Overview

overview

8

Static

static

3

boot.exe

windows10-2004-x64

8

boot.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    9s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 01:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    boot.exe
  • Size 29KB
  • Sample260627-bxt4msf19z
  • SHA256 cbd723d0915286600f09b7a646780fa13e495930450fd2430c70b4fd2197b30f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasionexecutionpersistence

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 32 IoCs
    persistence
  • Drops desktop.ini file(s) 5 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Modifies boot configuration data using bcdedit 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\boot.exe
    "C:\Users\Admin\AppData\Local\Temp\boot.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
      2⤵
      • Indicator Removal: Clear Persistence
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Windows\system32\schtasks.exe
        schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
        3⤵
          PID:2368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3348
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
        2⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
          3⤵
            PID:5424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1320
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {bootmgr} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:5024
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5600
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {default} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:1300
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:696
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {memdiag} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:2624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {current} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:5432
      • C:\$Recycle.Bin\System Volume Information\winlogon.exe
        "C:\$Recycle.Bin\System Volume Information\winlogon.exe"
        1⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
          2⤵
          • Indicator Removal: Clear Persistence
          • Suspicious use of WriteProcessMemory
          PID:2512
          • C:\Windows\System32\schtasks.exe
            schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
            3⤵
              PID:2908
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3288
            • C:\Windows\System32\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2228
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
            2⤵
            • Indicator Removal: Clear Persistence
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\System32\schtasks.exe
              schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
              3⤵
                PID:2428
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2968
              • C:\Windows\System32\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1772
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5960
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {bootmgr} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4740
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4588
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {default} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4736
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
              2⤵
                PID:3604
                • C:\Windows\System32\bcdedit.exe
                  bcdedit /deletevalue {memdiag} path
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:5836
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                2⤵
                  PID:108
                  • C:\Windows\System32\bcdedit.exe
                    bcdedit /deletevalue {current} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:256
              • C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                1⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Writes to the Master Boot Record (MBR)
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:1808
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                  2⤵
                  • Indicator Removal: Clear Persistence
                  • Suspicious use of WriteProcessMemory
                  PID:5344
                  • C:\Windows\System32\schtasks.exe
                    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                    3⤵
                      PID:476
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5576
                    • C:\Windows\System32\schtasks.exe
                      schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5840
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                    2⤵
                    • Indicator Removal: Clear Persistence
                    • Suspicious use of WriteProcessMemory
                    PID:3244
                    • C:\Windows\System32\schtasks.exe
                      schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                      3⤵
                        PID:692
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5504
                      • C:\Windows\System32\schtasks.exe
                        schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:5904
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1888
                      • C:\Windows\System32\bcdedit.exe
                        bcdedit /deletevalue {bootmgr} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:5376
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                      2⤵
                        PID:1860
                        • C:\Windows\System32\bcdedit.exe
                          bcdedit /deletevalue {default} path
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:4536
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                        2⤵
                          PID:4208
                          • C:\Windows\System32\bcdedit.exe
                            bcdedit /deletevalue {memdiag} path
                            3⤵
                            • Modifies boot configuration data using bcdedit
                            PID:1756
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                          2⤵
                            PID:5024
                            • C:\Windows\System32\bcdedit.exe
                              bcdedit /deletevalue {current} path
                              3⤵
                              • Modifies boot configuration data using bcdedit
                              PID:5688
                        • C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
                          C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
                          1⤵
                          • Drops file in Drivers directory
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Writes to the Master Boot Record (MBR)
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Suspicious use of WriteProcessMemory
                          PID:2508
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                            2⤵
                            • Indicator Removal: Clear Persistence
                            • Suspicious use of WriteProcessMemory
                            PID:4508
                            • C:\Windows\System32\schtasks.exe
                              schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                              3⤵
                                PID:4788
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:252
                              • C:\Windows\System32\schtasks.exe
                                schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5088
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                              2⤵
                              • Indicator Removal: Clear Persistence
                              • Suspicious use of WriteProcessMemory
                              PID:2088
                              • C:\Windows\System32\schtasks.exe
                                schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                                3⤵
                                  PID:2564
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1224
