Overview

overview

10

Static

static

3

47CA55CDB3...28.exe

windows7-x64

10

47CA55CDB3...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 00:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    47CA55CDB30DB720D739BFB73504B928.exe
  • Size 13.1MB
  • Sample240531-bacwvagg5v
  • SHA256 4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detected Akrien Game Cheat

    Akrien.wtf is a cheat program for a selection of online PC games.

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\47CA55CDB30DB720D739BFB73504B928.exe
    "C:\Users\Admin\AppData\Local\Temp\47CA55CDB30DB720D739BFB73504B928.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=cd8f60aa5fd1b833d79957e664b9bd42f71216a2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7d4,0x7d8,0x7dc,0x6c4,0x7e4,0x1579d84,0x1579d94,0x1579da4
        3⤵
        • Executes dropped EXE
        PID:940
      • C:\Users\Admin\AppData\Local\Temp\RBX-C000CA4D\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-C000CA4D\RobloxPlayerLauncher.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Users\Admin\AppData\Local\Temp\RBX-C000CA4D\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-C000CA4D\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=zflag --annotation=RobloxGitHash=eaa743d2ec5efd1c7cd63375418c0e423354daa2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x724,0x728,0x72c,0x534,0x734,0x1adb004,0x1adb014,0x1adb024
          4⤵
          • Executes dropped EXE
          PID:3772
        • C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1000
          • C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            5⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2380
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1464
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3884
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:856
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:2324
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3716
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTU4NTBDOEMtMENDMS00M0ZELUIxM0QtNUUyN0RFRDU4NzA2fSIgdXNlcmlkPSJ7Qzc0NUVEMkUtQUUxMi00MUI4LUI5MEYtRTI4ODJEM0MzRjY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyNkJEOEQ3Ni01Qjc4LTRCMjQtOTI4Mi1GOEY0RTc5NTdCQjd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7c0c5REo2TTNmWmtQN0NFTFdHbkR4Qyt3YVJhUUV1RUx2TElmWGsvTUF0Yz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5Mjc4NjY3NjUiIGluc3RhbGxfdGltZV9tcz0iOTU2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              PID:2404
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{E5850C8C-0CC1-43FD-B13D-5E27DED58706}" /silent
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2216
    • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
      "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1524
      • C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Browserfont\ilq5gxa6sOuB.vbe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3076
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Browserfont\hryZMJ.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4172
            • C:\Browserfont\refdhcp.exe
              "C:\Browserfont\refdhcp.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4060
              • C:\Browserfont\SearchApp.exe
                "C:\Browserfont\SearchApp.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Browserfont\SearchApp.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:348
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Browserfont\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1432
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Browserfont\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2156
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\de-DE\winlogon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4088
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4616
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\de-DE\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3692
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\fontdrvhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2932
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2712
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\System\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4280
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RobloxPlayerLauncherR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\RobloxPlayerLauncher.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:920
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RobloxPlayerLauncher" /sc ONLOGON /tr "'C:\Users\Default User\RobloxPlayerLauncher.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4872
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RobloxPlayerLauncherR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RobloxPlayerLauncher.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2280
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Browserfont\upfc.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3236
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Browserfont\upfc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:676
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Browserfont\upfc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\AkrienAntiLeak\System.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4416
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\AkrienAntiLeak\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1080
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\AkrienAntiLeak\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3240
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTU4NTBDOEMtMENDMS00M0ZELUIxM0QtNUUyN0RFRDU4NzA2fSIgdXNlcmlkPSJ7Qzc0NUVEMkUtQUUxMi00MUI4LUI5MEYtRTI4ODJEM0MzRjY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDMUEzQzlENS1FQjIwLTRGNTctQjkwRS01MzVEMzBBNzgyMDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7c0c5REo2TTNmWmtQN0NFTFdHbkR4Qyt3YVJhUUV1RUx2TElmWGsvTUF0Yz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MzM0MzY2NTkiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:8
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\MicrosoftEdge_X64_125.0.2535.79.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\EDGEMITMP_DB4DF.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\EDGEMITMP_DB4DF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\EDGEMITMP_DB4DF.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\EDGEMITMP_DB4DF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D56A56B7-C958-4D95-9CC5-A1947C292B28}\EDGEMITMP_DB4DF.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x22c,0x230,0x234,0x20c,0x238,0x7ff64aab4b18,0x7ff64aab4b24,0x7ff64aab4b30
          4⤵
          • Executes dropped EXE
          PID:2916
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTU4NTBDOEMtMENDMS00M0ZELUIxM0QtNUUyN0RFRDU4NzA2fSIgdXNlcmlkPSJ7Qzc0NUVEMkUtQUUxMi00MUI4LUI5MEYtRTI4ODJEM0MzRjY0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBRkRENjE4OC1GRDY0LTRCRTUtQjNFMi0xN0I1QUY5RUU1NkR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk0NjE3Njc5MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDYyNTY3MTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDcwOTMwNjA5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzcyMTgxMCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1CNDBMSmhURXNjOGZmR1JGUU9LSUFXRGx5QUlxWjlkMVowQWpkVFU2NDlzZzhyRVdPJTJmeHdHU0ZzVklhcGRaOFJ3Z2pmRUdpbjZpWU1IMlJNaTdnOFd3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczNzE2MDI0IiB0b3RhbD0iMTczNzE2MDI0IiBkb3dubG9hZF90aW1lX21zPSI0NTU2MiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0NzEwMTY2OTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDg1OTU2NTg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTM3NDk2NTM1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODI0IiBkb3dubG9hZF90aW1lX21zPSI1MjQ2OSIgZG93bmxvYWRlZD0iMTczNzE2MDI0IiB0b3RhbD0iMTczNzE2MDI0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NTE1MSIvPjwvYXBwPjwvcmVxdWVzdD4
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:4600

