a2de0ab72ca3fec53455fff38a806ec9300d18fdef7193db3b3d0d15ef6e566e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrucibleSetup.exe
Size 138KB
Sample260722-w2dyfa1hpc
SHA256 a2de0ab72ca3fec53455fff38a806ec9300d18fdef7193db3b3d0d15ef6e566e
MD5 d5799922d705dd0fbf3d30ae57ecbecf
SHA1 be43e7a86c7d756e9249b2417ce00c46aa4e71b6
SHA512 82c3a58442fd3a473ecd68dda0f4ec04af611d93f6f65cdc71818ecf375077665a962066e9b3a4eb2a486105274ee920d91320d02a943c9ba304e2e9f5fe8abf
SSDEEP 3072:pyWDF6onu2DhVVuDOlDVDsRLuEx4qv+xVcW56PpUN8RuQySOWl5/x:pyWZ6otCtLbiqmwpUN8RuQ4sx
TLSH
T138D30221A6D4C03AD1F1437125777BAB6AFD913A17AC2F0753445AAD3C43242AA1FBF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	5460	CrucibleSetup.exe

Executes dropped EXE 1 IoCs

pid	Process
3844	Crucible.exe

Loads dropped DLL 5 IoCs

pid	Process
5460	CrucibleSetup.exe
5460	CrucibleSetup.exe
5460	CrucibleSetup.exe
5460	CrucibleSetup.exe
5460	CrucibleSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crucible.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1089543797\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1089543797\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1673409120\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1089543797\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1089543797\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4440_1089543797\manifest.fingerprint	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrucibleSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	powershell.exe
2324	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4440	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3844	Crucible.exe
3844	Crucible.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3844	Crucible.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 2324	5460	CrucibleSetup.exe	89
PID 5460 wrote to memory of 3844	5460	CrucibleSetup.exe	93
PID 3844 wrote to memory of 4440	3844	Crucible.exe	94
PID 4440 wrote to memory of 4284	4440	msedgewebview2.exe	95
PID 4440 wrote to memory of 3872	4440	msedgewebview2.exe	96
PID 4440 wrote to memory of 3872	4440	msedgewebview2.exe	96
PID 4440 wrote to memory of 3872	4440	msedgewebview2.exe	96
PID 4440 wrote to memory of 3872	4440	msedgewebview2.exe	96
PID 4440 wrote to memory of 4276	4440	msedgewebview2.exe	97
PID 4440 wrote to memory of 1708	4440	msedgewebview2.exe	98
PID 4440 wrote to memory of 1708	4440	msedgewebview2.exe	98
PID 4440 wrote to memory of 1708	4440	msedgewebview2.exe	98
PID 4440 wrote to memory of 4660	4440	msedgewebview2.exe	99
PID 4440 wrote to memory of 4660	4440	msedgewebview2.exe	99
PID 4440 wrote to memory of 4660	4440	msedgewebview2.exe	99
PID 4440 wrote to memory of 4660	4440	msedgewebview2.exe	99
PID 4440 wrote to memory of 4660	4440	msedgewebview2.exe	99
PID 4440 wrote to memory of 6008	4440	msedgewebview2.exe	102
PID 4440 wrote to memory of 6008	4440	msedgewebview2.exe	102
PID 4440 wrote to memory of 6008	4440	msedgewebview2.exe	102
PID 4440 wrote to memory of 4780	4440	msedgewebview2.exe	103
PID 4440 wrote to memory of 4780	4440	msedgewebview2.exe	103
PID 4440 wrote to memory of 4780	4440	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\CrucibleSetup.exe
"C:\Users\Admin\AppData\Local\Temp\CrucibleSetup.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-FileHash -Algorithm SHA256 -LiteralPath \"C:\Users\Admin\AppData\Local\Programs\Crucible\Crucible.exe\").Hash"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Users\Admin\AppData\Local\Programs\Crucible\Crucible.exe
  "C:\Users\Admin\AppData\Local\Programs\Crucible\Crucible.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3844.4428.5575493957829038643 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView /prefetch:4 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffb48855fd8,0x7ffb48855fe4,0x7ffb48855ff0
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2468 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView" --webview-exe-name=Crucible.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1804,i,7099466957284307067,201011488266362220,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:84ce5f2f47addfb5c146ff5f1b487c8af92668a8
      4⤵
      PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 ebdf1905f222270bada8e2315e7eeb2841aad4c5bc2a2e37363bccd152f67b66
MD5 ab12e7dc1995e320e7aa6c85004480cf
SHA1 648cadf59112fac2db0665661bc704d27313de62
SHA512 538979fddb128d1d910b836e455060fa0ea31c3116972c3257e5394877b966bfa5bb390678c3369acdf2faabe614878f230c2938f747c97e1c0c141d8f563ac5
TLSH
T165C09B1473654726F14D613D7DD556141BB54115F5C6C3044F74113585197400871D05
MD5 SHA1 SHA512 TLSH

