hxxps://www[.]mediafire[.]com/file/n83x6cst43hveyl/Lycron_Crypter_2026_Cracked[.]zip/file

Analysis

user interaction
yes
max time kernel
150s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/n83x6cst43hveyl/Lycron_Crypter_2026_Cracked.zip/file
Sample260807-e3sdsaxdpf

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation pyarmor pyinstaller

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 17 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updates_notes.txt	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updates_notes.txt	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe

Executes dropped EXE 9 IoCs

pid	Process
4032	Lycron Crypter Cracked.exe
1052	Lycron Crypter Cracked.exe
3020	crack.exe
1784	svchost.exe
4636	svchost.exe
3448	clppth.exe
5528	clppth.exe
5960	crack.exe
5712	Lycron Cracked.exe

Loads dropped DLL 37 IoCs

pid	Process
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
4636	svchost.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5528	clppth.exe
5712	Lycron Cracked.exe
5712	Lycron Cracked.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\CLPPTH = "C:\\Users\\Admin\\AppData\\Roaming\\CLPPTH\\clppth.exe"	svchost.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
190	api.ipify.org
266	api.ipify.org
140	api.ipify.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1136103294\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_979243013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_979243013\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Detects Pyarmor 1 IoCs

pyarmor

resource	yara_rule
behavioral1/files/0x000800000002a277-366.dat	pyarmor

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000800000002a277-366.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lycron Crypter Cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lycron Crypter Cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lycron Cracked.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe
3752	msedge.exe
5248	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1036	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305505141598555"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Lycron Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Lycron Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "6"	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{16C0712E-1249-4CD2-ADB3-67C97B1F261D}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Lycron Cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "4"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Lycron Cracked.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 8000310000000000075da42310004c5943524f4e7e310000680009000400efbe075d9a23075da4232e00000050b3020000001e00000000000000000000000000000033c60d014c007900630072006f006e002000430072007900700074006500720020003200300032003600200043007200610063006b0065006400000018000000	Lycron Cracked.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Lycron Cracked.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Lycron Cracked.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{4FC238A1-2531-48A4-BFCB-8AED05401E53}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Lycron_Crypter_2026_Cracked.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2656	7zFM.exe
5712	Lycron Cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2656	7zFM.exe
Token: 35	2656	7zFM.exe
Token: SeSecurityPrivilege	2656	7zFM.exe
Token: SeDebugPrivilege	5712	Lycron Cracked.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
2656	7zFM.exe
2656	7zFM.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5712	Lycron Cracked.exe
5712	Lycron Cracked.exe
5712	Lycron Cracked.exe
5712	Lycron Cracked.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4524	1676	msedge.exe	81
PID 1676 wrote to memory of 4392	1676	msedge.exe	82
PID 1676 wrote to memory of 796	1676	msedge.exe	83
PID 1676 wrote to memory of 796	1676	msedge.exe	83
PID 1676 wrote to memory of 796	1676	msedge.exe	83
PID 1676 wrote to memory of 8	1676	msedge.exe	84
PID 1676 wrote to memory of 8	1676	msedge.exe	84
PID 1676 wrote to memory of 3436	1676	msedge.exe	85
PID 1676 wrote to memory of 3436	1676	msedge.exe	85
PID 1676 wrote to memory of 3436	1676	msedge.exe	85
PID 1676 wrote to memory of 4300	1676	msedge.exe	86
PID 1676 wrote to memory of 4300	1676	msedge.exe	86
PID 1676 wrote to memory of 4300	1676	msedge.exe	86
PID 1676 wrote to memory of 2316	1676	msedge.exe	89
PID 1676 wrote to memory of 1720	1676	msedge.exe	90
PID 1676 wrote to memory of 4688	1676	msedge.exe	91
PID 1676 wrote to memory of 2316	1676	msedge.exe	89
PID 1676 wrote to memory of 2316	1676	msedge.exe	89
PID 1676 wrote to memory of 2156	1676	msedge.exe	92
PID 1676 wrote to memory of 1720	1676	msedge.exe	90
PID 1676 wrote to memory of 1720	1676	msedge.exe	90
PID 1676 wrote to memory of 4688	1676	msedge.exe	91
PID 1676 wrote to memory of 4688	1676	msedge.exe	91
PID 1676 wrote to memory of 2156	1676	msedge.exe	92
PID 1676 wrote to memory of 2156	1676	msedge.exe	92
PID 1676 wrote to memory of 3732	1676	msedge.exe	95
PID 1676 wrote to memory of 2872	1676	msedge.exe	94
PID 1676 wrote to memory of 3732	1676	msedge.exe	95
PID 1676 wrote to memory of 2872	1676	msedge.exe	94
PID 1676 wrote to memory of 4408	1676	msedge.exe	96
PID 1676 wrote to memory of 3356	1676	msedge.exe	98
PID 4408 wrote to memory of 900	4408	msedge.exe	99
PID 1676 wrote to memory of 4112	1676	msedge.exe	100
PID 1676 wrote to memory of 4112	1676	msedge.exe	100
PID 1676 wrote to memory of 4112	1676	msedge.exe	100
PID 1676 wrote to memory of 236	1676	msedge.exe	101
PID 1676 wrote to memory of 5016	1676	msedge.exe	102
PID 1676 wrote to memory of 236	1676	msedge.exe	101
PID 1676 wrote to memory of 5016	1676	msedge.exe	102
PID 1676 wrote to memory of 5016	1676	msedge.exe	102
PID 1676 wrote to memory of 5040	1676	msedge.exe	103
PID 4976 wrote to memory of 1052	4976	cmd.exe	113
PID 4976 wrote to memory of 1036	4976	cmd.exe	114
PID 1052 wrote to memory of 3020	1052	Lycron Crypter Cracked.exe	115
PID 1052 wrote to memory of 1784	1052	Lycron Crypter Cracked.exe	116
PID 1052 wrote to memory of 1936	1052	Lycron Crypter Cracked.exe	118
PID 1052 wrote to memory of 2240	1052	Lycron Crypter Cracked.exe	120
PID 1936 wrote to memory of 4364	1936	msedge.exe	119
PID 1052 wrote to memory of 4936	1052	Lycron Crypter Cracked.exe	121
PID 1936 wrote to memory of 3752	1936	msedge.exe	122
PID 1936 wrote to memory of 2912	1936	msedge.exe	124
PID 1936 wrote to memory of 2912	1936	msedge.exe	124
PID 1936 wrote to memory of 3216	1936	msedge.exe	123
PID 1936 wrote to memory of 3216	1936	msedge.exe	123
PID 1936 wrote to memory of 3216	1936	msedge.exe	123
PID 1052 wrote to memory of 1680	1052	Lycron Crypter Cracked.exe	125
PID 1936 wrote to memory of 4560	1936	msedge.exe	128
PID 1936 wrote to memory of 4560	1936	msedge.exe	128
PID 1936 wrote to memory of 4560	1936	msedge.exe	128
PID 1936 wrote to memory of 324	1936	msedge.exe	127
PID 1936 wrote to memory of 324	1936	msedge.exe	127
PID 1936 wrote to memory of 324	1936	msedge.exe	127
PID 1936 wrote to memory of 2024	1936	msedge.exe	129
PID 1936 wrote to memory of 2024	1936	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/n83x6cst43hveyl/Lycron_Crypter_2026_Cracked.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb6c50c188,0x7ffb6c50c194,0x7ffb6c50c1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7065195473307097121,6502454177610192274,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,11705783648414777118,13763733193935294684,262144 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,17057233028907638877,10823338901975910980,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,15446495576753414902,2316292635308231790,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13753666509704546877,5135781321112835363,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,2222032086190494541,10925058306482167730,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,3174022261762119673,18113548625283008705,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,18005154655679181161,2028761704566977714,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4272,i,17644300983557964382,5355461722305956479,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3331284568323023082,8449749450024177083,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,6805849036072960353,1338368161315941664,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,13471532731235522842,13637180358509006815,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1148
    3⤵
    PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,13018192054321090590,3059639472403285671,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,13018192054321090590,3059639472403285671,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6248,i,12014357102981653214,13125119513678543177,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,5567325236592783888,11147746467119008567,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6844,i,10302408542204556345,9679119147047917721,2097152 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,8518451550665079062,1294882806559479346,524288 --field-trial-handle=2692,i,9627512595643849764,761426828391807631,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1036

