hxxps://drive[.]google[.]com/drive/folders/1TFpil5gONUL_zludePKWtqq8pafg4PcB

Analysis

max time kernel
447s
max time network
443s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1TFpil5gONUL_zludePKWtqq8pafg4PcB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Crafter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Crafter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Crafter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	Crafter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Crafter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Crafter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Crafter.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Crafter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Crafter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Crafter.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1416	Crafter.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
4928	msedge.exe
4928	msedge.exe
4636	identity_helper.exe
4636	identity_helper.exe
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1416	Crafter.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1080	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	Crafter.exe
1416	Crafter.exe
1416	Crafter.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4168	4928	msedge.exe	83
PID 4928 wrote to memory of 4168	4928	msedge.exe	83
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 5096	4928	msedge.exe	84
PID 4928 wrote to memory of 1272	4928	msedge.exe	85
PID 4928 wrote to memory of 1272	4928	msedge.exe	85
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86
PID 4928 wrote to memory of 4828	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1TFpil5gONUL_zludePKWtqq8pafg4PcB
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc109f46f8,0x7ffc109f4708,0x7ffc109f4718
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5857829452393699516,16482273928968788325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4616

C:\Users\Admin\Downloads\Crafter 3.5.4\Crafter 3.5.4\Crafter.exe
"C:\Users\Admin\Downloads\Crafter 3.5.4\Crafter 3.5.4\Crafter.exe"
1⤵
PID:1108
- C:\Users\Admin\Downloads\Crafter 3.5.4\Crafter 3.5.4\Crafter.exe
  "C:\Users\Admin\Downloads\Crafter 3.5.4\Crafter 3.5.4\Crafter.exe"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x394
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c6486c26f5cad04ad70f569324bb30f

SHA1
77bd42c1f9b741acc400ea83419d9cc2264d98cb

SHA256
f1b4e06164e4dd3290dfbffa50959273b282823ff820167c8c3c50cb388e42f1

SHA512
492708b469fffca77c64bb5582c575c20a884642a03d437903ae37032b77381955903d4a872a00ba77e4135e538bfd2174f4e6f68daabcb076747c7d8b729aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dfe3f1dda545a96a08719e7146daa42e

SHA1
2a743bba922c0439c707138e78ea740546b0f5d8

SHA256
3522907b0ee041053db20b04396001fbfef7043c976dee2880de9cb84d8f32c4

SHA512
a48c910806ef91835545bb6f2584053b524b6d4791c7851525b2a27b1344d7a676fc5a65c61aa72ea6a431bb5a82d0603b4c25a32ddcb4d7d51b5f3f1dfbfd41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a8ab9257db5fa6055d629e94795a577d

SHA1
ad65cef1795d6fa6df6866a34cf72bf04a5f7847

SHA256
6562692aa48ba9caabe4773e2494c124f432b21a41f8d365305f9f1ef79580b7

SHA512
ab9dc46b458d704400127d9e6e90dc152f4c1d9f7bfb7da18bb20ec4963925584fa8b72da69570e57f19bc2c6659b706878e5119da8206e035c8e754d4d2f604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
060f160a858d987a9b6fab81b1e7b682

SHA1
a097487bd3939a8647384432424e469851c5dbd0

SHA256
5c4cc1a7d8915605ecfdd7b3cdcaefa7b658685a3a148dccaa3900a67d31bb05

SHA512
29a7ebbaefbe85eee943688102422a536fe769560a09ed98cc63a5c410ae5f6232080e2f5681830820bf3f1c6cbcbccdf0a69b58eb48074667b06b2bb5fc95ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e7447c1541fbcf3223779e5a7eea2e2

SHA1
e1bb220f0053b443b258f09b2f816509d929fe57

SHA256
41f83a3912840450b86966095ba331c357fe59c354c3acca7a1c6e2f000139f8

SHA512
2241a7a512bcbaf96ffc855fabf02482ea73d18cb5184985ee5b2298fd0e764c49bd6947be29cc5d5a8d2e96313d9e47b7af8e38f7c87f8919d528eae1da1c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b8e263114ef6b5cbc426547f279caba