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        hryZMJ.bat
        • Path C:\Browserfont\hryZMJ.bat
        • Size 28B
        • SHA256 e078b7c5a7ccf4eaf88061eca9fe5d006ac8320ead0f0daacb4ef4024a729702
        • MD5 SHA1 SHA512
        Submit Download

        ilq5gxa6sOuB.vbe
        • Path C:\Browserfont\ilq5gxa6sOuB.vbe
        • Size 194B
        • SHA256 931546a195ef9c305d0a81ba4afb09749e64ef000bc44b4fedf1a4cf7eb63915
        • MD5 SHA1 SHA512
        Submit Download

        refdhcp.exe
        • Path C:\Browserfont\refdhcp.exe
        • Size 827KB
        • SHA256 73ff007b685023ead1e8a9840b6717f2b3cedd1d005ce578106e08bae0afdf43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe
        • Size 6.9MB
        • SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EdgeUpdate.dat
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\EdgeUpdate.dat
        • Size 12KB
        • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeComRegisterShellARM64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 179KB
        • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeUpdate.exe
        • Size 201KB
        • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 212KB
        • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateCore.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\MicrosoftEdgeUpdateCore.exe
        • Size 257KB
        • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTICE.TXT
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\NOTICE.TXT
        • Size 4KB
        • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdate.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdate.dll
        • Size 2.0MB
        • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_af.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_af.dll
        • Size 28KB
        • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_am.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_am.dll
        • Size 24KB
        • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ar.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_ar.dll
        • Size 26KB
        • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_as.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_as.dll
        • Size 28KB
        • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_az.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_az.dll
        • Size 29KB
        • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bg.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_bg.dll
        • Size 29KB
        • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn-IN.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_bn-IN.dll
        • Size 29KB
        • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_bn.dll
        • Size 29KB
        • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_bs.dll
        • Size 28KB
        • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca-Es-VALENCIA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        • Size 29KB
        • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_ca.dll
        • Size 30KB
        • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_cs.dll
        • Size 28KB
        • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cy.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_cy.dll
        • Size 28KB
        • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_da.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_da.dll
        • Size 28KB
        • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_de.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_de.dll
        • Size 30KB
        • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_el.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_el.dll
        • Size 30KB
        • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUCBEB.tmp\msedgeupdateres_en.dll
        • Size 27KB
        • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxStudioLauncherBeta.exe
        • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
        • Size 5.7MB
        • SHA256 8ef9489baa4b45a192e3483b6e37c2d9cf9135347cf28e2e012ed169a5609599
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerInstaller.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\RobloxPlayerInstaller.exe
        • Size 5.4MB
        • SHA256 eb02f21fab1f3bd916d086a5129c7d9aa39027cab9b61e93866e0bfb0724d85a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeWebview2Setup.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        • Size 1.5MB
        • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Program Files\MsEdgeCrashpad\settings.dat
        • Size 280B
        • SHA256 b18818488fcb81489f6442434a6d37958f33d57c45cfa7be769557771fbd5ee9
        • MD5 SHA1 SHA512
        Submit Download

        MicrosoftEdgeUpdate.log
        • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        • Size 88KB
        • SHA256 d7739efbe93ac9ad4c4bfbe7ee77b45c0057aad4fb2e975d007ac02fc6ca9b37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 2KB
        • SHA256 5692dd3c533822a635fda17c14b1ae0d3e81975b1171db0f59f30c4ee64fb8f0
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Size 1KB
        • SHA256 4c4b333092e2e38bae80906ea35ef57af96f9afa46d6892272a64b2564fd0832
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 1KB
        • SHA256 046f98c5955af4fa041daa6cd505c896b878f578fa24c2273a50a6bda8c8ce4f
        • MD5 SHA1 SHA512
        Submit Download

