Overview

overview

10

Static

static

3

4cc156f578...a1.exe

windows7-x64

10

4cc156f578...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 01:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe
  • Size 13.1MB
  • Sample240601-bmbvbadb95
  • SHA256 4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 42 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detected Akrien Game Cheat

    Akrien.wtf is a cheat program for a selection of online PC games.

  • Creates scheduled task(s) 1 TTPs 42 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe
    "C:\Users\Admin\AppData\Local\Temp\4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=cd8f60aa5fd1b833d79957e664b9bd42f71216a2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x7a8,0x7ac,0x7b0,0x7a4,0x7b8,0x1b89d84,0x1b89d94,0x1b89da4
        3⤵
        • Executes dropped EXE
        PID:3688
      • C:\Users\Admin\AppData\Local\Temp\RBX-A588BAED\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-A588BAED\RobloxPlayerLauncher.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Users\Admin\AppData\Local\Temp\RBX-A588BAED\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-A588BAED\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=eaa743d2ec5efd1c7cd63375418c0e423354daa2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x560,0x564,0x568,0x53c,0x5a0,0xe3b004,0xe3b014,0xe3b024
          4⤵
          • Executes dropped EXE
          PID:2112
        • C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:4384
          • C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            5⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:672
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:5776
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:5796
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:5824
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:5856
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:5936
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTM4RTVDN0MtMTlBRS00NkMwLTg4Q0EtOUE0RjBFQUI5OUNGfSIgdXNlcmlkPSJ7N0FDNkM2QTItMUUzQy00NEFBLTk4RDgtNEU3RTBERTg2MzM0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4MUI5RTc4Ny0xNjdFLTQ0MDQtQjZBQi0wRjhFN0E4RTYyOTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NjkwODY1NjUiIGluc3RhbGxfdGltZV9tcz0iMTExMCIvPjwvYXBwPjwvcmVxdWVzdD4
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              PID:3868
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{E38E5C7C-19AE-46C0-88CA-9A4F0EAB99CF}" /silent
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3336
    • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
      "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4524
      • C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Browserfont\ilq5gxa6sOuB.vbe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Browserfont\hryZMJ.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4600
            • C:\Browserfont\refdhcp.exe
              "C:\Browserfont\refdhcp.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3352
              • C:\Users\Public\Registry.exe
                "C:\Users\Public\Registry.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5364
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4820
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1364
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1456
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3660
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2156
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2372
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:544
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3424
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2504
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Windows\Logs\MeasuredBoot\WaaSMedicAgent.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4412
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Logs\MeasuredBoot\WaaSMedicAgent.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:956
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Logs\MeasuredBoot\WaaSMedicAgent.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1264
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrackA" /sc MINUTE /mo 8 /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4864
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrack" /sc ONLOGON /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2516
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrackA" /sc MINUTE /mo 12 /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:388
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Registry.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2448
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Registry.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4996
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Registry.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4668
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Browserfont\explorer.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4432
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Browserfont\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4568
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Browserfont\explorer.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3536
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrackA" /sc MINUTE /mo 6 /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4964
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrack" /sc ONLOGON /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2204
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "AkrienPremiumCrackA" /sc MINUTE /mo 10 /tr "'C:\AkrienAntiLeak\AkrienPremiumCrack.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3252
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\AkrienAntiLeak\fontdrvhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1472
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\AkrienAntiLeak\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3468
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\AkrienAntiLeak\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2872
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\wininit.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4780
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4608
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2640
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4784
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dwm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3228
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5004
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:456
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3964
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2992
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1248
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3208
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3684
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2608
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks system information in the registry
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:5480
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTM4RTVDN0MtMTlBRS00NkMwLTg4Q0EtOUE0RjBFQUI5OUNGfSIgdXNlcmlkPSJ7N0FDNkM2QTItMUUzQy00NEFBLTk4RDgtNEU3RTBERTg2MzM0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4RTA4MUQ3Ny1GMENGLTRFREMtQTM4OS02NjFFMjE1OUNGN0R9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NzQ0MzY2OTMiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:1184
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\MicrosoftEdge_X64_125.0.2535.79.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5140
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\EDGEMITMP_E9712.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\EDGEMITMP_E9712.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\EDGEMITMP_E9712.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\EDGEMITMP_E9712.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{33C57B65-B593-42CD-AE46-490EA11E13CB}\EDGEMITMP_E9712.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff790f84b18,0x7ff790f84b24,0x7ff790f84b30
          4⤵
          • Executes dropped EXE
          PID:3040
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTM4RTVDN0MtMTlBRS00NkMwLTg4Q0EtOUE0RjBFQUI5OUNGfSIgdXNlcmlkPSJ7N0FDNkM2QTItMUUzQy00NEFBLTk4RDgtNEU3RTBERTg2MzM0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBM0IxRTVFQy0yRUJFLTRDMDgtQjFGRS01OUEyQUQ3QjY3Mzd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg4NjY3NjY2MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4ODY5NTcwMzEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTQwNjU2ODU5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzgwOTM1NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GaFNZeFdDY1lFJTJiMzZORHlDRDcwbW1nc25ZZ200UnJGeU5OSGVaY0ZXRnd6WmdKTW5yME5nYSUyZkhWaEJ5Y0pEJTJmWkx3JTJiandFUjJLeVZDJTJiekI4QzM5ckElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIGRvd25sb2FkX3RpbWVfbXM9IjU4MTA0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU0MDczNjY5MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1NTY3MDY3OTMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYwMTIxNDY3NTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI4MTkiIGRvd25sb2FkX3RpbWVfbXM9IjY1MzcyIiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ1NTQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      PID:1852