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Lycron_Crypter_2026_Cracked.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2656

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4896

C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Crypter Cracked.exe
"C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Crypter Cracked.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\search on google.txt
1⤵
PID:1484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\setup.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Crypter Cracked.exe
  "Lycron Crypter Cracked.exe" -padrikadi -y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\crack.exe
    "C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\crack.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3020
- - C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\svchost.exe
    "C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\svchost.exe"
    3⤵
    - Executes dropped EXE
    PID:1784
  - - C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\svchost.exe
      "C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackhatrussia.com/xworm-v7-4-cracked/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb6c50c188,0x7ffb6c50c194,0x7ffb6c50c1a0
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1608,i,15706183940571236766,6697646724413991451,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,8234682873629855323,9196917278222434900,262144 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,6811752729042193672,7374782569361486137,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,15706520793536631747,18442468131062282134,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,4550781950898315422,13957228696141354892,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1604960183492208849,522419748393926214,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5948049749996461453,4194100739896975426,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4584,i,15921440271397162406,16668736510172278816,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,17526965397028710709,10247936061761454662,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5468,i,10110178929918170599,16488153270846222384,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5692,i,12389627016383173328,13087953166919011736,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,11342475965684348900,5016004444045007276,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6064,i,8679254474553466912,16533241161586487782,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4628,i,5023753536439612544,18054446779073019898,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6280,i,1785935134092653530,411072005506008466,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6532,i,15981856389123228993,13638138371051465274,2097152 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15765482336822879873,6359920158972939412,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2200968348074573071,8473144411457059672,524288 --field-trial-handle=2344,i,307059314015958751,8391893740363681229,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://thehackingtools.com/vip-rat-v-2026/
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.thehackingtools.net/wirefire-wps-2026/
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackhatrussia.net/cracked-software/
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blankhack.com/total-email-phone-extractor-pro-2025/
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shanghaiblackgoons.com/letsextract-email-studio-business-2025/
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackhatusa.com/sendblaster-pro-version-4-1-13-activated/
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blackhatrussia.org/arctic-miner-2025-cracked/
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://psddl.com/visa-card-psd-template/
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cryptersrc.com/cryptex-advanced-2025/
    3⤵
    PID:1836
- C:\Windows\system32\timeout.exe
  timeout /t 8
  2⤵
  - Delays execution with timeout.exe
  PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:676