SHA1
177c8cc3eba21cd5c982e5f65beee0f2a691141c

SHA256
b193dd5a9f83fd03fc8d6585c78519faf14d779cebe678cbebf9ec349ead0be1

SHA512
fe62ad7658074105034471581dbf17a0c8e57919c8da73b87a52936d3fa11027f403d953a18b0bf2e3d4fca222ce7c11b1b4b3c0b2261112e8dd222206ea917c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4daf2bbdb2416b510858562e46f50ab4

SHA1
6ba84853c7f80f9a335d7489a3e76bc50466b0c1

SHA256
b89a2ea5d73a4455f1a7b7cc90455cd89bb24209b412370dc7ea82015e8962eb

SHA512
e41a060097375ff3edce378aa0ad2477ba91ec71faad9d0dac9f68337e61d7dcb240160433d3f33eae372f2ea1b0e09f26b52cbb90e804526893b8b0763f57f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d01600d31ea1d7a33c8159966d309ce

SHA1
ab739b294ed91cb49bcfba388cd34e6a5da25a91

SHA256
f34ef35c99b20a2fad36f0f1c3fbf1a42368f8b67ebf3173b7f3800fd4ea3f1c

SHA512
f95cabaa733224f9b4ac79b733f3f0354cb61b43ac708f6ac344a2e7f6f443b5bdaf38e574d29e14c0739b5242c21f219fdb2849800ce80564fc7f463653c905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72118c6e56e116e5d7755961f8c653d9

SHA1
0dd97ef18bbe39ab83d5ce0b2eba181901e7a44d

SHA256
2eeff51b8f0aaf1506f8668d79295ce0a239643dfe2519b755b135e8f7387bcc

SHA512
c84894578b017750c72979ce573bd17a4e57f8157b074674b56d2f3f795c5a16950f2ba244ab79d5deae3f556352523fd3beef3e63207c015b84e924c2f30a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586925.TMP

Filesize
1KB

MD5
8f6d82095799a4ed76667d00cf5728b0

SHA1
235cbd1d687f4ecba9a174b160326494a0c574cf

SHA256
8c20d6382f2656de7805dd0933a576ea15501744a728323b982261df79ab4b06

SHA512
e89128809eea07241dbed8c6117e506110896cd5b5cf3269368990f8fcb0e62340fd4709346e79c76aca49d1b31785439dbde5d4508bb9218daea054a7171d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9f872a851e764e170b5540a1f1cac986

SHA1
caeaa222a9f5a204e0f3dc2ee780e6aa1531ab31

SHA256
a94bd739c23fd4d4a7314b1a2770d5918ab8620780dcd27d79a77ba1f78f267d

SHA512
ba0fb6d38f63d895ace6855008fe58a098b3f16c1c4264221ef690de783d922b058fbe54ea7db05aed060ab75d7754b8ea925a7a4a585c16bdc09861c24ed76c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e98a5d1409f996f4fa82dcc7ed83bc99

SHA1
84784740de88851f276afc09828f05ef62de7a21

SHA256
5f2bdba3ebf0317615d174d578958993acf203e2b67c39d8789aac3f27f5d8cf

SHA512
ce6d910db3a8c049769089432bdbb3e42dd80b08b00217221b14a19aabdeca63534a3a27d70e198d73c0bfd5a5c9035ee37d109d898d87a27075a5def6362162

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\_bz2.pyd

Filesize
74KB

MD5
177308f1e8a2f500c4948a2bcd299785

SHA1
ef3a3c0d030a6c55acb8c06c0c7ed878231e1a2f

SHA256
54ad29a941793dbdcf7a41310437fc5a4591cd66005e30206ff4c07376ddafb9

SHA512
bd00bb1dfd22dfa3960db08955623ca16ce76fbaebfd2781eb4f5e2d877f7eddbb9daad48ae5f7abf2a05642f42136a743b6d7b32b9de94bb1d34f9cfa1d1700

