hxxps://www[.]mediafire[.]com/file/o5nth1568oz727t/Cryptic[.]zip/file

Analysis

max time kernel
275s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16-01-2025 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
155	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5472	msedgewebview2.exe
2064	msedgewebview2.exe
1852	msedgewebview2.exe
568	msedgewebview2.exe
3420	msedgewebview2.exe
5404	msedgewebview2.exe
2568	msedgewebview2.exe
5252	msedgewebview2.exe
2100	msedgewebview2.exe
2216	msedgewebview2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Cryptic.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1188	msedgewebview2.exe
1188	msedgewebview2.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
5252	msedgewebview2.exe
5252	msedgewebview2.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2568	msedgewebview2.exe
2568	msedgewebview2.exe
2568	msedgewebview2.exe
2568	msedgewebview2.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe
2464	Cryptic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1612	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	2464	Cryptic.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
1612	msedgewebview2.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 3140 wrote to memory of 992	3140	firefox.exe	77
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 2284	992	firefox.exe	78
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79
PID 992 wrote to memory of 3516	992	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/file/o5nth1568oz727t/Cryptic.zip/file
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb43a2ac-015d-4ebd-9570-703d0a5d1e71} 992 "\\.\pipe\gecko-crash-server-pipe.992" gpu
    3⤵
    PID:2284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63ed74ed-d223-4041-bd02-88957b0f3c58} 992 "\\.\pipe\gecko-crash-server-pipe.992" socket
    3⤵
    PID:3516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2780 -childID 1 -isForBrowser -prefsHandle 1624 -prefMapHandle 2828 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {785e9754-1a4a-440d-a72a-396f7bd472c9} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3560 -childID 2 -isForBrowser -prefsHandle 3760 -prefMapHandle 3756 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2259e6f-c3e3-4787-bf36-88eeebe659b0} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4128 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4228 -prefMapHandle 4140 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d161d3-4cae-4aa7-9eba-11716c2477e8} 992 "\\.\pipe\gecko-crash-server-pipe.992" utility
    3⤵
    - Checks processor information in registry
    PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 3 -isForBrowser -prefsHandle 5556 -prefMapHandle 5512 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51a82c67-95f4-4683-a0e5-35d78d173114} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 4 -isForBrowser -prefsHandle 5712 -prefMapHandle 5684 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa923c83-921e-47b9-bd2f-c81796a89a40} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 5 -isForBrowser -prefsHandle 6004 -prefMapHandle 6000 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a529a3f5-fe9c-4a68-af83-8f6bc2c3c826} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6488 -childID 6 -isForBrowser -prefsHandle 6484 -prefMapHandle 6312 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aac98f8c-ede3-42c3-9802-6b4838ab3612} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6616 -childID 7 -isForBrowser -prefsHandle 6660 -prefMapHandle 6656 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20291bce-5ff0-4fd0-83ce-74a68d249622} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6960 -childID 8 -isForBrowser -prefsHandle 6988 -prefMapHandle 6912 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5910dc1-3e22-4faf-9b4b-b1b77026ef0a} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:1176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3916 -childID 9 -isForBrowser -prefsHandle 3900 -prefMapHandle 3984 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaf0eeba-8afd-492a-8769-0931ab4d99eb} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7144 -childID 10 -isForBrowser -prefsHandle 6072 -prefMapHandle 6068 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6265af40-1c2b-45e8-92aa-b1a497ca0714} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:2308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5284 -childID 11 -isForBrowser -prefsHandle 7284 -prefMapHandle 5984 -prefsLen 33835 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e078b298-c8b1-4a7f-96ec-1f48900c6f8d} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6944 -childID 12 -isForBrowser -prefsHandle 7216 -prefMapHandle 7212 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b2cd69d-c617-4c41-8b1a-9d9e74e65149} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7452 -childID 13 -isForBrowser -prefsHandle 7460 -prefMapHandle 7428 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a6259d3-5a5d-4ea4-ad11-b63744cdef13} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7708 -childID 14 -isForBrowser -prefsHandle 7856 -prefMapHandle 7852 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd37a4f2-8cbe-4552-8fd4-271d62518217} 992 "\\.\pipe\gecko-crash-server-pipe.992" tab
    3⤵
    PID:5192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3956