C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
1⤵
- Executes dropped EXE
PID:3448
- C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
  C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x2ac,0x7ffb6c50c188,0x7ffb6c50c194,0x7ffb6c50c1a0
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,7351535651066705613,17864470719153482553,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,14154957251571536411,2650211457446945004,262144 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,16508998267044702086,10807047230989675942,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4753647068103012037,1254020381474244438,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,4753647068103012037,1254020381474244438,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,4665860740201812155,15122178297946064994,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,17841272329274167761,13436877807477639010,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,2389096379748836930,7842004708114335488,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,2741254303199945009,8035636298876171152,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,1614753895374185768,13736274507792647251,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4720193854845988626,16788455351496762963,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,17896026839563188878,9317993893369339611,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,3703884636516018083,3327488958806131822,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,16901797349287606123,70244893783886997,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,11426166711583733437,3742527934743212349,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,4896333529903797354,6393774450733478395,524288 --field-trial-handle=2108,i,17188823655969999992,4843531080500887217,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:14
  2⤵
  PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1332

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Licence Key.txt
1⤵
PID:1840

C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\crack.exe
"C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\crack.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5960

C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Cracked.exe
"C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Cracked.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\flsip0bp\flsip0bp.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hq2tkbx0\hq2tkbx0.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qjwzvyb1\qjwzvyb1.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7541.tmp" "c:\Users\Admin\AppData\Roaming\CSC2F71E93BAF244C27A4F49F75441722F.TMP"
    3⤵
    PID:4572

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\VAuulCpTxqclHzoGkbwbHOaNy.js"
1⤵
PID:3964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\VAuulCpTxqclHzoGkbwbHOaNy.js"
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 42c6ce10e09f718d28bf57ca7e11cffd25b1b14421151c2814286318626f79df
MD5 70da9719e5501344da2e5e5e12e27a3d
SHA1 8364251de1afb09408b7e26ed5d9d8e170221fcf
SHA512 0ba3927baba69726bc25eb22a59015ce1e65d90f4852da6d4a53fb8ecf39122dd116415de787c760079ba9da28f949ee461c384b270161a26757ad243cb0d394
TLSH
T14ED0A7F0BA45D210C51A1075ED1176517266827434ABAA73D4E4544D5894C4892DF4A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c08bb072a9bffad29d0e3db1ec4f906a346c450e032302ab1b08462b0dacbc9c
MD5 0c8b1bb54d49495f362a901d6e5f7def
SHA1 366226a4b773c38ee8c3969874b3d9199d59e5a2
SHA512 7b50f97ae7f1d291f4420a3f9b8ae9c755acc573a737f5d923e64617aa6bfad5a60c4b6512cdba607ef0548beb039ff7c939b409914a44b082aa59818327a840
TLSH
T1E9D023F07C1AF190C22E00B4D91026001119833235977373D4D4480CBEB0C8042DFCF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f56e0223b8446d77c6bf2c2d3592a3bb1c430e2ccef8b83fa2cd4636053dc7e5
MD5 98cf5988a36ca614aa685be981530acf
SHA1 27e0943471d052678e5e9537f3ebc0015cf8865d
SHA512 5097aa304a27e06727ef5d83f19acf7a3b4c9205e23757b70d4dc77de69914c1bd82b12802db89913035b31feef25e921b8488d3f9afbf20201afd9122765581
TLSH
T105D09BA07D4DF011C15710F1ED0167515119C6652457A637D9A0454D6D55C58539B057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4acedc68bd4d6f73c5ca4b3e6fdef2f0513a35dc7ca792e8ee91b543ee7a789c
MD5 77354feb72b73609fe7be96685155c27
SHA1 e8d7f440d0772856eb85f9957edd0b85097a0e75
SHA512 b9bb310979bdc07575fd3c0d61abb0578901da13b4527c0c0c7317bb6a8ec7de305ed0436726298b078fd7dd92994749e78705c349178cbf8926aff4bd8ffdc7
TLSH
T1B1D09BA03D8DF011C55710F1ED0167515119C6652457E737D9A0454D5D56C98539B057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eceee9b090bf0da5624d71b67a274062004d5b964222f86aa73839abf9ad2ddd
MD5 fc05b9a29d2ea5f519678059a8b43daf
SHA1 08332e7cc6b3bb4b8ac4495e1e4cecb3072c72a5
SHA512 00b97e68ce525fcdc84ae8efb3e1e766bf65b782decf6bdd8fc3c77972c9411f0b4f4af511d57309c692b35f14c38ec94c1c4de511a41c091b79f38e3f31742f
TLSH
T1FCD0A7F0BA45D210C51A1075AD1176516266823434ABAA73D4E4544D6894C4892DF4A6
MD5 SHA1 SHA512 TLSH