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        hryZMJ.bat
        • Path C:\Browserfont\hryZMJ.bat
        • Size 28B
        • SHA256 e078b7c5a7ccf4eaf88061eca9fe5d006ac8320ead0f0daacb4ef4024a729702
        • MD5 SHA1 SHA512
        Submit Download

        ilq5gxa6sOuB.vbe
        • Path C:\Browserfont\ilq5gxa6sOuB.vbe
        • Size 194B
        • SHA256 931546a195ef9c305d0a81ba4afb09749e64ef000bc44b4fedf1a4cf7eb63915
        • MD5 SHA1 SHA512
        Submit Download

        refdhcp.exe
        • Path C:\Browserfont\refdhcp.exe
        • Size 827KB
        • SHA256 73ff007b685023ead1e8a9840b6717f2b3cedd1d005ce578106e08bae0afdf43
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe
        • Size 6.9MB
        • SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EdgeUpdate.dat
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\EdgeUpdate.dat
        • Size 12KB
        • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeComRegisterShellARM64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeComRegisterShellARM64.exe
        • Size 179KB
        • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdate.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeUpdate.exe
        • Size 201KB
        • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateComRegisterShell64.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 212KB
        • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeUpdateCore.exe
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\MicrosoftEdgeUpdateCore.exe
        • Size 257KB
        • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NOTICE.TXT
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\NOTICE.TXT
        • Size 4KB
        • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdate.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdate.dll
        • Size 2.0MB
        • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_af.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_af.dll
        • Size 28KB
        • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_am.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_am.dll
        • Size 24KB
        • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ar.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_ar.dll
        • Size 26KB
        • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_as.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_as.dll
        • Size 28KB
        • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_az.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_az.dll
        • Size 29KB
        • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bg.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_bg.dll
        • Size 29KB
        • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn-IN.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_bn-IN.dll
        • Size 29KB
        • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bn.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_bn.dll
        • Size 29KB
        • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_bs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_bs.dll
        • Size 28KB
        • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca-Es-VALENCIA.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
        • Size 29KB
        • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_ca.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_ca.dll
        • Size 30KB
        • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cs.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_cs.dll
        • Size 28KB
        • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_cy.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_cy.dll
        • Size 28KB
        • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msedgeupdateres_en.dll
        • Path C:\Program Files (x86)\Microsoft\Temp\EUB91E.tmp\msedgeupdateres_en.dll
        • Size 27KB
        • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxStudioLauncherBeta.exe
        • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
        • Size 5.7MB
        • SHA256 8ef9489baa4b45a192e3483b6e37c2d9cf9135347cf28e2e012ed169a5609599
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerInstaller.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\RobloxPlayerInstaller.exe
        • Size 5.4MB
        • SHA256 eb02f21fab1f3bd916d086a5129c7d9aa39027cab9b61e93866e0bfb0724d85a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MicrosoftEdgeWebview2Setup.exe
        • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
        • Size 1.5MB
        • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Program Files\MsEdgeCrashpad\settings.dat
        • Size 280B
        • SHA256 49daa9b409e6dbf866df53c899d038d28ed0852e2e3283d5f0636456d4a270b5
        • MD5 SHA1 SHA512
        Submit Download

        MicrosoftEdgeUpdate.log
        • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
        • Size 101KB
        • SHA256 672183692542d39b73c43121d338854a41c07c50eee8bb67d841854bdd3742af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 2KB
        • SHA256 5692dd3c533822a635fda17c14b1ae0d3e81975b1171db0f59f30c4ee64fb8f0
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Size 1KB
        • SHA256 4af99f75f4c537e7ed6d52a20291e5dfb5e08511c833c2e707d9c043de36eb08
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 1KB
        • SHA256 046f98c5955af4fa041daa6cd505c896b878f578fa24c2273a50a6bda8c8ce4f
        • MD5 SHA1 SHA512
        Submit Download

        B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Size 471B
        • SHA256 460f877a5d9ae3a59cde615bce6f53b45a8272b8200c25368f438288fcd01578
        • MD5 SHA1 SHA512
        Submit Download

        B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Size 2KB
        • SHA256 10a550bfcb42fd363d334563535df85368d90575cc59f2e81c9f851b4203cc10
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 1KB
        • SHA256 27cb2fca8ffd052839a188fcbf708de2157145913b14e88675c151a780b5c2dd
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 488B
        • SHA256 e6396d58a306bbc89e6ece70963112fbe8d982a64605e3cfa3630ee4bbf28653
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
        • Size 488B
        • SHA256 06545447189e629a37aa9847dd53f46c42b7f3722a6c9b2340fd7700413a2ba8
        • MD5 SHA1 SHA512
        Submit Download