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\_ctypes.pyd

Filesize
114KB

MD5
c3480ffe322762b2b5436f5e3814379b

SHA1
1d610d93cf736cc63667e776b1e479f672d9e9d5

SHA256
adf692c4dea2d5f429215d89427b6059499ffeba40fe4ba1595eff7e6b3d713c

SHA512
67a92b4e87e59b9736b5c8882a765ece05536882cba97a754b7ef5951303d23626be0ec199ae49bb32c589ecbd4e68a8d48fc58cbd2edd6d0cc27aadfbe4b804

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\_lzma.pyd

Filesize
152KB

MD5
7b45f888febd15893430275070405e65

SHA1
5a19373059e0f8e7ad4ebeb6745758d14324984a

SHA256
f8486617d631fd02e02a021b0f4871551788a037bd8f67939a4c0d00a36218e4

SHA512
6aba44c014c03e470cb4cfd83fb92c068826f87ab02e269686fbfb1bb651486b9337e60cad47e5573b70df84d841fe3b259370289900598b6aa250478b9b066b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
e5912b05988259dad0d6d04c8a17d19b

SHA1
724f4f91041ad595e365b724a0348c83acf12bbb

SHA256
9f3608c15c5de2f577a2220ce124b530825717d778f1e3941e536a3ab691f733

SHA512
c270a622d7887f4c97232ea898f5380459c565817f0d201cdb081ee82e3002b6e6248753a68da896d3b1327f93e8e8cb0ca0dcaeef324f610e0a1c7b542c6492

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
16789cc09a417d7deb590fffe4ed02dc

SHA1
4940d5b92b6b80a40371f8df073bf3eb406f5658

SHA256
3b68d7ab0641de6b3e81d209b7c0d3896e4ffa76617bbadd01eb54036cdd1b07

SHA512
19e4f086cc2137ee60316b0736b3c6b3780578896df9a826edfe004bb74bee8e051c511a84d8a7ea278a5f47c82b9c955394f629ab0bb0740ecb51293d9be7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
9476affaac53e6e34405c4001f141805

SHA1
e7c8a6c29c3158f8b332eea5c33c3b1e044b5f73

SHA256
55574f9e80d313048c245acefd21801d0d6c908a8a5049b4c46253efaf420f89

SHA512
f8e3476a09d888caebd50da0ea2debc4006004e72af677919413655ab4595622cac524f1bc6c13406ee341ae0052a19ed83826ad530f652e73b2c65d4fa65680

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
a5883c68d432f593812ab3b755b808db

SHA1
51cbb7ba47802dc630c2507750432c55f5979c27

SHA256
b3715112a7ca4c6cc0efee044bd82444d3267a379e33a3ec118d87e75604204d

SHA512
27153e29e99a905fa4c8b3ede078644a3a3f29fdf7b98e387e39c5c60444e326c92afd74da8fee225f7ddf39724a0daef68ba238f3cc64fb7860172b8f29d79a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
241338aef5e2c18c80fb1db07aa8bcdf

SHA1
9acbeef0ac510c179b319ca69cd5378d0e70504d

SHA256
56de091efe467fe23cc989c1ee21f3249a1bdb2178b51511e3bd514df12c5ccb

SHA512
b9fd37f01a58594e48fa566c41827b2b9499605d9e55c2178e83ee41c8c5f50a4df2c85efea94ca586ea0ea4a6d984ebb7ca2193e9306fcb853b147b2c76bc2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
49c3ffd47257dbcb67a6be9ee112ba7f

SHA1
04669214375b25e2dc8a3635484e6eeb206bc4eb

SHA256
322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

SHA512
bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
cce27ff9b1e78b61955682788452f785