Submit Download

33e9ca36-b9b2-4633-8a8e-e0d03bdc4390.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33e9ca36-b9b2-4633-8a8e-e0d03bdc4390.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5ce1df82-78ff-469d-819c-1a742afe0d93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5ce1df82-78ff-469d-819c-1a742afe0d93.tmp
Size 414B
SHA256 bf936e1a18ce22905922efd5aa34f21a1a63b85ac75b6e649680ec6a944b8cff
MD5 abf41653a7c1f3174e2d54c526a544c1
SHA1 f8b94b5a26ca0d82d3d8e2aacffbd59d11e638f1
SHA512 71384847f4f9d21f68c668916583e74af8d1fb0f116c8d2d2a6218ae1861868fd70d2f9b66cf05d49ae1885d3f47fa2faf9d1c8f99fef0f07e2bacb4790d7e0a
TLSH
T18BE022EAD825AC374CFD1758A0900A86E78413172A50854B3A3CD208CFB063F0A87D2C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f520ad5b04cc882a50e300054115a50e5297269878d924e3d33233ad98fe484c
MD5 9b04e25763018f853ea255b4d5e3d8ff
SHA1 3398bd329d849e2c941212aa3ef66d7f99ddf2d7
SHA512 772cf1d0a346ceaa881746f324ee062ce80fc69fe49509f43beac1fbd9b3f6859e9270d79751bb1b898bb3c818fe03dca6b5ec0d53c282c3c35a75b9adc62d7f
SSDEEP 768:ZoHLebpMdO9A+qI+pvuLG9A1lRw715qS:ZoHLQpgO98IGj
TLSH
T10213933E32545D81FAD2823C548F1AB0637DC620E8DA5F437BF57257536A33A292E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 97a4cfaaff4b5500ad198ddcccc0010b2626159d2809f2740f9d2b53be903772
MD5 ac26314c11b9d98b00bd721d2f68d6fb
SHA1 d9edd9e318277ca6a672c02b0ca72a2fa2750482
SHA512 dd0722892a8d69535a4a2f7cbf7bad3d036d3f5300777f4d9e73413fe06d9c15e8085946c1362e853ded9832a6b87f4c0c11f6b0827f5ed1c19fb9831e57648d
SSDEEP 1536:Bwk7hxU+uTL/JdL/l8/oD3ZQ7snju5ukuiPOE7VL/rPL/oWcfTxbfNTB8ABbP6:By+2L/HL/BQZIEL/rPL/Tcrx
TLSH
T196442CF74981A01BDBA842F5E2133A3DD177051D3CD1EDE9E5784C922826B32B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 2933a8529f505ca15d27dc6bc0be1b1c77598078eca916f4580b99a91e897dbc
MD5 16424c94cc045c7c2e1a0d5ea1e3b0e7
SHA1 c7e48a1d8524c41f2cec953dd4e5db7045d16bb4
SHA512 7e1a4447050f5ea30497d33c5a7ff0aa12c3e46143d924441e7a3310d66c99f90849da7ee7d1a7efd53bf0c3bdc77eb18fb1c168d326627249b33e69fe784ed9
SSDEEP 3072:RXLd5mXuVa1+HzOKFD+UFIpNncTyJ8MSSNkePp/nEhj:R7d5NVQEOUFInc9K
TLSH
T1312529EECB682C82CE6B8770B0E0D9077E712183B68DD0D39944C5D997D6B8175E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 25KB
SHA256 20d2e79486f9f42b4a3d02c2993d201658c52ee2ee7da5dcad12eb436181cd2e
MD5 d7249f7268ccfa43e5d52aca8da318d1
SHA1 ad6712fd417ee8cee8f8bc111eaf70ba71158d1b
SHA512 8149af1044f4f33f4afc660f0463dc72966432d9097b3bbde88f3632596dda60ea4a607884967b90bd65b27314e0c9fa3e860a66292702b2e03f41f949bb6561
SSDEEP 384:Pg0jVOp/DULsJg9xQAQUp8/aSJjSoOf6HmIvXbzD4pqWAUQIvro9diTy+CaB:4067JAQ4kjpCwbAqyvrucT7C
TLSH
T10AC2D0E9C5648C78FE7E89E42C7ACEB92B30C1064F69171C3F029B5E5B56D9AAC85402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b4bf9880bed45d6fcc3ba5a2ef4d038b8f69a0c55b66d6053dc24f3ca398fa9f
MD5 3ed08d8e879b81b54691a6008c5b9074
SHA1 b6629a853ebac621b0b4681fe7ad35f7d9775dc0
SHA512 643b4d51f202bb2999af7c84ef2bc597ec21709cd22ce676fbdf8c3f9a72dd64c99a88a0111910efe0ada12b5b634650484a6dc5700dd3523cead68740eb68da
SSDEEP 48:DbIIH2LOgwm0xCvZYmxtUXrRyMtgqdW1PhY/NJs6N2Yzf6QbvuTpe0sgTMMWrQxX:vhH2LO5QvZDD12/NtNFzf6Qbmf9um5
TLSH
T1E4A14DAA09912CD1FF558A33B0DD3E6AB4B343662B930E7729E449F2150F391F17A709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2004604bedaae37b9e3aa2585d43bf14a4ba0382e47ffa9163795f3921372fa0
MD5 fca4d66399e1c9d9bd7f433ceae3125e
SHA1 1132a26efb7fbf0d363a7c2c032af0c42bfe9442
SHA512 6bad29ff0587e1e5777df00bdb0501ec20979c1128d46626a6ae646aa5c09588e9bb9b071511b4ab9388ff4ad8a2f7fc5eee92c0ca641ce40edb52480d891258
TLSH
T1AB811A660D466CA1FF594A33F0ED7A02B87383A86B924E336DF458F6510B362F076708
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589749.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589749.TMP
Size 3KB
SHA256 5e39b4378debce8a17fb19f5a74ceb56e7700c9d44882bcd67e6b13265d58739
