meduza | hxxps://github[.]com/fendiglocker/Crosshair-X-Crack/releases/download/Crosshair-XCrack/Crosshair-X[.]rar

Analysis

max time kernel
109s
max time network
103s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09/11/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/fendiglocker/Crosshair-X-Crack/releases/download/Crosshair-XCrack/Crosshair-X.rar

Score

10^/10

meduza collection discovery spyware stealer

Malware Config

Extracted

Family

meduza

109.107.181.162

Attributes

anti_dbg
true
anti_vm
true
build_name
665
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/968-1901-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza
behavioral1/memory/968-1903-0x0000000140000000-0x000000014013E000-memory.dmp	family_meduza

Meduza family
meduza
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	Crosshair-X.exe

Executes dropped EXE 4 IoCs

pid	Process
4024	winrar-x64-701.exe
5756	winrar-x64-701.exe
5876	Crosshair-X.exe
968	Crosshair-X.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
94	api.ipify.org
95	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5876 set thread context of 968	5876	Crosshair-X.exe	134

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3ce78f8b-a82b-4432-b171-1757cac0e17d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241109035402.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3700	PING.EXE
2760	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 944421.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3700	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
644	msedge.exe
644	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
5740	msedge.exe
5740	msedge.exe
968	Crosshair-X.exe
968	Crosshair-X.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4420	7zG.exe
Token: 35	4420	7zG.exe
Token: SeSecurityPrivilege	4420	7zG.exe
Token: SeSecurityPrivilege	4420	7zG.exe
Token: SeDebugPrivilege	968	Crosshair-X.exe
Token: SeImpersonatePrivilege	968	Crosshair-X.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
4420	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4024	winrar-x64-701.exe
4024	winrar-x64-701.exe
4024	winrar-x64-701.exe
5756	winrar-x64-701.exe
5756	winrar-x64-701.exe
5756	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 5776	644	msedge.exe	81
PID 644 wrote to memory of 5776	644	msedge.exe	81
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2680	644	msedge.exe	82
PID 644 wrote to memory of 2792	644	msedge.exe	83
PID 644 wrote to memory of 2792	644	msedge.exe	83
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84
PID 644 wrote to memory of 5424	644	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crosshair-X.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/fendiglocker/Crosshair-X-Crack/releases/download/Crosshair-XCrack/Crosshair-X.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff84cd646f8,0x7ff84cd64708,0x7ff84cd64718
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff66e7c5460,0x7ff66e7c5470,0x7ff66e7c5480
    3⤵
    PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10203319101996926279,2947477263502925989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4056
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6064

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\777db9fb55714d4fb6ba8b4d38f5ac48 /t 3500 /p 4024
1⤵
PID:4720

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f91c8423f25e4f89ad5661c7ac15f210 /t 4772 /p 5756
1⤵
PID:6052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3044

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Crosshair-X\" -spe -an -ai#7zMap26959:84:7zEvent17505
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4420

C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe
"C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5876
- C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe
  C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:968
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2760
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
843402bd30bd238629acedf42a0dcb51

SHA1
050e6aa6f2c5b862c224e5852cdfb84db9a79bbc

SHA256
692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a

SHA512
977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
557df060b24d910f788843324c70707a

SHA1
e5d15be40f23484b3d9b77c19658adcb6e1da45c

SHA256
83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

SHA512
78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee15c58c84b06ef6c19219d4aeb87cc7

SHA1
0fe7e480566a3ce4c6cb29dfb22d72296538c59f

SHA256
60ae17fa607e6b97afa1c35826c306a49ee3e796cad6a6017065d87378456bf4

SHA512
5c827fca145e2eebec259d915494cacdc832d25b1c7d753575441e5adf397c8fe09817c39bfba063cddef84e2e4e5b938d5603e439a0e78456c0dac5c2a8f47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583ae1.TMP

Filesize
48B

MD5
739d9c5403cfe77708710b75585f54cb

SHA1
74569d9640ecb78bf830afc76a44907f6a49de89

SHA256
37de3ada1644bdc73ad28e7f94402bfceb3070b4aa5aefcbe547a4e8406dc871

SHA512
043f962119039e08605a41f2407efc511ebd6cc57461c08c2a5b233579568d7606b859642493411d8d0a9b8f0708198eaa3b710def742423ecdcc97ca257d209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
57175b108c0f6153b8818a1c292c7428

SHA1
d13e79d41b75d3beb142585ff57326043b10410e

SHA256
702b4371c90ff24c549f6a390bbd78187f6d3a3eca9409d831445da8f88631a2

SHA512
2c16c644bc89ae21a449ac721158111304524cf277e4e6f88aeab35204414e400f354f398da633ee1425b69fd5b2009a0d235625c2cd9981fb07c1ebf53c8bd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
d2e58fb9cc966b8c70a7a70ed6a56a91