C:\Users\Admin\Desktop\Cryptic\Cryptic.exe
"C:\Users\Admin\Desktop\Cryptic\Cryptic.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=2464.2052.1848827363928393015
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x130,0x7ffbd9703cb8,0x7ffbd9703cc8,0x7ffbd9703cd8
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4252 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4528 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4228 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1976,3546993881496593073,1684884912517194203,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView" --webview-exe-name=Cryptic.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1880 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
5acbf6e33f35665e9935ec76f51e0c1d

SHA1
33a70bfa8be9ece822cbc1977c101ec7400bf9ec

SHA256
3dcfe0bf5d46baad66cb45afaa171ed18df7a98cbf487ca55b24b78db400ef24

SHA512
e3ec7158768b1c318a8beb17e354ae7d9496fcb62ecf3343f3550386084071cc6875a3449459dcb3e129f56bc0abb0376d36d104685fe8ff8aa32c580abc5beb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\cache2\entries\C480DC2E887C2EC5556F7B69EB07B76AE5666CED

Filesize
443KB

MD5
45e5151e6083fbab648732fed79e9293

SHA1
4ca4e94964fa558f0ceff3d984812a1f6438a80a

SHA256
44f01083b5edf7ea70f7c9dd1789959dac35b5474fcd4e41fcd6cbe75f080ccc

SHA512
052d5639ef9980282235bccdd10413c9682cfe60a41f4015a435c497ea946ad4d5c085f0d109099e3e1eeffba4156eff6a53d8aede89800e58fd299d120e5455

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
24KB

MD5
3417fd5646328241699d24b0bb3eff6f

SHA1
e9ac74f86ede16cc6641244429031fb1a040bf0b

SHA256
58739c129a432bfa398cb230cc272c52b07b59147569b73b17c9728ee60837ca

SHA512
39c393724219e878aa4030561e8ff2e8a553bc86dceed8123a948460ec582231fd63730311e57dbe2082636ee218fddb0a1019864a4c5bbd4b1a56de965a4926

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
23KB

MD5
48931d601cc49c5b937234fb3ad9061f

SHA1
6fcc832853b6747c6a0f72862f944fd5714b0284

SHA256
4596c9a6517c72cbc3e5154bd3247c28c4bfbf7ec64a71f7462c997e8be8ca0f

SHA512
0712f8f1e858c2a0e27b1aa5736fa04623d4b357f988c430883712620b2418cf1bf83141cbe67f1ad52292b6bfbfbfea2fba8b69babccfb8b4c2f28b3551f7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
6KB

MD5
49cb555fefd0562a68ae30092b468007

SHA1
d887d1d500a6aaf543261d9188af32b3d78b7227

SHA256
bd5d2231cd549f762d2dc7a5db06b509e2445fdaefb981a25b677d1b6e2f3cc2

SHA512
6b9f2a881e67d81157b710d86dd2a3afdc584de6330ce39699cf11f5b87fadfeccc62461a6828dd3c6dc4b96a88ed40eaed58f10a7b3f78ac56582b5fdb9521d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
7KB

MD5
5d37a6241b9624b223663153571af5bb

SHA1
8313199127e2796b0e01c58d56a32d9a32860baa

SHA256
823a8f6e2d6ee1b0abf0864c83c61fd525eed9c17fa54476562e5b6cc9b20858

SHA512
8bdb86d64825c92176431df5ff9fbea9439de6c2d8094aa154965d5bc4bcc9520f5518e8c6044b043be6ab5ece1dee23f31782b51bdedc11f6dbe40226c88e7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
46KB

MD5
04db6ae78c066ee98280b1446b987858

SHA1
2ead0440e76379db0a5dcd2b417bb7e83441419a

SHA256
1aed8e16304ea6ece4a4d52a49ef564b564c07820ef525421c66c99968164163

SHA512
564d9c035eecbf9204f11cb182fa6075fdd900b34314752c753ba168237801e56183228d9549d5bf9c1b79804e2c199a6f82251e9fc4a4c67292eedd34a542ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
4584a989e85f9532ad3a28eb2eb34863