                                • C:\Windows\System32\schtasks.exe
                                  schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5572
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2400
                                • C:\Windows\System32\bcdedit.exe
                                  bcdedit /deletevalue {bootmgr} path
                                  3⤵
                                  • Modifies boot configuration data using bcdedit
                                  PID:3964
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1132
                                • C:\Windows\System32\bcdedit.exe
                                  bcdedit /deletevalue {default} path
                                  3⤵
                                  • Modifies boot configuration data using bcdedit
                                  PID:2864
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                                2⤵
                                  PID:1280
                                  • C:\Windows\System32\bcdedit.exe
                                    bcdedit /deletevalue {memdiag} path
                                    3⤵
                                    • Modifies boot configuration data using bcdedit
                                    PID:3780
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                                  2⤵
                                    PID:5872
                                    • C:\Windows\System32\bcdedit.exe
                                      bcdedit /deletevalue {current} path
                                      3⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:4604
                                • C:\Windows\System32\drivers\Pyrite.dat
                                  C:\Windows\System32\drivers\Pyrite.dat
                                  1⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Writes to the Master Boot Record (MBR)
                                  • Drops file in System32 directory
                                  • Drops file in Program Files directory
                                  • Suspicious use of WriteProcessMemory
                                  PID:2016
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                                    2⤵
                                    • Indicator Removal: Clear Persistence
                                    • Suspicious use of WriteProcessMemory
                                    PID:1572
                                    • C:\Windows\System32\schtasks.exe
                                      schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                                      3⤵
                                        PID:1568
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3292
                                      • C:\Windows\System32\schtasks.exe
                                        schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                        3⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4804
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                                      2⤵
                                      • Indicator Removal: Clear Persistence
                                      • Suspicious use of WriteProcessMemory
                                      PID:5744
                                      • C:\Windows\System32\schtasks.exe
                                        schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                                        3⤵
                                          PID:1684
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4560
                                        • C:\Windows\System32\schtasks.exe
                                          schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5124
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4936
                                        • C:\Windows\System32\bcdedit.exe
                                          bcdedit /deletevalue {bootmgr} path
                                          3⤵
                                          • Modifies boot configuration data using bcdedit
                                          PID:5368
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4576
                                        • C:\Windows\System32\bcdedit.exe
                                          bcdedit /deletevalue {default} path
                                          3⤵
                                          • Modifies boot configuration data using bcdedit
                                          PID:3404
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                                        2⤵
                                          PID:4308
                                          • C:\Windows\System32\bcdedit.exe
                                            bcdedit /deletevalue {memdiag} path
                                            3⤵
                                            • Modifies boot configuration data using bcdedit
                                            PID:4908
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                                          2⤵
                                            PID:3008
                                            • C:\Windows\System32\bcdedit.exe
                                              bcdedit /deletevalue {current} path
                                              3⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:3468
                                        • C:\Windows\system32\sihost.exe
                                          sihost.exe
                                          1⤵
                                            PID:2420
                                            • C:\Windows\explorer.exe
                                              explorer.exe /LOADSAVEDWINDOWS
                                              2⤵
                                                PID:944
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
                                              1⤵
                                                PID:3468
                                              • C:\Windows\system32\userinit.exe
                                                C:\Windows\system32\userinit.exe
                                                1⤵
                                                  PID:1072
                                                  • C:\Windows\Explorer.EXE
                                                    C:\Windows\Explorer.EXE
                                                    2⤵
                                                      PID:4516

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        iconcache_48.db
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                        • Size 1024KB
                                                        • SHA256 5d58db9702f5b966f21a3acb980f6b2e50cc5a524afbed5be2ba8c8046aaac60
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        iconcache_48.db
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                        • Size 1024KB
                                                        • SHA256 8449c7d3638353edb5f2f0f9d660a9ea4c4eae247a056db6e58c3534a0fdeb66
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        iconcache_idx.db
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                        • Size 7KB
                                                        • SHA256 42833ee211714076825d9642a7f6f5df059dbed3f853f907392c4b862aa77cde
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        iconcache_idx.db
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                        • Size 7KB
                                                        • SHA256 f74954a6d18c790b1592fdfb671e8979c3ae20ca687107c3c1b5f8ecc8e9a6d4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        svchost.exe
                                                        • Path C:\Windows\System32\spool\drivers\W32X86\svchost.exe
                                                        • Size 29KB
                                                        • SHA256 cbd723d0915286600f09b7a646780fa13e495930450fd2430c70b4fd2197b30f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download