MD5 3de5a4498fbda4ae57b293b80e5ade4f
SHA1 558f5805ce1a232bdde7e7558907aee65f579cbe
SHA512 5f2d3e43d5cf8c164b10055ab177edd60e44ecae905536a66bbae5808c45cf9076fa3c74dd9799d7764b0bde9de100021514249ccb9eff262867515c5e1b517d
TLSH
T177714D660D456C91FF550A33F0ED3A02B47383A86B524E732DF458F6520B712F17A708
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5988_1917176999\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir5988_1917176999\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 054161550044815cc7d586798d1fa7c48a8177ddb979fa3f05e698ef107694b9
MD5 f2c4b09e516d91879e836507f0dd75a9
SHA1 7b98b8a44e427f4d4c9b67e72f78e2ac2b25c644
SHA512 019e05d5f3e2e675e220054f81765923f6965331c3e777f76a27ff3a769355c70a51581e1fac4a404046028b4f040164dce96ec160bbb46a0ebd875291c8bb7f
SSDEEP 48:uzBmw6QU1PzOjVHMPkvi6xVqKRmYh74VTz7na4:6BCxOjdMcKkVqKmA74hzn
TLSH
T1F392B5836EB47003DB660D76223B147CD93BE16C5FB6DDD5383494214DF9802A0BA9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 7d507a0ded59e301fb764fb4e8ee8e07c5738082449345b95831e94d1ad2a43e
MD5 7ef224ff0750c0d1e4eeda019cef35fd
SHA1 36357a57c6a62650937c04c93d5e8c452e78961a
SHA512 418794ff87558642b20530bf6a5e776e18d0f58ead6641adfaa1762c12a6b71371c42dc0c9f0ae6bf9c470543070a3b32a907475bf352742d878a8317512988d
SSDEEP 192:xofHawL0+G83uxXBBK31GkSJu8sEJH7DNspUU:xYHla83uFBBQ1GkSQS7DNspUU
TLSH
T1FD14884F5F703312CE7D403669E784A75DBDF43F8B52668A78601461CDE3652A05C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1021B
SHA256 234c9557a5e86cf4b6f18c2e5fa4a7854c7593c30f39f4c4028d8fa5c5f1f864
MD5 821664bda1cd4cde92857e508b80fd37
SHA1 2dc4d229f95dc1ea3b1765dfa7b0429500173179
SHA512 ecd1abdfcf24d8b790a98c480cc80b7cf45a820b89594bd1e39e7e92bff151766ce6688d51beddba7d050453826bc3b9d28bbdb56e76fa6193c5e9ca67dd47e0
TLSH
T17A11E163D99188F667FA4E41A075719BC65D43B79DD2E9C5F5607B4009980A812B0D82
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6a23f6430d29ce4c90d243e61414a4b2fca8188473a61b913b2e708450782497
MD5 bd0e8a46906b915f6ceee873527284f0
SHA1 0b82f0ff007a9385de28f8e3890cbf15fc919fe0
SHA512 64db6ff0a96e5c381fcc8be84e6a031578b3c2a81b6964902d4eed91d94380e709f2798734dd12b591371dae44e3764e4b0d3c65725b2863b9768e023dad5497
TLSH
T1F5E0D8604ACED52D6544204B532CE70CD3F13506EB887AC15F0CD848B445424EBD2DD2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 62254b9e338c34ce26db99d01092cc311fb26fc8496377cfd04537359ce97ebf
MD5 ca5f2e88b0323a1f858e552899d57de2
SHA1 347b727a43d173b2fd5c1e38a6c41a1a7960a88f
SHA512 c8a513440acc1b2c3139b3e716598cd9db1f54fdd78b7ebbf57e5d10e7ea096acfb3fdcf3d10b34e1f9a7d6fba79c1ec7331c81d838913709f90730d957ae6ed
SSDEEP 96:DOhOKd1y3CJPh+O1zbn75n4IWVYSVsvk/WEoxw6y0r0SCK41o87fxK:DRKzwCJPgSHn75n4IWVYSVsvk/WEibyG
TLSH
T194C15AF3C2D5D52EC8011BF45624AE2BCF1D0A1983293C2589D5EE8BE3E3072D26965F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 49d801c52be9a622735b4a0eb786e00e6f3cfaebfbfb7d27735544a3d3367b25
MD5 a71199ae03009fd232e85c5d987c883f
SHA1 828d2965e14f80ad1f0d58c475add396a8a25e8b
SHA512 199c784d621f2f4c1797dcf9ff68094b68b2a441745d6b8816bbe40afd64bfcec7aad04f4f00b3ec0ad3af0da07e63ddc8cf47cd3eef96aede46dbc9e2abfd1a
SSDEEP 384:DRKzwCJPgCy4JcOCV2a6EkHwHn75n4IWVYSVsvk/WEW0r0SCK4qqfxgL0wTaUyol:Otmv7KBFrT
TLSH
T13A829AF7C2E4C62EC90156F5A614BE2ACE1D0A1483293C1AC9D5EE8BE3E3472D25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 ebcf0995fa0c662579c24b389c7e37e47ae3e322d435407eb1fa14df043e5de3
MD5 e3e843bce9a595849d4f5883c4b1b742
SHA1 25f0909a1b70714629323e8ee0e869926668641b
SHA512 f1fa491a8302a00c85bd4dbd751a941ae3e9a1aa93f912da7bf11415eca262492a93b989f58a3d161ac067fcf083bf44090bbde858e56474af9f8df1db936788
SSDEEP 384:Dg/u5VAWrFhloHNCetxt7bKREmHn75n4IWVYSVsvk/WEW0r0SCK4qqfxi0wIUyoK:YPmv7EBFrk
TLSH
T12582ABF7C2E4C62ECD0156F0A614BE2ACE1D0A1483293C5AC9D5EE8BE3E3472D25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 f25ed0bca2a916866444e4f00599a45dee98785826af6142d0d4369d9103c770