SHA1
cf1c202a2b5fb736a89d41859343976ddfda8864

SHA256
e3b6e2667bbcafba58f01cbdf4b2fc7450710705f20b19be2a9755220b77274a

SHA512
35e11de2abb751c1578cf46d248b094ad2fef2804e6e19393d6f959514987b1a37ce6182f200efe9d1ef3b92e361bdd3c5b7aebdfa360eec2711f3f38a531f94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
bfe91b9deb829ea9f2db5c52ccb24322

SHA1
39e8820ee6d1a9ada3b1c1f372cb91c934c4801e

SHA256
7d181955eb6e5dcae269edcde738625fb73f1c894e06b5066644c2a584edb0eb

SHA512
1fdeac9c0ac5cace994623b386eb775b7941d8e61482f24ea97600ca7089050114e798e38e3dd0bf4586298f2c7b808c0d66fe2e76440f956d9eebfaf8ea5155

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
71KB

MD5
dde9190629324fb1c132b04cc14dcc77

SHA1
b127529f45c430bd0a1f232581df53473cb954fa

SHA256
a39c3ad0bc45a4fb7afe6fc5ecc19ced34f5e7ac3525075a1a9f025fdfee1998

SHA512
0175e62cf7624bd9b1c598fce32266cf6cbd240c65ed4f70b8dc080858b7819ee64fd5bf607328b5261d069c1ea56b386810ebff93a8126f2481cb25745526a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
5bb6bfd4054d763ae545897be9a11931

SHA1
778793eed767f64d465d6fd2be53b586186702c9

SHA256
dc6ec2513763bbdb6c4dc3d58543df7286be320641b9a63c60951fd63477b1a5

SHA512
ba76828e99523dc7c476d0073e0f88527a85597552e81dd63220b2aed74dffd4507d6304d7e0bc380c1d760b235a82a5b3b3140f98fb693d1a7ac7a8b48d0bc4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
350bd2a4fc92684b11088b8e7c7bf0b4

SHA1
ddd3ca974302f489cffe03f95f6affee793e5f76

SHA256
33a759fe51ca0555533c35053908c6bdaa76a308f214c6c92b94583e0dd24075

SHA512
36141aefd4740511d1816767cbe86cb52636e40469ea0b49c1526b115ed403e2b0b84735cb8b691b540223da3dc24b43127aabc2542bcf1494cee8fc8a84e9c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\548f8f85-b980-4d40-9d7c-2157df88ed06

Filesize
671B

MD5
1de5ee495ba211f7fa2d5fb3df6b0c0b

SHA1
b5cc7a39c3ca8088ea6785fafa5488620c3cd30c

SHA256
d39a574c4e581bec8ee7273436e818feb4c8007aa89b7181f65c8b34168db5e0

SHA512
cd59fe8263160c1fefc99cc8c6829e105b12b678107fc6e88b29acf748092ab973338fc58bdcbcac29bfc6c79f2b5a46fa110fef7d647a61faa36b0998d32c87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\b33d8555-4a12-4a2e-b34d-541d67c3b867

Filesize
24KB

MD5
0510d98c136604ef47e0989853315019

SHA1
97c8ab10deb33900cca312f10637b813e9086a9f

SHA256
28165506798852c4da8514f4c9fe785e0fd089998471d95d52ca9253987feb24

SHA512
91a39fb1c8099e01c498ca67a1dd482dca75a2edccbe78a166f99c90e7b3bb60572bb3e58737373c4281969629526606ca507a2b4c6b044bd66c262ffecbd20d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\de93326c-af3d-4bd4-8c91-1933038c77f0

Filesize
982B

MD5
6dd5e1b22925e87428a9bb900cafaebe

SHA1
04a4763d39208498fd184ed4428b59fe80cc209c

SHA256
077ff5f55b6f10913c7d6a63237d0ce9654829dc9f0717aa524bf5b488eb29e8

SHA512
ff402560b04a3c5995cf3bda3187e4d3cca128c69965b1fc10574e7f5a54772b075b501c4e84c0ea00fc909332dba717d1e0dfafb80b5fd0e685f73d09017fee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs-1.js