        75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
        • Size 434B
        • SHA256 6c99f79b080ff52c35cf64b9acc6a034c39609eec50b54270a82d1b30d43c18f
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 f7570432c8954f1d03006a7fdba7c1a4cfb9647c34e2cf70ef5c171fcbebbbd3
        • MD5 SHA1 SHA512
        Submit Download

        B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
        • Size 400B
        • SHA256 9d1cdd21b2f58a1e6d8ad56c0c4502013bbf1ce6ee331971606dd9fabc5bdfb0
        • MD5 SHA1 SHA512
        Submit Download

        B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
        • Size 458B
        • SHA256 6093f3c97a1769d23520b5927981ca314da35dd5329eaef8e2c1d4ea4760bc63
        • MD5 SHA1 SHA512
        Submit Download

        BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
        • Size 432B
        • SHA256 376aa4fd9db249ca53b73c9d69dfad3248931caf13c723a1a9a07b5250925e95
        • MD5 SHA1 SHA512
        Submit Download

        version-d6abc3b106a04c5c-rbxPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7KQBJSM0\version-d6abc3b106a04c5c-rbxPkgManifest[1].txt
        • Size 1KB
        • SHA256 921309bc0c4f5befcd3c44362d8898845228063d502a0f6da2ef48d741547aad
        • MD5 SHA1 SHA512
        Submit Download

        WindowsPlayer[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMPDKH9Q\WindowsPlayer[1].json
        • Size 119B
        • SHA256 4dd63b8e839d53626af540214059c5c8a4711a257ba8c65c0f7367dac6d3750e
        • MD5 SHA1 SHA512
        Submit Download

        version-d6abc3b106a04c5c-rbxBootstrapperPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EO73ZF47\version-d6abc3b106a04c5c-rbxBootstrapperPkgManifest[1].txt
        • Size 82B
        • SHA256 8134540f2d005b02845d4445fe748737a9103d25b152aeed6856703073358e96
        • MD5 SHA1 SHA512
        Submit Download

        BatchIncrement[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\BatchIncrement[1].json
        • Size 163B
        • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
        • MD5 SHA1 SHA512
        Submit Download

        PCClientBootstrapper[1].json
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\PCClientBootstrapper[1].json
        • Size 6KB
        • SHA256 ba1166a1b62e506fb2aab08d8022303eb600211ca40ea412fb349a5da4a27d57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        version-d6abc3b106a04c5c-rbxInstallerPkgManifest[1].txt
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\version-d6abc3b106a04c5c-rbxInstallerPkgManifest[1].txt
        • Size 83B
        • SHA256 4c8ab5db7c2b45deb80b9525b2ab4015214756f76654ce598721316ed57d72b8
        • MD5 SHA1 SHA512
        Submit Download

        AkrienCrack.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
        • Size 1.1MB
        • SHA256 d37aa66005e6123a219328759e079126ce5ad078e0ad72041c7047309daf0455
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AkrienPremiumCrack.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
        • Size 9.0MB
        • SHA256 11ff80946d298ed531925658f63fd09dfb3a9d6c4a36cee57bbe569b9e378be4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AkrienPremiumCrackByHurminka.exe
        • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
        • Size 9.7MB
        • SHA256 45f4d4b64e6a1ca96e51aec35bea9bdb72eb950e9810f1cbb95976dbf379089b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerLauncher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RBX-A588BAED\RobloxPlayerLauncher.exe
        • Size 5.7MB
        • SHA256 4387634feeb838cbf3156a553ff0914b3cbbc3369a1179a3c6fa57c58b755017
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RobloxPlayerLauncher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
        • Size 5.7MB
        • SHA256 2acc3e0879e4a71a6b08e2d6af7b238198d2eda73518b9394d82d00b010c9d7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
        • Size 40B
        • SHA256 914b0329ed6dc3ca102923eea53b28eaa917ccd20e584cd7f91b8e1cc3ce91e8
        • MD5 SHA1 SHA512
        Submit Download

        memory/672-483-0x0000000072900000-0x0000000072B10000-memory.dmp
        Download

        memory/672-478-0x0000000072900000-0x0000000072B10000-memory.dmp
        Download

        memory/672-477-0x00000000001F0000-0x0000000000225000-memory.dmp
        Download

        memory/672-541-0x00000000001F0000-0x0000000000225000-memory.dmp
        Download

        memory/3352-177-0x00000000009C0000-0x0000000000A96000-memory.dmp
        Download

        memory/4524-81-0x00007FFE75E40000-0x00007FFE75E42000-memory.dmp
        Download

        memory/4524-82-0x0000000140000000-0x0000000141131000-memory.dmp
        Download

        memory/4524-80-0x00007FFE75E30000-0x00007FFE75E32000-memory.dmp
        Download