MD5 308d46e8fde977fca919c6489a58ca29
SHA1 8894f21d05d05e533e4302c1b8315432bccb4da4
SHA512 3f8f9374835c31c65883d7725684ada89540e688f675e9cfe79a122e71a1669cf90ab15399331e0fb7b6bd622e4ff237e7675a17766a6f4fb3881320e94303c4
TLSH
T12C014793D0BEB47B102D4ABF0994FC0217BEA831028158E8EB6DC46CB1C44F35B26029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 2fb3d84849e744be071ead08d59aeafbaa90af765bcfd550d0491a21e62deba9
MD5 df1cfd9302469a554021358c5be978c1
SHA1 79fdb19b2899739c819cf7e764630f2db0d7f4b9
SHA512 44a74823a4a198323e0818ce5f6389300241fb2ca8a2c41468813a1a331d0386edb790a890d0c6fdd5647aace27020d35bb0de35185be1a67ffb6d9801da0125
SSDEEP 384:sxZ36h/fQsMWvpMksDE/bxU2RR+eZXQTJfBaC/Loo:sP6h/fQYpMHE/bxU2RVCTLL
TLSH
T15072A7A355705AB78CE7D219FA25FB26E2F9905285D04F50ABFCED1C00E67DE6202C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8d3f3e823ca47af1ae142804e649ed7f75c7a5881262dd8e72daf941d70542db
MD5 ef3ae3c5b095c4bdd877166a63bc1bbf
SHA1 f881760c0ddf8445af05926f9fe54a29ebb5652f
SHA512 81f62580224d249d97a19ef9759c8d8ca167c5021591c4d02ec71da3b3c7120acfe3e2a7b8d6e02b5504456be6905807ecd734412119003d928dcf8d47e22329
SSDEEP 192:sxZ3RFoh/fQsUWpVGpWIdp3K/W6+WNduyiWd/Y0dBaPZZIgFJ:sxZ3oh/fQsUWvGpX6/bD/5Wv
TLSH
T19032C7526A34A93B8CCBD20DFB25BF63E6F9502291911F58A6FC951C04F66DE2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1d3a6b6560a0945ddae36a3f468c554ebb827ee7a20b6713e189d0626e7262de
MD5 6a4e6c34410f120ed58c320d2000d0fd
SHA1 9d31bc1a8b62866ef4068dc3fd2e7d26a0126095
SHA512 e5da9a4ff098ae80bbe7b6594833f4a59dce046ebe7def4f1329f01b36d265a8bd0e796f8eb16c65b5efbe079d35faed988d861a99a432f8989d0b29870358b1
SSDEEP 192:sxZ3Rmoh/fQsRpLIdp3K/W6+WNmyiWd/Y05VarOrIgrJ:sxZ3bh/fQsRpU6/bZ/5H9
TLSH
T1F822C7526E64A93B8CCBD209BB25BF53E6F9503291951E58F6FC961C04F6ACE1207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fd19c4187fa6426cc87496dc2597752483e93da0e64b0e677a1785dbecbb00a4
MD5 7d118d487a4e14bdcf247b6ad7465509
SHA1 b6003e712f1bdfb04ab40ac99e65b3b1ff73ce89
SHA512 cfc0d1492b6c063fefc6d5cd0a3d98dfcfda7c0e2e510c0c09b474c366690bab8c04e57a8b6c26ea46bed5205b7a6f3b750793040f7cb692e4b52d6a0d0a0bd8
SSDEEP 384:sxZ36h/fQsMWvppksDE/bxU2RR+eZXQTJfBaC/LnO:sP6h/fQYppHE/bxU2RVCTLO
TLSH
T15172B8A355705AB7CCEBD219FA25FB2AE2F9905285D04F50AAFCED1C00E67DD6202C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5385d92e8aec944796b31ab964e9c9bc5ec85d7d2e1ca19173527e8662256d66
MD5 186c2b5e14e576515e95eae1b2468a25
SHA1 3ed64bb3944a829ee372ec7a76187a8d20fa5d58
SHA512 2c3dae549cd670ee336b5a68cd5cce1b266f88e62893eee68453736dfdf598522e70210d0cf200a776ec4d17ab4a8180beae8ea261af9369b5ff323abf5722f2
SSDEEP 384:sxZ36h/fQsHWvppQDE/bxU2RR+eZXQTJfBaC/LOO:sP6h/fzYppIE/bxU2RVCTLf
TLSH
T17072A7A355705AB7CCEBD219FA25FB26E2F9905285D04F54AAFCED1C00E67DD6202C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 9bc484f22574f480604f9c5f086ae55a2c59e63e365cbb6d284681c795ab7319
MD5 c1458227528f0868a11026541c4aeeaa
SHA1 1bb053915a94fd38506cf06477755aac03398a9a
SHA512 c4b1056c00f9386fdddbf5a4e2bb9e8208cd86861de9fda623340ac8ec4894f2fb94c4764b99c4859cde1fab8af1c3bc52bcf92bfaf99a8c4c021484cad6ad47
SSDEEP 768:Nlzdl8kZ2N1WRmsYQ608F1+UoAYDCx9Tuqh0VfUC9xbog/OV36/Ll/df0hraroqr:Nlzdl8kZ2N1WRmsYQ60u1jaK6/Lpd8h0
TLSH
T126D20B3F244CCB7E4FC00A9DDC266F966EE802C7A6588D5047FE994C02D77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2d4866269c4663d4debec36d578191af4d3e1ec54c23067760e480a1d10a7ba8
MD5 4bbaf32c3aab7fca34a8145788f8a4e2
SHA1 604198311841f266758ad1dfcb0cdd3f6478fdc7
SHA512 ba3fe1dfc2b2ca2b0421569b42ea57ea77a10b0d7706133432f22f340cff748c3a26ea00822edcb3186f12418a05bbfa5de960c74430148270daf9067db2bc43
TLSH
T1EEE086500ECAD17DB51520870768C318E3E6B527DBCC7E422F8CD9886546D65F6D3DD1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430550523153654