Filesize
9KB

MD5
73f5987e5e9a7f23a74b759169ad566c

SHA1
689280ce3e6db218c1a6ea9fede3accfcf79515d

SHA256
88e98ee2aa031663fb2f6fcc215df1e5fb0fe36620e929120af1f550fe522cb4

SHA512
d3bf8049b83e3fbfa2a13506e443c0ec37d238c2334c3ea7f618dddf3f4c22ee0ebf5503f2474c5bea47ae448afaefe3e0c0b4f2fece2219d80d5610c01b133b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs-1.js

Filesize
10KB

MD5
c86a56e606b2ce2187d5f21a49050051

SHA1
de57a8060da81c304109ca943267ee084ac540c3

SHA256
fbc90502d342ed5791e9c199eae8497263a80b8952bde2ef343427f7e914f268

SHA512
05063002a7f6fc8c9aedf830864a802867db2265a22d1f89d5066f7677c9b1b8c8775572207d937156620765dafd41d2ddc66ec4413b62bc94cec8974b901818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
11KB

MD5
c2d6439d42d8214045789d292b1369b4

SHA1
a20c579bdb2b389bc1a7a3b7a3066c8282baf3e4

SHA256
927523b8a744fdb53f56846711e68361f1dfc60498347295518666c968c888c7

SHA512
8bf3fcd06b67439fcac07b27340c94a1f85ea22e6c25c760f662caf6ce7e28edf898b4cf7444c7f8eeb7f0cf559eea4ab1be94810269161f58443ccb5a130e88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
c0981cce05aea48607f51fd20d1efc10

SHA1
84a72c68bf804836ce318afbae0f3ce14b70a1ab

SHA256
7ebfd2e106a2105490ae36c840bd6ca30ddc1800ba8c9db963c7556b9342a439

SHA512
23f523f11d4c91d55818eeac2e821e6657866df762bf714c33ec563c9a7507669381be75ad557830830aa2a023aa46e42c0e791aa4df5dfb63d8bed469b4fb29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
f71ecd2b2fb0e2c5bf96b2cbb1fba309

SHA1
b749342d8a4331aeacc2b26f62e1942b14b16851

SHA256
eb22c58e2701ef41993232e06277b451dd16e79ba84ae54a3b6534a03bd1e82c

SHA512
53ac1b85748360b9e02af8db1b00013ed7210360feb358d64a53e9b696bb1bad235b91fc38b13fca88035c65ca8db0b799654a08e8e96e01efcd6db6bef788b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
7cf42c1a7bb36c73154ecd9529d0491c

SHA1
b420ab4f9d4e3a03354a285477e5583a6058c3c6

SHA256
d820cba92f98d803c13ff76bd7509aee56206d1360c1265b06c4717667035e90

SHA512
45b471804fe6e54967f6c1b14c8dee42a4fe34748e22a27536f89036bad35d905d4e8e0269d8f1edb4fcc5ff662623c5a6ccc45cc3ccb93a7d02b4e796cd6c1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
24KB

MD5
ea685c08b29b3718c061b186ec01de6b

SHA1
0ee2787477193078bde8b91bd3ea38d8a919caff

SHA256
c49247aae6e2c4a0ef7308461bb210a7214083d2d95944ea62647b7bc380bc78

SHA512
e86ffa97aad932688a3b37d7b19616e29792394e8d4d5b10bf52a08effdbe4c8749f987a5f6ca103ed1d753708af43beb01d0a80c787c5b96b4fa208aee9778e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
22KB

MD5
1679559ab5e1cb9254fbab99a70f7e98

SHA1
80e52bb202d09fef35312ade40f00c751d23d803

SHA256
5ed11140822f380590ae90c20c8a5568bf4041c1d2c41333eb3fd8f9f040bd72

SHA512
7e723ee5fab029fa9dde5306109ced9b5a9ac7e386a61af384f841958b076b3f90e5d79ed530de64edefb8b4e630c68377aebbe257d7c4d3725f4888763561e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
e14ee9fe5337caa2ae3ca617580a5dcc

