Overview

overview

10

Static

static

3

4cc156f578...a1.exe

windows7-x64

10

4cc156f578...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 18:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe
  • Size 13.1MB
  • Sample240601-w22dqsba2v
  • SHA256 4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detected Akrien Game Cheat

    Akrien.wtf is a cheat program for a selection of online PC games.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe
    "C:\Users\Admin\AppData\Local\Temp\4cc156f578777710f3ce0c217664b9830ddfcab407f0c6de0cae10d5501d1ca1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
        C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=zflag --annotation=RobloxGitHash=cd8f60aa5fd1b833d79957e664b9bd42f71216a2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x798,0x6bc,0x6c0,0x790,0x6cc,0x1929d84,0x1929d94,0x1929da4
        3⤵
        • Executes dropped EXE
        PID:4804
      • C:\Users\Admin\AppData\Local\Temp\RBX-28B275E8\RobloxPlayerLauncher.exe
        "C:\Users\Admin\AppData\Local\Temp\RBX-28B275E8\RobloxPlayerLauncher.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Users\Admin\AppData\Local\Temp\RBX-28B275E8\RobloxPlayerLauncher.exe
          C:\Users\Admin\AppData\Local\Temp\RBX-28B275E8\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=eaa743d2ec5efd1c7cd63375418c0e423354daa2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x56c,0x570,0x574,0x544,0x57c,0x161b004,0x161b014,0x161b024
          4⤵
          • Executes dropped EXE
          PID:4440
        • C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          MicrosoftEdgeWebview2Setup.exe /silent /install
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
            5⤵
            • Sets file execution options in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks system information in the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4536
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:3664
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3812
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:4524
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:4668
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Registers COM server for autorun
                • Modifies registry class
                PID:3056
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTBFNjc2NEMtQTgxOS00QUEwLUFFN0QtMTEyOERFRTk2NzNEfSIgdXNlcmlkPSJ7QzU4QTRERUMtOTlEMS00ODNDLUFDNUEtQTg4MjhCNUJFMEQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxRUNDNzAyRS1CRjRCLTRENEMtQUYzRS1BNTgyQTM1NkM2RDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNTE4OTM3NjUiIGluc3RhbGxfdGltZV9tcz0iODQ1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              PID:4384
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{E0E6764C-A819-4AA0-AE7D-1128DEE9673D}" /silent
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5056
    • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
      "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3656
      • C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
        "C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Browserfont\ilq5gxa6sOuB.vbe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Browserfont\hryZMJ.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2884
            • C:\Browserfont\refdhcp.exe
              "C:\Browserfont\refdhcp.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pqEIJQJY9p.bat"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1696
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  8⤵
                    PID:1296
                  • C:\Program Files\Windows Sidebar\spoolsv.exe
                    "C:\Program Files\Windows Sidebar\spoolsv.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2456
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:904
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:776
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1504
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\AkrienAntiLeak\Registry.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1604
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\AkrienAntiLeak\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2988
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\AkrienAntiLeak\Registry.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:1748
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\AkrienAntiLeak\conhost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:2192
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\AkrienAntiLeak\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:3320
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\AkrienAntiLeak\conhost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Creates scheduled task(s)
      PID:4744
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTBFNjc2NEMtQTgxOS00QUEwLUFFN0QtMTEyOERFRTk2NzNEfSIgdXNlcmlkPSJ7QzU4QTRERUMtOTlEMS00ODNDLUFDNUEtQTg4MjhCNUJFMEQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0OTkyRjA5OC0yQjQ0LTQ4N0YtOEU4Ni1BMzNCREI3NUZCQzh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNTY4MTM5MjAiLz48L2FwcD48L3JlcXVlc3Q-
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        PID:4876
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\MicrosoftEdge_X64_125.0.2535.79.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\EDGEMITMP_EBAC5.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\EDGEMITMP_EBAC5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:3140
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\EDGEMITMP_EBAC5.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\EDGEMITMP_EBAC5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D4AB318F-48FE-449F-BCC3-E639ABB5A5E6}\EDGEMITMP_EBAC5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff68f424b18,0x7ff68f424b24,0x7ff68f424b30
            4⤵
            • Executes dropped EXE
            PID:2816
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTBFNjc2NEMtQTgxOS00QUEwLUFFN0QtMTEyOERFRTk2NzNEfSIgdXNlcmlkPSJ7QzU4QTRERUMtOTlEMS00ODNDLUFDNUEtQTg4MjhCNUJFMEQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswRkNEMUVBNC0zREY1LTQ0OUUtQTE3Qy1FQkMzMzY0ODU2NkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA2NzMxNDEwMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNjczNzM3MTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzMzMDMzNjQ5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzg3MTIxMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1EYmJGbEtGbTg2RnVuVU5GdDZkWkppSlhPU0VIJTJiYWVjWVZDeEpZaDhRSlFhMkdkSTVJUFM0dm1TZ3M2bmolMmJWaGxOMDlRaGxiMXBuVk43VGN1eTZFbUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIGRvd25sb2FkX3RpbWVfbXM9IjE4OTM4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTMzMzExMzc5NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUzNDg0MTM3OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4MDg4NTM2NjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NjEiIGRvd25sb2FkX3RpbWVfbXM9IjI2NTU5IiBkb3dubG9hZGVkPSIxNzM3MTYwMjQiIHRvdGFsPSIxNzM3MTYwMjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ2MDM2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        PID:1320