        B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Size 471B
        • SHA256 691c1610ffae828af0cbb45b92b846ea34ba18c0f3b676a8ca5f37fdfe155f9d
        • MD5 SHA1 SHA512
        Submit Download

        B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Size 2KB
        • SHA256 ec9f4ac42177cb43dfb0da24f385c90824957a26927e8dc20089ac4ebc2ec129
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 1KB
        • SHA256 0c90df7a9cf8fd56a51ec09690374de339e38fea6d7ae511dddb6293e6967a20
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 488B
        • SHA256 9eb73c89648b0d72dc669660a5a74f8ec7fddfb72905d2761aafa32aa1ff29d7
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 488B
        • SHA256 0c2a65f787cebe1af7f69ebfee733b7ca5f47be7021f0be22304517c06d7bbb5
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Size 434B
        • SHA256 886e31be9ef5a4c0797c7333aefdca13c39376fd05a3446c291b9b23c0be4cbf
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 0bfe6141ca1f8241d01193c47f2c2d48d7f247a0cf024933f3f79808bbcc8ef2
        • MD5 SHA1 SHA512
        Submit Download

        B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Size 400B
        • SHA256 72a1bc2c93b10c35b35f9a556139d21ffc64963b85e95894a3866b32686e9da5
        • MD5 SHA1 SHA512
        Submit Download

        B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Size 458B
        • SHA256 c029abf441f38269d6186913c224fa78292f8b1f7c17058503e39faf84ed6bf0
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 432B
        • SHA256 d5e8277c9130abcec170ce9c69e07a9f762d53e3d2d40c769aab75216d0cc567
        • MD5 SHA1 SHA512
        Submit Download

        zflag[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DD719OCW\zflag[1].json
        • Size 119B
        • SHA256 4dd63b8e839d53626af540214059c5c8a4711a257ba8c65c0f7367dac6d3750e
        • MD5 SHA1 SHA512
        Submit Download

        BatchIncrement[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WOBB13N1\BatchIncrement[1].json
        • Size 163B
        • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
        • MD5 SHA1 SHA512
        Submit Download

        PCClientBootstrapper[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB09K3UP\PCClientBootstrapper[1].json
        • Size 7KB
        • SHA256 b3e39a420751ff8cb0f8cdbbae28579e66c15f72138df41349ece029dbc61a85
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AkrienCrack.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
        • Size 1.1MB
        • SHA256 d37aa66005e6123a219328759e079126ce5ad078e0ad72041c7047309daf0455
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AkrienPremiumCrack.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
        • Size 9.0MB
        • SHA256 11ff80946d298ed531925658f63fd09dfb3a9d6c4a36cee57bbe569b9e378be4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AkrienPremiumCrackByHurminka.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
        • Size 9.7MB
        • SHA256 45f4d4b64e6a1ca96e51aec35bea9bdb72eb950e9810f1cbb95976dbf379089b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerLauncher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RBX-C000CA4D\RobloxPlayerLauncher.exe
        • Size 5.7MB
        • SHA256 4387634feeb838cbf3156a553ff0914b3cbbc3369a1179a3c6fa57c58b755017
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerLauncher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
        • Size 5.7MB
        • SHA256 2acc3e0879e4a71a6b08e2d6af7b238198d2eda73518b9394d82d00b010c9d7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
        • Size 40B
        • SHA256 20ba8871ad10c1af60a1d10a702f9115c748a95ea8c28d7fd7fe4474067f0716
        • MD5 SHA1 SHA512
        Submit Download

        memory/1524-85-0x0000000140000000-0x0000000141131000-memory.dmp
        Download

        memory/1524-83-0x00007FFAAD490000-0x00007FFAAD492000-memory.dmp
        Download

        memory/1524-84-0x00007FFAAD4A0000-0x00007FFAAD4A2000-memory.dmp
        Download

        memory/2380-465-0x0000000000520000-0x0000000000555000-memory.dmp
        Download

        memory/2380-466-0x00000000726D0000-0x00000000728E0000-memory.dmp
        Download

        memory/2380-472-0x00000000726D0000-0x00000000728E0000-memory.dmp
        Download

        memory/2380-527-0x0000000000520000-0x0000000000555000-memory.dmp
        Download

        memory/4060-154-0x0000000000850000-0x0000000000926000-memory.dmp
        Download