cryptbot | 0f6b8f0f181618b3ae213cf6a916a597e0d9f4cfea364e2ca7713138e22e65cb

Analysis

max time kernel
109s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Visible Analyst Cracked/DOWNLOAD NOW.pdf
Size

36KB
MD5

c83a5606ef6b97810e7bd415e8dade34
SHA1

2e408bf30e8e73caa0191ea7407acef8574a92f0
SHA256

0a6fb9cebe132c69d96cf7f2b4675369d2aed44b329004edcd81409cf2ab62d6
SHA512

5bb6216fa0ee4dae72fd1e5af0160afe7e5eaacc5856014c7df0fa41d77640762c186fcee9c9dd3f594b27853c3c56394518a495aec95da428e614c9f0fd6b95
SSDEEP

768:xqo/tP5ABqQVMfJ0PHK0PIjaBXsOk93pY6tXtvneYrMlGSCahIPxtSrrVZXBdO8e:xqo95bQXHbgKX495Yu13rM5GPirnXBda

Score

10^/10

cryptbot discovery spyware stealer

Malware Config

Extracted

Family

cryptbot

twelvevf12vt.top

analforeverlovyu.top

Attributes

url_path
/v1/upload.php

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Executes dropped EXE 1 IoCs

pid	Process
3664	Set-up.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
5792	msedge.exe
5792	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
864	msedge.exe
864	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1544	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	5824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5824	AUDIODG.EXE
Token: SeRestorePrivilege	5464	7zFM.exe
Token: 35	5464	7zFM.exe
Token: SeRestorePrivilege	1544	7zFM.exe
Token: 35	1544	7zFM.exe
Token: SeSecurityPrivilege	1544	7zFM.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
868	AcroRd32.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5464	7zFM.exe
1544	7zFM.exe
1544	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
868	AcroRd32.exe
4788	OpenWith.exe
4788	OpenWith.exe
4788	OpenWith.exe
4788	OpenWith.exe
4788	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2200	868	AcroRd32.exe	85
PID 868 wrote to memory of 2200	868	AcroRd32.exe	85
PID 868 wrote to memory of 2200	868	AcroRd32.exe	85
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2916	2200	RdrCEF.exe	86
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87
PID 2200 wrote to memory of 2280	2200	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Visible Analyst Cracked\DOWNLOAD NOW.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9E343C6721F4F12C45CDEDE00165294E --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9417BDC138C4BC357D52D32F08DFDC8B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9417BDC138C4BC357D52D32F08DFDC8B --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DA4D56DD68804C92426856805602164D --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ADD5DD7ABD8C21A28B8FF3BC50DF8EA0 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0AE177D5991F1BA657955E7D8B9D1EDC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0AE177D5991F1BA657955E7D8B9D1EDC --renderer-client-id=6 --mojo-platform-channel-handle=1820 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=35EE872CEA7CB7F31A956EF114F3F2E4 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://farheerdrctf.com/Jn68skLsqWhva
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a85d46f8,0x7ff8a85d4708,0x7ff8a85d4718
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,7618183054279111986,9009020745848302760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5988

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1468

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\⚝(LaTe$T⋯SeTuP⌗PA$S↳oPeN↳9192)⚝.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\⚝(LaTe$T⋯SeTuP⌗PA$S↳oPeN↳9192)⚝.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1544

C:\Users\Admin\Desktop\Set-up.exe
"C:\Users\Admin\Desktop\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3664
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
  2⤵
  PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4e3e1b6fcb571d58d9aedcb36e0a6bfc

SHA1
a48101e8d419110c00bda78de1e8cfbd9e48acb0

SHA256
d52a0682ced33a77072034981d28e12721e9bdec481fdeb000eed833bebf0bdf

SHA512
1198cf35887048cf590eb1ac351eb2c6af18800950f5a2bf01849d10b69040a01325b2ffa88fe9d0a096c79c75e8e3bae48b4db283378f7bffc0cffe884c4d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5e355d68a2f15922e52440ca6031ad50

SHA1
0976577f92d2d707828b83a0bde5d4e23f3ea837

SHA256
29669af00703d832be77c95e722ff39ae154d8147c598e17f0e348072d14c3d3

SHA512
b85afef6f6b9b1f763304620cbf1488d7a075ba01f77bc26d318a0ce817d69d45cda2505b12ae7cb6dd786016bd3726a8a10a41c3236e66df265aa93635c6480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
bda013580082a7dee3e60704e0f16fcf

SHA1
5e18380500ae75154d8e9cb95ac2c25078b5db69

SHA256
200c7e5d21c03bce72a570e204a9747046dfc69297011514e7d9e8b9381b1226

SHA512
57bf7b08f2632c0885930cdd18e258cc3fae138e3b4ad6cc7fd8a430bb5169ae6241c53d81c74a85fddda9e1f7d79772898296690047c559c52d1e807d10b1e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
628B

MD5
36c4a4017bc99f3a9afa31bb66f8316c

SHA1
56768614f0fe7d41a3148e262dc3730087d1034d

SHA256
8d7d2c7a527f1b0d321c220df0671bf4f5d856d9922e824bd92f5b8d36fa07d9

SHA512
8296f3a17761f712fcd9d381f2c69b9f46999682372a8dd5bee15944b6482bb4fff332cc404fb7e8a7b081ec130b6cad5b3651803d3306e778424edf5d49db96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10ab792d24ac38991951cc4d8cd8a59c

SHA1
08274ed91bb071cda37f5504f6900cd5032f1875

SHA256
3c5316a6ba21ddadcba708cd27668ecf04c3443922832abad5b570c7c46c2ae0

SHA512
a7eca1c8bf4103da04b38538b3e1693179caa406b18150cc096da59b4f0a0b0fba325776df23acd4601da93b90d0f354df61f90a6f651e2b85da9930ecfa77f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3028d27c6b7445d14a7debf5e7e8b5b6