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          hryZMJ.bat
          • Path C:\Browserfont\hryZMJ.bat
          • Size 28B
          • SHA256 e078b7c5a7ccf4eaf88061eca9fe5d006ac8320ead0f0daacb4ef4024a729702
          • MD5 SHA1 SHA512
          Submit Download

          ilq5gxa6sOuB.vbe
          • Path C:\Browserfont\ilq5gxa6sOuB.vbe
          • Size 194B
          • SHA256 931546a195ef9c305d0a81ba4afb09749e64ef000bc44b4fedf1a4cf7eb63915
          • MD5 SHA1 SHA512
          Submit Download

          refdhcp.exe
          • Path C:\Browserfont\refdhcp.exe
          • Size 827KB
          • SHA256 73ff007b685023ead1e8a9840b6717f2b3cedd1d005ce578106e08bae0afdf43
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe
          • Size 6.9MB
          • SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          EdgeUpdate.dat
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\EdgeUpdate.dat
          • Size 12KB
          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeComRegisterShellARM64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeComRegisterShellARM64.exe
          • Size 179KB
          • SHA256 35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdate.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeUpdate.exe
          • Size 201KB
          • SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateComRegisterShell64.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
          • Size 212KB
          • SHA256 4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeUpdateCore.exe
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\MicrosoftEdgeUpdateCore.exe
          • Size 257KB
          • SHA256 9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NOTICE.TXT
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\NOTICE.TXT
          • Size 4KB
          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdate.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdate.dll
          • Size 2.0MB
          • SHA256 d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_af.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_af.dll
          • Size 28KB
          • SHA256 a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_am.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_am.dll
          • Size 24KB
          • SHA256 986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ar.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_ar.dll
          • Size 26KB
          • SHA256 e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_as.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_as.dll
          • Size 28KB
          • SHA256 3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_az.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_az.dll
          • Size 29KB
          • SHA256 5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bg.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_bg.dll
          • Size 29KB
          • SHA256 a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn-IN.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_bn-IN.dll
          • Size 29KB
          • SHA256 5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bn.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_bn.dll
          • Size 29KB
          • SHA256 e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_bs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_bs.dll
          • Size 28KB
          • SHA256 99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca-Es-VALENCIA.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
          • Size 29KB
          • SHA256 2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_ca.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_ca.dll
          • Size 30KB
          • SHA256 8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cs.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_cs.dll
          • Size 28KB
          • SHA256 e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_cy.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_cy.dll
          • Size 28KB
          • SHA256 252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_da.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_da.dll
          • Size 28KB