SHA1
44c65e34433026b2915dc00864b7da4975dc101b

SHA256
d932a42e3759541e5e8464cba88840742d8bf562ec692bac1857aceb0f9a84a7

SHA512
05c7f437860edee06e5b9aa88b473e6749140b2701b4f5d674fa73a4fc0f84bf79a33a007527e6260b60e87bfe5a3346f237123e5f7d2f400b52d2806d0d3f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
209B

MD5
9121618d45f17ab47e57d0ae5d4c0d20

SHA1
2625dcd42fe545da974b0a4b7cef6a6b870ff919

SHA256
62db9a0d08dd2715f116e1fdfbf2793a07ba0fa7cdc8f438c9ef9bd3f20955ce

SHA512
a1b26c6ba9371fc4bab4a09a23872ea28febbb50aa2b1c829108cd0324d284b377c9511e9ecb611c59042f762d86a20dd23c885fc2e29f21510bf7c33a3a011a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
293B

MD5
d2aa1805454aed475486ddfdb98e8e2e

SHA1
2bab588e099de22cba7b6106f4b8821c223c509c

SHA256
453d25f3ac1da9a52f0e084c2460788ebc04e4ddbf634ed41eb7bebaf12505d0

SHA512
2ad5388d533d44f1b5973aea4530880ea386dc7eaab0ea460730846ab2fe2f953d2058d86e1f41e14ca0099ca3446c798ef8d3a5e66d4de111739d140e02db13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
699B

MD5
5abe65607ac9db999484bc338e62191b

SHA1
ab98cceff1f45229e24910e3ccf2f815de2fb07b

SHA256
82ed5d6b099babe6e205233ed7b08a274059d3aa6b84f75cbf105aea24a4b6a1

SHA512
ffe72965b18a6e901f24854275eb8007318d5201b9408316408f378ca8f60e4df4d804bf40b3bedda53ffeb764f15ddfd55671700dabdd600007843ff7ad485a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef5a52d0fd44a108341a1085b44e78f9

SHA1
5f330168d80e51159e0e62dee1d4e47b1e97a59a

SHA256
66d99817d0a2b73f22b9758e34a39977c80be7d2b28f430bdbdca473715b9e2e

SHA512
5501d569ef5b2fc620f70a3549302a73c09e299ffb988d5c2180dfaf1644ba036d8482d94b5f464c19038d4cd63034bb3886fc3bcd8ff2718c6d5ca1137e591d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
129381d8f98855777a9e8ca416fffe16

SHA1
f9366d87b02bda95008a77931fd4da453a7f6be2

SHA256
4de19b2d019fa68295f0a3ea4b2b335da93c84893fafad0556c4149909f608c4

SHA512
7085f98b21f8b07f0812afa399656c2817a8a55e315eef93cf0352bc02c17da02c8cab46b5fdee59b378d7ad011bd9fcea12cccca19864216a6b779bc762e68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
02b402720eb1a6b3e6c81a76b184408d

SHA1
53d41499cf0f38d73b7c5f77d8ef6f1c29108a4f

SHA256
925647edcd23d4d3ffa2f759768b1b2295224fb636979e365e87c18e0935af49

SHA512
e268688cb754b608465d259ca5e5d40fb83eb4fb7189e832b7b267248293d105053c84bf882203fe5f1479eb8d820ba486736715d8d4c103c80347b0d9b4b390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
952a6e3cbc50f011cf2f04c9470080ff

SHA1
a0d6a2509af73e523c970f6e4351861bde63d6db

SHA256
faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f

SHA512
7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
74d9eb5260fef5b115bec73a0af9ac54

SHA1
18862574f0044f4591a2c3cf156db8f237787acf

SHA256
7d7e7b38664d625a0bbffbcb7882b175709e92987bf9da113c4745fafbbc361d

SHA512
b85917201b1d4b4542a4424ce40ddd083ddbd0e230e1931fe6f7cdd2aa3d8a0eec8daa743ddc5467f0a92da5594144c602081d941b216ca9cafdfd3c150d32d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
257ee020ff394d4dcf13f722434b1c94

SHA1
47f5d80fe7fa2d7e9dc199a104b45a696bc2b465

SHA256
aa6d9804baf9d957cc937ecdd2dbfcc15ced2fd71b3d9eb047aabcdc2b693588

SHA512
6b20e800209b291443db3b714fc9eb2379e1d2ecacddfd26fc4fcdde780b4488cf1b29f8e17893d996488a5bb7a4ea45e4fd0caec94d030d210d030d22456e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
eecbbd6f3b03bddcb6dccae9ca68154f

SHA1
f26d3bf7138e53d4feecd19e7b2751867ca3c107

SHA256
666833ba95ff9914ae7bc4781236008409040245efaa296287afedd369815de4

SHA512
b648a9516b31698508f0078aaf034c1eb372d175c0d015f331bedc532f583c456c7c0b863923946db7ff49d64c96cfe9460a83080b0293deb72238580152b4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4c0.TMP