SHA1
cb3ed3c64fa684b2ec989580e5d7288ecf3e7abd

SHA256
2c15b480b06402aad4ed71afe62f09928be06d381b177aa20aee4953c56ddb81

SHA512
b7fe250a89bf79fc555ac87c636800c149e9ef7bdc63a03eaa825aa84ee448f53c6fdc9bf04f0e325e33e5e252183a41d1c77c4ce16fd3d27886098bf22ab56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e287cf90f74ff55d623ab312dce092b

SHA1
be8c6c7b385772bc9225b378a283d013eb11a627

SHA256
5e376c17f6189a03ec2291eaf17d807cdae6e08c7f7df8550439544327fde197

SHA512
80cf75853f453e9f54bfb706e9140b6ebaa445e4f334f8903d8266972217f76f350d1ab9e3d6c90bd0f5ed36be6aac9bf8c5f7950b87928978c83db8d7b0caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
44695bf60062d93716e85379b97ab607

SHA1
6a5b56bb8e8a60e9a4b011a9a9bef3b0e30c0009

SHA256
67496c5470ffb4412ff8b44678ccaf9b232158664a9a35c7f6ded1ce260a5c8c

SHA512
b2383a5271afc0836688b5abd8bf4c1f2b9861e8a5f892be21dd70e463ae0e9548605e50619989799e39d8e0240eee6c94058ad8f279b11f1a0ff57c4e4f0672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF463e6.TMP

Filesize
48B

MD5
dcd16bbe0de2c814c4e298f6f4fa27c4

SHA1
be3df249dde8849c20f61d87e3e194126edc189e

SHA256
8d944ded2dacbce1414751451af2345b68870aa34bbdf3f5509af4aff2362751

SHA512
ac96d5c1e15e8a3adb98fca94e7553ed0d04c56a4aea1de2afd03f479b3c3a482ad933271e56e84390bed0129fad028e3d95a7b9daea8bfd45e174730ed24e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbc7c39a-f078-43d0-9599-42fbd43429ce.tmp

Filesize
5KB

MD5
9d7f4df1645c6e62103d37eeaed3e44c

SHA1
f0965fe4f08a4d4563c6c642a3f0d6d97858b4b3

SHA256
912edff607212fb4c6022d1e8d0e3f261644f6e8dc138bc327a6c721d0fb6d4b

SHA512
e8522e3dc1a24d480bf29d187bf25613473f53b6f1cb164f8d742b38d98d2eafae9000e97ea14be01ff24d300d5c65a46e7f80148c7cca070faa7910036745d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
140544e6fa26dd64fdd0a6c68818ef23

SHA1
0e2cfcebe6bb146c4b8fe7cdf6ce5d32b25fbbdd

SHA256
410dd2ed5584822df59c78c210bbe323f4847dbc8834857371ff46586d2b0a24

SHA512
de043d02d54f7eb19cf1b993bdeeaf1060bfb9faa5f85c28e90b7f4a35a6f5bfd6c28cbecae22914259ec8ce0d436e572fb7c44b4525de3e810a382e9113b39f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e0ff3ddfc63a70edc227165259ec116

SHA1
bf9c74a4d805edc9a236a5569ad7dcd981118f89

SHA256
e81b28c163568575c05a4b39a04f3d36654ced9ba644b598ac601621d6677f56

SHA512
a34b8f81a44b82f972e9db7491974f11d3f75eb70d97c32fc23dc14edca84dd84a3608183cb8702e2d61f2a641788d274e26a63c8fe851ddbcae3623eb22b30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1146ee4402ac25a44f9baaaceb9f02c

SHA1
4c2cfd2461a2b9d10893a28fa98423f66bb9b0cd

SHA256
f84cb8a04d9e5ba2c57f0447ef7936dda4468538629bb14d8bd8bf8cbd86d119

SHA512
0981efe8c7cd09aa4167f8c1c462ab2e7e3a5b392d0f49add542174d950aedfa4ccb9d22c8ec454f445b3a3c4513ac64cabd480f874f5be97a14c7e1f69985e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\Set-up.exe

Filesize
6.4MB

MD5
870f1122277648c00bf1946e44840576

SHA1
c33bee3656773a7c8dfcff6ed91e9ee45f1374da

SHA256
e3dbf48bf7232de2ba30108b1a2f786f720d9add5ff58f6ec6e642333f36fcbe

SHA512
7221b6c24b9e04288bfac96b65ab048729a3a030afe71338527c9c89932417448daba755abbdece8675a14d57045c967b19cc471795ae79a2f7824167848fbd7

Download Submit
C:\Users\Admin\Downloads\⚝(LaTe$T⋯SeTuP⌗PA$S↳oPeN↳9192)⚝.zip

Filesize
21.6MB

MD5
1aebe68ae764b80326d67346159fe668

SHA1
d84451dedacfe5e2444b5a6c98d76e14e4274b52

SHA256
979a864bf11b81fddf2b9e513ce939c9dd28081050935ba8f882bf08ba9781ed

SHA512
f1698a4803fe0a5efce0744462c08867192f8c572ca76be605b7bf8011c18d99f20e73c2c8e5048d45335fa88888501e7366ebabeb10265b89bb5446ebddf1e4

Download Submit
memory/3664-420-0x0000000000400000-0x000000000106B000-memory.dmp

Filesize
12.4MB

Download
memory/3664-423-0x0000000000400000-0x000000000106B000-memory.dmp

Filesize
12.4MB

Download