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430550523153654
Size 13KB
SHA256 4333166299d5395ca716bb023c1d76cef02fe53aabc021e729a40649e61bc11b
MD5 b82c859eacc7aa15eddc99b3881f3292
SHA1 eb11d46503046050b3383a5541be7544a465345b
SHA512 e02115db5246a48f29ebf9a812ef4a847af7600c5257a3816afafda631d4679f8a671ea4f78181fdd09d043757e0c51bc2b474a4add5d11273c8b653fc322f08
SSDEEP 384:r9uSsA8/Stl/onn/cYlRrnBxR/2uj965Z:rIKtlQnnkYlRBxROQg
TLSH
T1E8525A256BE9857AF1BFC27C94BA21F7F671BA52B1C0CE5D01A111090C27B03AF70D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5e0d5902ff8fff48c4f06ec4f614aff4e170fb7efadf7e82fa7e5c1f5a45a545
MD5 15f2ca439372128bc2d15093328f9967
SHA1 a4c151c46a9c62934dd26ff0d3a6b32551e7eee5
SHA512 5b1562b4e078f2950251fb4f2b9a68402c54f3eb4c54e7d813ee6c1364907ae6419fd066833cbe42e03d6f02a0c1a7f4109476f9a61a2bcfb5d1b30d9b0ae6e4
TLSH
T119B01245BB01A307C0BD08B193D357C062B0F40200404A138D2DBF214E096E53F029C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4768a0bb5b82c2f35b3a57ae9bb0a4a8a2f72dd5db607827ffd0c82d26eac222
MD5 00f53e53f630bfec2fcb31139421a409
SHA1 e5f5a1ab0bb65327ff38fe84942351708789f02b
SHA512 0c9b0f2c57327834d36d20c4f8e7394a0fc17eb45ee71f5b8a2fc43617c56b77bc942ae5210430facb1ca1239a8037e1bdc6a36ea21c3837744b27a98e4a511d
TLSH
T14DE0D8201ECAC23EB24520CB5318D308D2E3B513DBCC7A512B0CE488620A950B3C3D90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 10985fa80e53ab14967e64cbff8bb0e03d862506c07dbd54cb0c85f015951498
MD5 708fc1bdd03bba9231cf8591b9764573
SHA1 c18b632698de548e3f9f77ac755bb61858223b81
SHA512 f4849d05d7352d4c9df4c9aa00d764f66fed976060672741bfda39e45907107acd7d8970bba57d0add2e5180c934c073344113e85b283138c562e483abfcb728
TLSH
T114E026704ACACA3D6900609F8368DB1C92F1B9169BCC3AC2570C8448A501931F3E7DD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 888c8d7ab783838f90cb8872ef1a423f67c1e3e2051350e76ad942da4d6680a1
MD5 d9c7eb18060fc85c9c0ac133d6668435
SHA1 7b99c384fb1a3ae752f13bc63152dd9f2e81ac88
SHA512 39b084c1ee784bf7a43956776efbfe76ff0a2af0c4220418491144b5cf77e3edc2f12c3a0df1dbd6310f394a4461ac244d731eafcc2e123a339918200a40650c
SSDEEP 48:KcIIDKpyUPyJeIfK7is7KI/KT6kLyJJm9JfXXOz:KcIgKpye6eoK7iQKAKT66Sz
TLSH
T1B791E59171BA62463C3F351C87968626568271633198B57FBBB801B60E67E234CFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be4ebdd5-2bbc-44fc-b01f-4e4fbe5dba67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be4ebdd5-2bbc-44fc-b01f-4e4fbe5dba67.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 e1630f271e030805762943e4c7386d3a465da55d582ce599fef437ce2e3f9342
MD5 c9f1fe56296e825cfd367304b6b8f159
SHA1 b0370b03ebcb93e47d5150ddf16256e91c3bb8e8
SHA512 014138743f6bb62fce233f9d943906a518272b01efec13b4c750fcecc622d621b9bead93fd89021970a5223040d9eb08ff067e29ee96833df93a52a081abc1fa
SSDEEP 49152:/+qyHwL/3QSeNmamNWIlycWNXSl2jmwxqjE6doNXPy78UctMUXJwJte0HaxpO2nK:l
TLSH
T16616DBFB7D1991AEC9CE8174D52BEE0884B34A614520C6E2693D24C3FB78503FE77989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 b006330839efb0059e27544cec024d830345ce9779f4d79479fd0499ba5e2bb0
MD5 6620dba4a1ae27efd2ae5c2b8d99a977
SHA1 5af1c0974522363a782d6563ed87679edb6724f8
SHA512 8cca2b3ab1a949773a64051f23dcea5228aae21dee342c57296b820857a15ff48fc0ae3a7d85ecdb45e73158c976ec656a3859ba66976a0100b27dbe3e9294d6
SSDEEP 384:5Uct4slqsHQXIIImbGMIMuBkuTuCueuhueuO:v9lzHQPY3J4J7
TLSH
T19172B46B5A511B7BE26EAFF60276C5981AE99CC04870562C3061280F8CF3E2787C53F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 2c980d241c7587cc13925171d0647e7cbe323f5473d8e9f45a4024af1fe271d3
MD5 23a592e72cd8469c89d83762a7bdd93d
SHA1 3028759abcbd3407f009991dad96aec04490d5b8
SHA512 318256453aed515c16723026d2da0f29783e6b445c1cb40a7ce542198410c4c3594e4fdd1f590152a3cd4c6dc52caa94857361c02161ee46cfe124ef9f1b2ec9
TLSH
T129E02610AECAC26EB45424D7D238E308A2C03A03EF88BA875F00C48CA481529FBE7DD1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9ca2bce18cc83dacb180d03317c3014a299228a2e1eb781f98ab005c6018058a
MD5 62a30362bf60c5c425250cfc50cdb95d
SHA1 e0fe98a4310bf0a02e43c2e38d3c3d87920df8b6
SHA512 a4345e4f8ef2b49d4f3716b68d4b4b30fdb8c3b88c06c12f93a31145fea18e1e042e5b7afa644dcc40b16585674a4d5cbaa9f92fb576711ccb22a91f87b0845c
TLSH
T1E121D296F320C159C54A8A3B642FA7195329C4058FF8EC0F487924693E76F140E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 7386dc7dc476ea873bae3e01728d4ad58ca61a7d3a107f182ef7c0b1c15aaf8f
MD5 59de29e1d7a24019c69a6b5505e8c181
SHA1 490d551e280d22aa7448e850ddf03f3c22be4574
SHA512 4a5f75528a52ee8fd05df6cad42a4c487e56c9b57dc34200c65e87d6e274c80a66bd33f9dee766621fdf6d4e3961b855018a141f7708d84c231f9d2e30b2b6e3
TLSH
T179E0485069C5D25F741420935278D358A2D13D46EF847E461F04C88C9541556BB97DD1
MD5 SHA1 SHA512 TLSH

