[10:42:01] root@localhost:~$ systemctl status defender.service
● defender.service - Windows Defender Service
Loaded: loaded (/etc/systemd/system/defender.service; enabled)
Active: failed (Result: exit-code) since Thu 2026-09-16 10:41:58
Process: 4821 ExecStart=/usr/bin/defender --daemon (code=exited, status=1/FAILURE)
Main PID: 4821 (code=exited, status=1/FAILURE)
[10:42:04] root@localhost:~$ journalctl -xe | tail -n 12
-- Logs begin at Thu 2026-09-16 10:41:58 UTC, end at Thu 2026-09-16 10:42:04 UTC --
[WARN] core.database: MFT integrity check failed
[WARN] fs.ntfs: volume signature mismatch on /dev/sda1
[ERROR] crypto.locker: unauthorized encryption detected on C:\Users\Public\*
[ERROR] net.remote: outbound connection to master-node-04.io:4444 established
[CRITICAL] sec.override: kernel-level hook installed at NtKrnl.exe!+0x4A2B
[CRITICAL] sec.override: firewall policy rewritten by remote process
-- Reached end of journal --
[10:42:07] root@localhost:~$ netstat -tnp | grep ESTABLISHED
tcp 0 0 192.168.1.42:52414 105.112.149.121:4444 ESTABLISHED 1337/malware
tcp 0 0 192.168.1.42:52415 91.219.236.14:4444 ESTABLISHED 1337/malware
tcp 0 0 192.168.1.42:52416 185.220.101.7:8443 ESTABLISHED 1337/malware
[10:42:11] root@localhost:~$ ps aux | grep -i crypto
root 1337 98.4 4.2 8542 2104 ? R Oct19 412:38 cryptolock --silent --key=0xDEADBEEF
[10:42:14] root@localhost:~$ █