SHA1
a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a

SHA256
8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de

SHA512
1fcec1cd70426e3895c48598dfc359839d2b3f2b1e3e94314872a866540353460ec932bf3841e5afe89aa4d6c6fac768e21ae368d68c2bb15f65960f6f5d7d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
cdc266896e0dbe6c73542f6dec19de23

SHA1
b4310929ccb82dd3c3a779cab68f1f9f368076f2

SHA256
87a5c5475e9c26fabfead6802dac8a62e2807e50e0d18c4bfadcb15ebf5bcbc0

SHA512
79a29041699f41938174a6ec9797faf8d6bf7764657d801cb3af15c225f8eab0135d59cfa627bd02dd7459f7b857d62299e4d082586ce690627ebdf1267ebb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
39809cc5dabf769da8871a91a8ed9e69

SHA1
f779cdef9ded19402aa72958085213d6671ca572

SHA256
5cd00ff4731691f81ff528c4b5a2e408548107efc22cc6576048b0fdce3dfbc9

SHA512
83a8246839d28378c6f6951d7593dc98b6caa6dbca5fbd023b00b3b1a9eba0597943838c508493533c2de276c4d2f9107d890e1c9a493ee834351cff5dfd2cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
19KB

MD5
5d5fae1a17961d6ee37637f04fe99b8a

SHA1
47143a66b4a2e2ba019bf1fd07bcca9cfb8bb117

SHA256
8e01eb923fc453f927a7eca1c8aa5643e43b360c76b648088f51b31488970aa0

SHA512
9db32ec8416320dcb28f874b4679d2d47a5ae56317fdc9d2d65ebb553f1d6345c3dd0024294a671a694337683dd4e77254595a9cdbfe115c80d0ef53516d46aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
588bd2a8e0152e0918742c1a69038f1d

SHA1
9874398548891f6a08fc06437996f84eb7495783

SHA256
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

SHA512
32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
6def20ed13972f3c3f08dba8ecf3d6cc

SHA1
9c03356cf48112563bb845479f40bf27b293e95e

SHA256
c2e887a17875d39099d662a42f58c120b9cc8a799afd87a9e49adf3faddd2b68

SHA512
5b4d2b1152bed14108dc58d358b1082e27defd1001d36cd72ec6f030a34d6caf9b01c3c1dd8a9ac66d1937fcf86a6fe3469ac93b1e76d933a8f4b51c1f782f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
a056d4eeaae37deab8333dcc4c910a93

SHA1
cb59f1fe73c17446eb196fc0dd7d944a0cd9d81f

SHA256
593fa2aa2474508ad942bbaa0fdc9a1badd81c85b0dff1c43b90a47c23ad5fb7

SHA512
c2f811994182ef51d0c011c19336179da69357e5f284f787bcdb54f90c32768a959232a477534f7e62cd3d71a048a13e91b20042e2fe6ab108d606c7c8df9255

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
f3b4ab35a65a8d938c6b60ad59ba6e7f

SHA1
2745259f4dbbefbf6b570ee36d224abdb18719bc

SHA256
ea2972fec12305825162ae3e1ae2b6c140e840be0e7ebb51a7a77b7feeda133a

SHA512
a88afb66311494d6c15613c94555ba436cd2f75e11a49a448c9c6776dfba24cda25a44792a1e8b3e680c1ad3ad0574b43ac2328c6e41ff0832139c94b066dbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
5faf9a33bab1d39dd9f820d34339b3d4

SHA1
50699041060d14576ed7bacbd44be9af80eb902a

SHA256
a1221836731c7e52c42d5809cc02b17c5ec964601631ec15a84201f423da4ac4

SHA512
73c25d1338df9aee5211fbb0e1b14e6bd853e31746c63bc46f44810622b09d52ee39b8e8a57c655da63d3d3d4025c2cba4d8673893d022417a2032ba3d935061

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d699333637db92d319661286df7cc39e