          • SHA256 fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_de.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_de.dll
          • Size 30KB
          • SHA256 061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_el.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_el.dll
          • Size 30KB
          • SHA256 223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en-GB.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_en-GB.dll
          • Size 27KB
          • SHA256 fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_en.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_en.dll
          • Size 27KB
          • SHA256 9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es-419.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_es-419.dll
          • Size 29KB
          • SHA256 55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_es.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_es.dll
          • Size 28KB
          • SHA256 e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msedgeupdateres_et.dll
          • Path C:\Program Files (x86)\Microsoft\Temp\EUFE74.tmp\msedgeupdateres_et.dll
          • Size 28KB
          • SHA256 f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxStudioLauncherBeta.exe
          • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioLauncherBeta.exe
          • Size 5.7MB
          • SHA256 8ef9489baa4b45a192e3483b6e37c2d9cf9135347cf28e2e012ed169a5609599
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerInstaller.exe
          • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\RobloxPlayerInstaller.exe
          • Size 5.4MB
          • SHA256 eb02f21fab1f3bd916d086a5129c7d9aa39027cab9b61e93866e0bfb0724d85a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MicrosoftEdgeWebview2Setup.exe
          • Path C:\Program Files (x86)\Roblox\Versions\version-d6abc3b106a04c5c\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
          • Size 1.5MB
          • SHA256 921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Program Files\MsEdgeCrashpad\settings.dat
          • Size 280B
          • SHA256 9b97a3f74a2dcd07bca7df8d91f5a6d95b15ee7c3f36f0b05d78d51cbc2748c6
          • MD5 SHA1 SHA512
          Submit Download

          MicrosoftEdgeUpdate.log
          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
          • Size 59KB
          • SHA256 3badda5dfb8e6265a4ec7abefe796326c0bbdfe1f969f21834c65f8f4f8611f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Size 2KB
          • SHA256 9db668f073799480d1e9b934785cbd0f216c52fc3de394f5213bb51252ecdb3d
          • MD5 SHA1 SHA512
          Submit Download

          75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Size 1KB
          • SHA256 a2e097216608967d8f44a6baee17157048adb03cc53d084ade665fdbb2a8fd0c
          • MD5 SHA1 SHA512
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Size 1KB
          • SHA256 046f98c5955af4fa041daa6cd505c896b878f578fa24c2273a50a6bda8c8ce4f
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 471B
          • SHA256 8a2263180a9fd63b8294d0ecd37b034ee820b2cb3836ab43da34692f57d1d057
          • MD5 SHA1 SHA512
          Submit Download

          B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Size 2KB
          • SHA256 fcd800f8cfa1d990536b8727975c05283662c869b8b8b20d976cdbeb630a468d
          • MD5 SHA1 SHA512
          Submit Download

          BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Size 1KB
          • SHA256 6268ef1b8d4b8aca2bec3c4854c34d361fdd92f2e5286999ae270918842d9c3b
          • MD5 SHA1 SHA512
          Submit Download

          07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
          • Size 488B
          • SHA256 71a2321580c332f1026e9b47d374d01c0a86825fd5657d8f59462415092fb35a
          • MD5 SHA1 SHA512
          Submit Download

          75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
          • Size 434B
          • SHA256 504e97cc8db0b94f32a634857f4b25be3d16ec87acf7c7849f76d72860dda402
          • MD5 SHA1 SHA512
          Submit Download

          B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          • Size 482B
          • SHA256 cf535bc63da8de9a8b4f56c8eaa1abfd1be92e41dbc2e7d12b8b43754d1d89dc
          • MD5 SHA1 SHA512
          Submit Download