Submit Download

Crucible.exe

Path C:\Users\Admin\AppData\Local\Programs\Crucible\Crucible.exe
Size 6.0MB
SHA256 9a6660edfbb01f75726eb9bbe3668bad2e6fae93e2747e82cd0c104e0bdb1cf4
MD5 909de7256b28af598e7d83dd0cb820e4
SHA1 39933a34166886d987a23651a8eb24fb3453d936
SHA512 aa600a669ba7e64c55c141113bbbb64e474a8a77ebefbcf25f1252ba12c23117f2328b82d2aaa1ad745ebc5ae9f6195233e9d366a094a8874be62f6c3ed7b5a3
SSDEEP 98304:q9McHm5rWqqgBfD3zZrC47ewc3cCG/HVMSU2JVbBe9Yi6PKMJWPqRb:+89zq3G/HFBEmi6PKMJhd
TLSH
T19A569E03F6A191F8C05EC1B8D31AA633E7327889093476AF67E81B252F6AF506F1D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-log.txt

Path C:\Users\Admin\AppData\Local\Programs\Crucible\logs\launcher-log.txt
Size 248B
SHA256 5c9d1cdd8a98f1537f52ba3698db3fda62c28781cb243d8f3abd0564f157e51e
MD5 fcf09bee2a6c34614cad8c615cb62bdc
SHA1 19ffa84b0d004f4e3f7b82c0624e6112fc345947
SHA512 0410b57018c3d65012ca231265704422ce2cb64c4982e0ad5e9b78f65a538f81ade7e8fed20e0db92a396abe014c0f2efaf107df02090b2873c37a86b1cc7ec3
TLSH
T1A9D052C240B011BB0AF200048409D526E0E3B2445AEE34D4B269A21496AA66F8BEBED3
MD5 SHA1 SHA512 TLSH

Submit Download

launcher-log.txt

Path C:\Users\Admin\AppData\Local\Programs\Crucible\logs\launcher-log.txt
Size 423B
SHA256 344c2797662e1461073823ffe7f15c0bd70bb48aa041586aa9ef76ed0d68cda5
MD5 60e71f39f2d3b2015025ba097ab73ec8
SHA1 3a949ce0fef2fe111ac6ef125edde62229e14e1e
SHA512 e75c20fbd1cd1d0a1ff00a1b0b339dc668f0b3df5c1b69781340643e920617d35cef17b1edced8f509bdb7f1af821aa84c4b47fbe57549f0b88973caf5c57dc1
TLSH
T165E06DC140B081F74BF50408C909981FD0D7B3446AEE74E5B36DA20553BB65F8AEBB9B
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso191D.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nso191D.tmp\inetc.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso191D.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso191D.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nso191D.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2eb6699dfdf936de4481d0bc1a8a8c39880197247e54d5052a2b177772ce0dfb
MD5 ed54ba54914a2af4a8eaf1f7ffa97548
SHA1 18488604175bbc8a3bba9f1ee7b04d4c4d60a9a7
SHA512 3ecaf745a1c934fe6044417f8a572262112263b26e1a95c17f608d94ee0ef66ba7fea49930ed5e43cf488234aff1961aa508641659fe1afb47e2245b4103bf7b
TLSH
T169D01212B3020978C4252133014261090840D21FC00680149828D55D1E44054290AC93
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2e1db7947621f0234449ace63cb3edc2511f6ce8c7ad9059f3f25c9d9a618a6f
MD5 100505be984a34fc2f7ef6114c66fec2
SHA1 1c764f0cf882ab358cf088f31153b398c228fed2
SHA512 b7545a12e793048344fc8afab688648017457d08919cbab31157f3005a5d6a87667135dd2cfe7e19a7b654bc31f9279f80142cd6ccd6988cc66a4d95ae21f8a4
TLSH
T18BD00450D3051C44C55F11314150411105505514D0035134441050440CC0004700DD53
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5acecb.TMP

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\Network\Network Persistent State~RFe5acecb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d61bd6e0-dba5-442b-91e8-fc88b9d3eac8.tmp