SHA1
0bffb9ed366853e7019452644d26e8e8f236241b

SHA256
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

SHA512
6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
7028cf6b6b609cb0e31abd1f618e42d0

SHA1
e7e0b18a40a35bd8b0766ac72253de827432e148

SHA256
9e98b03a3ca1ebabdceb7ed9c0ceb4912bb68eb68f3e0df17f39c7a55fada31d

SHA512
d035ccfd0de316e64187c18e6e5b36e14f615f872c08740ec22ef2c12d592e37d78ab154202926a56ab01d669eb5870dff651280a882d6bf2a700c43dcd25ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
2166fb99debbb1b0649c4685cf630a4a

SHA1
24f37d46dfc0ef303ef04abf9956241af55d25c9

SHA256
cdc4cfebf9cba85b0d3979befdb258c1f2cfcb79edd00da2dfbf389d080e4379

SHA512
de27d06b1f306110b42d0ed2642a555862d0ade7e56e5f2908e399f140aa5f43904e08d690bcb0d2f4d11d799ec18fa682db048da57d99cd99891e45add86371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
b7cbc8d977a00a2574e110b01124ed40

SHA1
637e4a9946691f76e6deb69bdc21c210921d6f07

SHA256
854db7d2085caacf83d6616761d8bdcbacb54a06c9a9b171b1c1a15e7dc10908

SHA512
b415ef4092fa62d39941bf529a2032bc8b591c54ed2050ea4730f198899f147539b2c0e97f3c4f14848c71066924c1848ae5f07779a1a47ab4c5e46f02be7258

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
6961bf5622ffcd14c16fbfc1296950a4

SHA1
5584c189216a17228cca6cd07037aaa9a8603241

SHA256
50a1542d16b42ecb3edc1edd0881744171ea52f7155e5269ad39234f0ea691de

SHA512
a4d0c15acbff4e9140ae4264fa24bd4c65fb2d1052a0b37bf281498f3b641fef563c18115511829a23340c9440f547028d36015ba38cbd51ad0744d44d5ccd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
47388f3966e732706054fe3d530ed0dc

SHA1
a9aebbbb73b7b846b051325d7572f2398f5986ee

SHA256
59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132

SHA512
cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
df50047bbd2cf3a4b0cf0567514b464c

SHA1
f20ae25484a1c1b43748a1f0c422f48f092ad2c1

SHA256
8310d855398f83cb5b9ca3adeb358da1354557aec5c82c8ef91a29f79a47f620

SHA512
5c3bfc2ccb2ee864b99f6709677474327e85889f4c962ea0a1ef9e1e876dc88b1d8e8e0f6c1422f634ff1c84a861c34e52ee07dac7fdde505b508bea80562b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f62b66f451f2daa8410ad62d453fa0a2

SHA1
4bf13db65943e708690d6256d7ddd421cc1cc72b

SHA256
48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

SHA512
d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
a1952875628359a0632be61ba4727684

SHA1
1e1a5ab47e4c2b3c32c81690b94954b7612bb493

SHA256
a41bede183fa1c70318332d6bc54ef13817aeee6d52b3ab408f95fa532b809f1

SHA512
3f86180cc085dc8c9f6d3c72f5ccc0f5a0c9048343edaf62239eb4b038799845388898408ed7e8eac5d015a9bc42ff428f74585f64f5d3467dddb1303baf4f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
6c88d0006cf852f2d8462dfa4e9ca8d1

SHA1
49002b58cb0df2ee8d868dec335133cf225657df

SHA256
d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663

SHA512
d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
d53637eab49fe1fe1bd45d12f8e69c1f

SHA1
c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

SHA256
83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

SHA512
94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
c712515d052a385991d30b9c6afc767f

SHA1
9a4818897251cacb7fe1c6fe1be3e854985186ad

SHA256
f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

SHA512
b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
f0d507de92851a8c0404ac78c383c5cd