          B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          • Size 400B
          • SHA256 a4005cef1718a44308f22af6590b7ddd631d0614ba35111f8f210be883ed16f7
          • MD5 SHA1 SHA512
          Submit Download

          B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
          • Size 458B
          • SHA256 86fecab5b958c006ddf7a46954355789f89878b99624d0c5f7810d68726925a9
          • MD5 SHA1 SHA512
          Submit Download

          BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
          • Size 432B
          • SHA256 ff5e0de3a3801df23329cd299925fb48f3c8ee482045d53160c5e3a30a4b0fb2
          • MD5 SHA1 SHA512
          Submit Download

          PCClientBootstrapper[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\PCClientBootstrapper[1].json
          • Size 6KB
          • SHA256 ba1166a1b62e506fb2aab08d8022303eb600211ca40ea412fb349a5da4a27d57
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          WindowsPlayer[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\WindowsPlayer[1].json
          • Size 119B
          • SHA256 4dd63b8e839d53626af540214059c5c8a4711a257ba8c65c0f7367dac6d3750e
          • MD5 SHA1 SHA512
          Submit Download

          BatchIncrement[1].json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\BatchIncrement[1].json
          • Size 163B
          • SHA256 b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
          • MD5 SHA1 SHA512
          Submit Download

          AkrienCrack.exe
          • Path C:\Users\Admin\AppData\Local\Temp\AkrienCrack.exe
          • Size 1.1MB
          • SHA256 d37aa66005e6123a219328759e079126ce5ad078e0ad72041c7047309daf0455
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AkrienPremiumCrack.exe
          • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrack.exe
          • Size 9.0MB
          • SHA256 11ff80946d298ed531925658f63fd09dfb3a9d6c4a36cee57bbe569b9e378be4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AkrienPremiumCrackByHurminka.exe
          • Path C:\Users\Admin\AppData\Local\Temp\AkrienPremiumCrackByHurminka.exe
          • Size 9.7MB
          • SHA256 45f4d4b64e6a1ca96e51aec35bea9bdb72eb950e9810f1cbb95976dbf379089b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RBX-28B275E8\RobloxPlayerLauncher.exe
          • Size 5.7MB
          • SHA256 4387634feeb838cbf3156a553ff0914b3cbbc3369a1179a3c6fa57c58b755017
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          RobloxPlayerLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe
          • Size 5.7MB
          • SHA256 2acc3e0879e4a71a6b08e2d6af7b238198d2eda73518b9394d82d00b010c9d7e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Temp\crashpad_roblox\settings.dat
          • Size 40B
          • SHA256 993944881e83de23ea83b31a12d20d42ae54ddba3e3ac8fa8438e2f5ce945ea4
          • MD5 SHA1 SHA512
          Submit Download

          pqEIJQJY9p.bat
          • Path C:\Users\Admin\AppData\Local\Temp\pqEIJQJY9p.bat
          • Size 209B
          • SHA256 4424be63c96f27eb4543e31913f96f0890aa5e83079842db56e750722ad146f3
          • MD5 SHA1 SHA512
          Submit Download

          memory/1804-110-0x0000000000340000-0x0000000000416000-memory.dmp
          Download

          memory/3656-82-0x00007FFE41C30000-0x00007FFE41C32000-memory.dmp
          Download

          memory/3656-84-0x0000000140000000-0x0000000141131000-memory.dmp
          Download

          memory/3656-83-0x00007FFE41C40000-0x00007FFE41C42000-memory.dmp
          Download

          memory/4536-453-0x00000000004F0000-0x0000000000525000-memory.dmp
          Download

          memory/4536-454-0x0000000072B00000-0x0000000072D10000-memory.dmp
          Download

          memory/4536-486-0x0000000072B00000-0x0000000072D10000-memory.dmp
          Download

          memory/4536-510-0x00000000004F0000-0x0000000000525000-memory.dmp
          Download