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Default\d61bd6e0-dba5-442b-91e8-fc88b9d3eac8.tmp
Size 6KB
SHA256 06a4eb16e76276e9a0a8d59cd6fa8f271754a92938d887575af054014bad4d0f
MD5 e2da9d1c193ca52a69f435e2d49b446c
SHA1 74b468adbf0d57c325af4a3ab6375cf09e593153
SHA512 3b6940ff38c8b8f9b5e2f110a84015f5b72d590da8cc97a9bbdf5e9270dc16c5e3bab5044ee3baf72615152a001564661e38488b01a1ad57f0cb4be8a56fa3d2
SSDEEP 96:stH/dXibtb91kro5h16ZRVs7/x+6Mhmuecuf71ejerK+gAg28XM1C7K:stf1GGo+VsV+F6f7Qjp3G6K
TLSH
T1ABD1B6065E28697B4CC6E509BAB9BA13E2F9547261D51E98E7FC462C08DB6CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Local State
Size 3KB
SHA256 a004d75b55f7d6d8cf594854df4871dc30b594bf3d311682e50c4f20771aef1e
MD5 d3208474534cf151253b8b0859b66325
SHA1 d189676b80e9673bdbbd2c55feec8495cba0948b
SHA512 6f2373b65c71ab5066f896ec4629b4ccd4d91b73a55bdb249a8370d63616ba5ef5f006f29bc54032058e17e12373d47ad625e0b23cf9c0a6504349929569914d
TLSH
T1FD81943B98A4A97B4DF3954579863F27A7A1807BD9916FE5D6EC0B0C02C72881393C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Local State
Size 15KB
SHA256 af016b21f47b911de0d956435c84c8b38c4fb899c025956e700f3305b1b07b17
MD5 2ea3c9f03f18ff10d3c2dea5634547ec
SHA1 a70acdf0b23c7f676256a81a292da4e81656d378
SHA512 df318198afb5acec7aa5ebaa81ef4b8f3f476e58b43c5268ec9f695e2a1a3cd855f55c3c09b16fe298f8f37042c60da882b69f34dd385ee28240416c357eca23
SSDEEP 192:FsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vBNBS+heoDUhrGB:Fsrv+89zHqlDNP9oidENBSGIwR/I6jN7
TLSH
T17772AE33E43CA6379DF39845B4867F173BB8609B96C24EA4D8D90B8D428B0D92347D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Local State
Size 2KB
SHA256 096a3d6a75c4139732c0019bbf985e5e9bf33758d24b9d90d9f84fb584fbe412
MD5 33be1387561651b60040f26e2155010f
SHA1 03fb64ed0d5e19d2377c7b3df066a8c26b98ba0a
SHA512 54e4c776c25d99c28f162fce63f205860d6767410190574d7c61fe6d511c3c566d1505779e31de784ec3be11f6ad4cec9f2ad99484f6cdfc1d712ec281c95dbb
TLSH
T19C51A533A8549A7789F3568579863F739A7190BAEB521FA0E6DC070C02C755C2757C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Local State
Size 3KB
SHA256 c63b9986716792a1f31f61631770c0a02a0707f959cc219a861826052f23ec8e
MD5 346f7819de29fd9aeb8bc96bd2dd52de
SHA1 7b41d0775f865391f74c55691dff5b203bc67bfd
SHA512 fc4fc4d6e170956be1070fee6c47e27ce5cdb21de71c4f2f703e9e2162eab23e1435dbae8b12ff3dfbb98e4e8b48f90ced5d6766d9c52f150eb7631a0525cc9c
TLSH
T1FB71A57B98A4997B4DF3994579C63F26A7A18037E9916FA4D5EC0F0C02C72881353C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59a3d7.TMP

Path C:\Users\Admin\AppData\Local\com.drizzza.crucible\EBWebView\Local State~RFe59a3d7.TMP
Size 1KB
SHA256 3a84d2cd829e1509100ecb394d8a9b7c7c2f4f909941263d73b2975f149b2614
MD5 ca9242af6ef029986e1396174041fa8e
SHA1 cab6125dd9b1eab4e8dec59815be976958782948
SHA512 e26d4059a9f96af6028204c502cbe0fbf78aee87a6759fbfa4f7d94eb32b0531314a021bb8752e524ceea2567d0aa7ce3eddda5113bdde1957e1df30e0cf82c8
TLSH
T1223172B798D44AB3ACD2218632827FB75E7040BAD6508F80A1DD470D02C748D9BBFC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-42-0x0000000005E00000-0x000000000615B000-memory.dmp

Download

memory/2324-38-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/2324-48-0x0000000007530000-0x0000000007552000-memory.dmp

Download

memory/2324-32-0x0000000072E22000-0x0000000072E23000-memory.dmp

Download

memory/2324-47-0x00000000075A0000-0x0000000007636000-memory.dmp

Download

memory/2324-46-0x0000000006840000-0x000000000685A000-memory.dmp

Download

memory/2324-45-0x0000000007B30000-0x00000000081AC000-memory.dmp

Download

memory/2324-44-0x0000000006330000-0x000000000637C000-memory.dmp

Download

memory/2324-33-0x0000000002E00000-0x0000000002E36000-memory.dmp

Download

memory/2324-43-0x00000000062F0000-0x000000000630E000-memory.dmp

Download

memory/2324-49-0x0000000008770000-0x0000000008D2A000-memory.dmp

Download

memory/2324-39-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/2324-52-0x0000000072E10000-0x00000000735CC000-memory.dmp

Download

memory/2324-37-0x0000000005510000-0x0000000005532000-memory.dmp

Download

memory/2324-36-0x0000000072E10000-0x00000000735CC000-memory.dmp

Download

memory/2324-35-0x00000000055E0000-0x0000000005C2A000-memory.dmp

Download

memory/2324-34-0x0000000072E10000-0x00000000735CC000-memory.dmp

Download

memory/3872-103-0x00007FFB6A680000-0x00007FFB6A681000-memory.dmp

Download

memory/4660-179-0x00007FFB6A680000-0x00007FFB6A681000-memory.dmp

Download

memory/6008-291-0x00007FFB69210000-0x00007FFB69211000-memory.dmp

Download

memory/6008-292-0x00007FFB6B090000-0x00007FFB6B091000-memory.dmp

Download