SHA1
623d62e43c58b71262c06fdf2e6a339f81c6af40

SHA256
93ad79d0196ac6741461bcd78d3bc371cb98eb200c991692262bdc3697575f61

SHA512
b564189593625837d0ad0259bf3adc451f14cb11b6d9aaad9be97574bd457f59eccbdf7f0a58abfc339c8e5cd584af5b5dcbadbd98733e44e586dd7f3d5dea02

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
19fb1d76740369b3148b4dc64b53089f

SHA1
e3989428c30ab7d8957e80074ea4ae10b87f5382

SHA256
67cffb84dfe1d06084369d077d3d733ea88d41658ac6d2a47246f3adc7e1cef7

SHA512
015db9650f684c288e9c4dff4df11b5e0a6e96456709e02cce41f01e76a22f07a48ba8beb53cac00ddf4bd7bc6830cd86669fb9d4fa556f1058081a5b7d67b1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
24KB

MD5
7cad99957ef61b6c6dc0d76322399150

SHA1
2dc3302967e68403a6b599057ce77f21fef03c61

SHA256
4882aa952e5ae62c9aaa6692f82fbc1c7322627f1258a4af2870b5dbce64dbb9

SHA512
b2eb7150214fcf6758c5089b618da9ebd708b076e0d0f065459c6ed700a7b334e742299a1f45c61440d37055d9eca6c07958014affa0dd94e1cd4fe87a591437

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
7dea8c277ec965563f185d689b62a54a

SHA1
5ea074dc5e60fa0f87a8dfd382dc46523b89595c

SHA256
5229c29f7731751f3b89a6151bc3a8d20c795fb7a27a99f186fde5d0a19539e0

SHA512
e2a2c319d91f6b90f5df2195bce03829cdcc43d342490679480ba0e80db85b429f2efb0bd6d53a961948da55a9472c08acc282c18ec231e153576075b1bd3271

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
82e75dda6ce3abc11c967dc03ae34fed

SHA1
f409b1e7c4da76df06649014319e2dced5bb1736

SHA256
1d84b2c9907fd7b9a1ab91969aeedef118d488582df32ed7112a2b30b0941b61

SHA512
debb25d5345624d26bf1a453411440c9ccbd0c5c985d3a3555d4d7b0cd1f8cacc95e1af7b0efe1707670440703642c7a9b981bf5203e8727074833fb2d08af16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
7ed3345c9c6c5a9c70a34d3752f877e4

SHA1
48a93b6880e1b38105721727b488915dea70537f

SHA256
fff99de3eb6780b688bd7d00d06878e515c59d06d765399422df99c6935eed2e

SHA512
0e3d2bcff9556ba44321220240d93d37686a46008c345a798f9fcfbf41a77e474f61f6e76d8c48018b67614c2d5aa221914c4b76be1d83b982422fbbff52b440

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
15KB

MD5
6ac15f85092ede87c9d802a5e8af29fe

SHA1
2c752943909a0ea0b52c25dd8263e8f353c46808

SHA256
a48a1e0382d674df5824df4dedcc2ab57867d7d25524ddb29a7aa15990134b8b

SHA512
b69a9bc7aad36a4005fbfd4a15c8c9ae8b0c6f5c9d78764627992b3b0e8b33f0823628d5a3e36cc69320eabdd6213392233b1f570e73678ed2a7496cb53efa08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\storage\default\https+++www.googletagmanager.com^partitionKey=%28https%2Copera.com%29\cache\morgue\236\{3c4f6689-48a9-4f2b-b964-25aa08251fec}.final

Filesize
11KB

MD5
c84f1b624e16ab4c39b9ed6098b665c3

SHA1
a9031f6923b3c7889c066d8e9c3e0a165337b36d

SHA256
74690facfeea8bade05c1f7d74c4a7062fd9bb6145ecb0b5431d6a4666c0a324

SHA512
b5ccdf43dfda65fda4d3d56e8c0ea8825f3da4c421f8e6babaa451ba1bf5087ee39459a76dc6a114a5e0cefd98438b56a9da2c87c31e1a6b92cb78d2e7794e00