Filesize
872B

MD5
20eceba9959e90706c3f3dfa374db982

SHA1
6e7c6c51af8f095d421278fc9d4234fcb512f30e

SHA256
f4a556d2ff8cbde86495d0bec8370ea1ce0313e95ae3657959042e530e5f6af7

SHA512
c26206d5f3528bb88f7909822478aec354bb386ea2db909565a7020fe232a5402315add949e83c0ad173416d3f2fcb7f0c5c1282acb268354c7611b42c2209cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
e9f66d69bc971d56c1363695d396f464

SHA1
4d96ce0e43aed46df928ba6a627e7934bdb0416d

SHA256
9c314e68a0d12a282f0033f0d5dfc2f4a7df590dfce843f1db39097273b1cd23

SHA512
dd5a5126cc2beee33618ec192986ffa98febf87f9915e3ed7e8c41ff11e8d580df54d0e0d8370f678d29370931ea3b28cd68e90269b894b2f5d433574ab7be90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
afef23c659e8aef42de50b1f962275df

SHA1
ae0a7e36b92533cb14108b8cbd90ea3eb4d01442

SHA256
1fc36f45ada864d48bb1358401504927ca481ea233bd227113a70fb88f2213c0

SHA512
68ddeb6a63c3a8c7c65508e657ef81775cf8750694258056ec7e4cdb04232d5ab2754cd9e3aaa9185d8aa7df087589e5670332d1e8824f6c68e29ffb02da5663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2c1d7c966d12d99d7fac59faadb8a9c

SHA1
f16c8ab57642dc88990c1c51d467e58bfd6763a8

SHA256
5c80ad0b1409050ffd6ef0abb229e822a07f65c0a736f1164123f9c44ccb0248

SHA512
649d2be2782452f62331c1e16c326409af956ec5be1b2a4370609c3252d4779445ac4a4753922abf26263fbd3f429cbae2ad506826f8a46ae88e67babb312230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
924854787a58c978ab316c8fb03c6984

SHA1
b7337296999df60020d16db19e386d0fce776f7d

SHA256
9cb71bfd52ace889590bea3c5ea9ec4e8e919736d1f3bf52a2877dd0280fea5d

SHA512
ce55aa2fb3fc6c393c515e5eb7bf1bb620c0c5c3acb2bf24a0c20ff7966ae71534f31a78512163bf86e2c537c01c5f2cf2ff64da6f6f388f8d1d0e67bf59d498

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
10fb9e26b26742a6040814cccafa1196

SHA1
754b17d9d5500e1aa85ec54a44eef12cc40b8512

SHA256
fe80b094bb4187342f5ff1892366829eab6712a6a4030e218f6baaad869228fd

SHA512
d3c10b7178962c6dad9b9253bfece30845aebc0682cf761509c59a9354d1f1ff9a037c69d2113f59d3c32d05d85c2899c4aa8800b6ec76655b4afabbf0bdea38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a435397185dbfb627cce13236c0e3fe0

SHA1
3e41aa49c4090e9e244768b7a30eba1b862a4c8c

SHA256
8a7fe6bab372013eeb739da2297146c8dfa5e0147ef8c114ec0c6c3b8a8ce50d

SHA512
4ed2d5478e63d715335d54d9f3360d29f16248c5355cbfc0d8542147db592ba83f665e1dc3111f9d51a54c31ea2be0d179cecaf23fcc67b9e907461620db1cce

Download Submit
C:\Users\Admin\Downloads\Crosshair-X\Crosshair-X.exe

Filesize
3.6MB

MD5
979f82f61cbec2d6a3612f31c48c1e68

SHA1
dd201171c887c24563736d759e80ff4a804f6058

SHA256
25bb8fb4cf7b57c2b1cea335f113ade65f33b5e797f1f5ce973ad4a9fd0d9cf6

SHA512
93d52fbd30adce86789bda8b76361ee902f2813bf35d399c1ca3b6f035a7c300d2323b732b5926ffb4567043170a07465dd1f9a57e28bcaa2ec6d5169bc90cb5

Download Submit
C:\Users\Admin\Downloads\Crosshair-X\src\static\sounds\ui-sounds\secondary-system\alert_error-03.wav

Filesize
267KB

MD5
486c28fc374424364c825f941c020a5e

SHA1
bfa02baa07aa732485ee7b8a8c3dfe11bddf96af

SHA256
14578505dc4a7c97bf65097cecc66c74bb35d2cdf58137215a54f8a956344a3b

SHA512
729664999ac937ee37b6dfcf90a6a0c4a80c5629f9412e2ce6e2bd3aa576655440e22b58c96394311522b4d0781e1d7d0a10269d7230bcdf7ed41a04fbfab648

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 915598.crdownload

Filesize
22.5MB

MD5
550d99966f776df5a4bcaf5fbeda7eb8

SHA1
2f38b80de6b9968b8d5a8974e99188f310a63577

SHA256
ea6d08a9b5f2f4dc3b8f6eecfa39cc2b0c29fe33b84fbc57460e8cf2efaeea30

SHA512
694d876065e9ff55720a61188d54ca9d0f3a2d76bc9d014bce5fbffe26c5e12aba55a50080c660d23867797f25713de5164e736fbd4b06bcafc2dfdd14b0a71e

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/968-1901-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/968-1903-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download