SHA1
78fa03c89ea12ff93fa499c38673039cc2d55d40

SHA256
610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

SHA512
a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
f9e20dd3b07766307fccf463ab26e3ca

SHA1
60b4cf246c5f414fc1cd12f506c41a1043d473ee

SHA256
af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

SHA512
13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
ab206f2943977256ca3a59e5961e3a4f

SHA1
9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

SHA256
b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

SHA512
baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
4dd7a61590d07500704e7e775255cb00

SHA1
8b35ec4676bd96c2c4508dc5f98ca471b22deed7

SHA256
a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499

SHA512
1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\base_library.zip

Filesize
829KB

MD5
3f9f832ad9515a697776b144dddb21d9

SHA1
1ff0d9b26b4c20a46bdfce3c0360099abb515356

SHA256
caa24440e9f108810d973bc00fbdb123d4477c7be35573a7a4d0abbff7d475cc

SHA512
774bcafd1211be84f4096ab0b935f1b6175993277f4ae1b2abc86712c7969f5578ad754dec5b35802d22252983e086dc5ffe3ea73fc4020483db10887e1d3b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\python3.dll

Filesize
51KB

MD5
1337b40b72bbdd59c9160706bd0cf2f1

SHA1
e15c4774a335f2371197c073479246a6d792412e

SHA256
ae88285d10fed8c43e457f20c5ea704b1fd1b44e97e691c463ff9eb62b0c653c

SHA512
b653cc32d8d17690cb6cd115595c45d29b9a68da6a2845c31e9dfc9f23800b0d6b56c001a97ba33c98f2889ac74a444d7818275b51ea079ec6c76a22e93397b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\python39.dll

Filesize
4.3MB

MD5
33f1c14cc443c6bfddfa2d86a2d4e490

SHA1
6d7aa11003fb9b40760d47e5e1121f4731319f1a

SHA256
5dd0b205b16545218552676c3dd602a0cf01fb4ee8c656df988e3e308083f67a

SHA512
1cbe8d87ae5037f14b80ddbede0e984803529a9ddd17d68608c751283a92e9c9d788e2f255298006cca8afb5015024a6551603ccc3bace4ec8a86e076a8e068d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11082\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\Downloads\Crafter 3.5.4\Crafter 3.5.4\config.json

Filesize
1KB

MD5
bdd956fc8c3c365d8c930e88f3622731

SHA1
e32e6853db720d5a7181983e77ac07b9e79657a0

SHA256
541381bfae63b4dcf6aca6bb895cdfa1c7944bf1cddb5c01ea5c903f78c311cc

SHA512
6e3eb597f1648de738311269fbdad193d92ca89b3f47cc47bed024c60d905e6cd5356dd38fa19c557dcc3bb258776f159fc36250bd8a7eac15daab6b519f4cd4

Download Submit
memory/1416-715-0x000001D6B5600000-0x000001D6B566B000-memory.dmp

Filesize
428KB

Download
memory/1416-759-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-712-0x00007FFBFF3F0000-0x00007FFBFF650000-memory.dmp

Filesize
2.4MB

Download
memory/1416-711-0x00007FFC007E0000-0x00007FFC00CC0000-memory.dmp

Filesize
4.9MB

Download
memory/1416-714-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-716-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-718-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-720-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-722-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-724-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-727-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-737-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-741-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-710-0x00007FFC00290000-0x00007FFC007D1000-memory.dmp

Filesize
5.3MB

Download
memory/1416-746-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-755-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-757-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-713-0x00007FFBFC980000-0x00007FFBFCBE4000-memory.dmp

Filesize
2.4MB

Download
memory/1416-761-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-767-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-770-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-772-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-774-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-776-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-778-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-786-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-788-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-790-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-796-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-812-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-818-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-820-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download
memory/1416-822-0x000001D6B4A50000-0x000001D6B4BBD000-memory.dmp

Filesize
1.4MB

Download