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
594e4e24aaf75871f8936f871badd4a7

SHA1
4d30af454908a0311bedb76b0705b6e44902bc68

SHA256
7db27b5feef4e094c04c570763ef27014aa3f57d44aa15f19afbe9cc14a68b74

SHA512
0578f811cdd97b7cc21306c5055e2cad63b2d5eef9bb14819ad69abc060dec0b886b0ac71cee697f8a53634961a566deccb42d74c1edf51f26ae676b186c3145

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Network Persistent State

Filesize
382B

MD5
945c0855c9bc41266c387467acc6f944

SHA1
2f69cfce7775dfc492ca006ab69be95a79a356fc

SHA256
ebf4191c25ea634b20ff36dfd812c59cd399442c84c42baffea2b7b6983cff68

SHA512
512f4543db323639909a6a4024a24323485ef9946bd6d0b340c30ddb6b101cba707f8aa077e36e9754fd6f756c0b254601f0b8e139e283115ad21f0183ee7ad0

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Network Persistent State~RFe59c654.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Preferences

Filesize
3KB

MD5
bb7114a8dbd18bb2d6a977a1129536b2

SHA1
65aba8581a4e247c5ebbb0111e476fdd16b017d5

SHA256
d5a3521ab3b173d6f08b39950330c8855146e663ccd3a44db32618ad3a1a4ad6

SHA512
f891d89a6fd871df7b96072353c790ee858c541b2df65975688d52cc6859a474cfc4dbe04f38288b88c5f221f542e0427ecf5a6e6edef17fcfefbc47d8ddce43

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Preferences~RFe59c21d.TMP

Filesize
3KB

MD5
29acc2a6d95cff1626c1b4dd392e9949

SHA1
b605db3c759e7e8f8a3e570598b8c0b73e977ff4

SHA256
5620d0e60af2205d34220d0f7a8a136d6847a349d98136f46aa1cf1a1cd059bc

SHA512
b37a670f97b1a4e1a58984e89b306b595cda47f7d49de8a0d5e4b15a90ea368c06de86baa3ae9145758578db62e265af88521143052fe89f381f88884c80fc16

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State

Filesize
8KB

MD5
52b2e77dde6b999c31a1f126ef639a26

SHA1
a0410e932c1c68eeb8ae5dc41f208bc82c2cb1fa

SHA256
92f80bf9ad6a36f2ee7c8a9efc1acdbef1d5901ee93b82fa73d4e742035c5d02

SHA512
16229c273ae68426814a4a03f78fc1ea4478f1eea7bd5bc9e62151bcec0303f80aad7ca376295c3de4d7888e58e9f118ec0b4517ffde86fe836187f8768e7586

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Local State~RFe58fc6c.TMP

Filesize
8KB

MD5
878f86d86706ffb2d23390e4eb5f3aec

SHA1
b538e4527c998909af5df2ce9e863abf212c7d71

SHA256
bb7f76972ba4246cf57b7d7253f0fe6cafd42f9e5e3a32a99adff4595f581fb4

SHA512
faa3a5f4b1e542f9851501ee41dd44104cbbb986813bbeb38ac634041678d098697d93fed0e901345f1057d8f3ea95222cdc9eac9108bd9cd5edfa2b62c57437

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Advertising

Filesize
24KB

MD5
131857baba78228374284295fcab3d66

SHA1
180e53e0f9f08745f28207d1f7b394455cf41543

SHA256
b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49

SHA512
c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Analytics

Filesize
4KB

MD5
da298eacf42b8fd3bf54b5030976159b

SHA1
a976f4f5e2d81f80dc0e8a10595190f35e9d324b

SHA256
3abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec

SHA512
5bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptions

Filesize
689B

MD5
108de320dc5348d3b6af1f06a4374407

SHA1
90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b

SHA256
5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53

SHA512
70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Content

Filesize
6KB

MD5
97ea4c3bfaadcb4b176e18f536d8b925

SHA1
61f2eae05bf91d437da7a46a85cbaa13d5a7c7af

SHA256
72ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554

SHA512
5a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Cryptomining

Filesize
1KB

MD5
16779f9f388a6dbefdcaa33c25db08f6

SHA1
d0bfd4788f04251f4f2ac42be198fb717e0046ae

SHA256
75ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639

SHA512
abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Entities

Filesize
68KB

MD5
571c13809cc4efaff6e0b650858b9744

SHA1
83e82a841f1565ad3c395cbc83cb5b0a1e83e132

SHA256
ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b

SHA512
93ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Fingerprinting

Filesize
1KB

MD5
b46196ad79c9ef6ddacc36b790350ca9

SHA1
3df9069231c232fe8571a4772eb832fbbe376c23

SHA256
a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3

SHA512
61d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Other

Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Social

Filesize
355B

MD5
4c817c4cb035841975c6738aa05742d9

SHA1
1d89da38b339cd9a1aadfc824ed8667018817d4e

SHA256
4358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6

SHA512
fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Advertising

Filesize
2KB

MD5
326ddffc1f869b14073a979c0a34d34d

SHA1
df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63

SHA256
d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb

SHA512
3822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Analytics

Filesize
432B

MD5
01f1f3c305218510ccd9aaa42aee9850

SHA1
fbf3e681409d9fb4d36cba1f865b5995de79118c

SHA256
62d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620

SHA512
e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Content

Filesize
48B

MD5
7b0b4a9aafc18cf64f4d4daf365d2d8d

SHA1
e9ed1ecbec6cccfefe00f9718c93db3d66851494

SHA256
0b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43

SHA512
a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Cryptomining

Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Entities

Filesize
42KB

MD5
f446eb7054a356d9e803420c8ec41256

SHA1
98a1606a2ba882106177307ae11ec76cfb1a07ee

SHA256
4dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640

SHA512
3cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Fingerprinting

Filesize
172B

MD5
3852430540e0356d1ba68f31be011533

SHA1
d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff

SHA256
f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054

SHA512
7a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Other

Filesize
91B

MD5
09cedaa60eab8c7d7644d81cf792fe76

SHA1
e68e199c88ea96fcb94b720f300f7098b65d1858

SHA256
c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975

SHA512
564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Social

Filesize
3KB

MD5
318801ce3611c0d25c65b809dd9b5b3c

SHA1
b9d07f2aa9da1d83180dc24459093e20fe9cf1d8

SHA256
2458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03

SHA512
7daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103

Download Submit
C:\Users\Admin\Desktop\Cryptic\Cryptic.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Staging

Filesize
16KB

MD5
39bdf35ac4557a2d2a4efdeeb038723e

SHA1
9703ca8af3432b851cb5054036de32f8ba7b083f

SHA256
04441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae

SHA512
732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284

Download Submit
C:\Users\Admin\Downloads\Cryptic.Q2K6pJK-.zip.part

Filesize
6.5MB

MD5
576fe1b9566d71aec47bb662445b5a31

SHA1
d5432ad8e994549da0cde1cb5c86b2e9cb5b453f

SHA256
f6b958ccc17f05631144f5abf8393f06f5bc224ff85972739d586cf1bbef628f

SHA512
5e6beefb50aa51cbcc3e365393d350c5832978dc13ae11e1691cf3ad6c7080b366412d9ef9d46532f75f105769971463e012b82ff8a90348dae47ff5892a391a

Download Submit
memory/568-871-0x00007FFC006A0000-0x00007FFC006A1000-memory.dmp

Filesize
4KB

Download
memory/1612-1190-0x000001C2E7A00000-0x000001C2E7C3C000-memory.dmp

Filesize
2.2MB

Download
memory/1612-1578-0x000001C2E7A00000-0x000001C2E7C3C000-memory.dmp

Filesize
2.2MB

Download
memory/1612-1484-0x000001C2E7A00000-0x000001C2E7C3C000-memory.dmp

Filesize
2.2MB

Download
memory/1612-1796-0x000001C2E7A00000-0x000001C2E7C3C000-memory.dmp

Filesize
2.2MB

Download