Submit Download

dd959614-9ecd-4d9d-be30-732bf1c7f681.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dd959614-9ecd-4d9d-be30-732bf1c7f681.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 71dde41a06e5574a87dd00a0611526e791a12856adbdacf0218c3e5eb0c02809
MD5 8b749348d239b7e9041646ffd88bb48b
SHA1 1dd22e615b8f3fd3bfe46ce08ce284fe15d32f5f
SHA512 f807cfc71d0a49ff1a757e1acf025dbcc041f906e7fa0f7b0902b477fae48b46cdd38aed9b3c11a535d40d652119601c700fa170ea371a97651b04893cbcc4c0
SSDEEP 384:n8ZcIW38N5/KAE/AyTrK/OnK1BhPhf5UrzVKDyHx/7Izn:qW3nt+/OMBhPhSVA
TLSH
T14BA28D756CB8AC369DD3E549B64A37077FF48163D3C81B9886EC7B2E04A91A92307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 1c93f7c177a7472baff7fc374fb2c822f1dd83ad6f1ca9e5ba42dd32ea525a5b
MD5 e3512f7a3c806bc627d4a91681d2b185
SHA1 367b459bb1527f410b850aa53087bbc0161218de
SHA512 9ea3fb81c863fab594a6f93dacc6e4ec944c6f4bb69e46fcd91492c51bce0474a67e7888c6cfaf213ddc020d81049ef4e1fe051e1750c5da0048ad5487710177
SSDEEP 768:5FqW3jwg640x7ToYudAZnmsQ8QVmp1mA9tIVA:iW3Qt4rdAZnmJ8BuGiA
TLSH
T1A13349F998D7D93AD9AE6787633E2E0699BCC023B5985984F7D42E0CCC2257FD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e121c11f6deb62a83de57dadad38e53466765a675b1c46d0de0b4cf9b4a887b2
MD5 2edab2bb4461e7fa1e7eb89c8c918bb4
SHA1 4200b028ff9d64b28d032d3a5203c1426d3bf1b8
SHA512 5cb01047d9a86785a95f3a896265fcf90468f4b5b41d224a67afc8bd3327311ddd7fc81b337d8c3e23e095c00f8c2f0e6a36809e3fed8ea990b747a9be64c2b4
SSDEEP 384:npZcIW38NE/KAE/AyTr17yfCAj7F/Onfx9cA9tn5UrzVKDyHx/7Izn:hW3OtdfAj7F/OfxmA9taVA
TLSH
T193C26BB8ACA8AD3B8CEAE388B64B76536EF40177D5D40A48D3EC2B1D443259D6703C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9d2c6e7a12ddfa55af666b68bca1d85c2156d7db3661a922d5d5b86ab52e0441
MD5 ff191b96c1e98dd5e5692f79c0137424
SHA1 2d4dd8f5630463d1a22fe72ac7dad3868647a03c
SHA512 9ba63b47b8ae3ea7c819cd7647e84c0970b5cffb7d6d6fabc0e517491cef124d190dea5fc2a14b51a5ff35d2214c5110ae8242e7b772cb7f2fed21aec24e2a2b
SSDEEP 384:ntZcIW38NtqKAE/AygrK/OnKQ5BlX3rTWENf5UrzVKDyHx/7Izn:1W3gq+/OT5z7TWENSVA
TLSH
T1EAC25C7C9C646C3E88AEF709764D3A276DB84137D2B41A98D7EC2B1DC479498F703816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3e70a97b5cd36a39d0a91057cf1a0caeea48f2137c06b5e2d0953d716b1c4c96
MD5 69d52029f809c759b0e9eaa72ccbcecc
SHA1 b24ca907f58f16fca034d77ed38fb9397641dfd1
SHA512 dd3ea98c6e389694be75ba6d1f7f6a945dc7c7c7bf48606b95d3d2aa16bc24afbc3ca33ffc8983ac1f1b9c77ce813be5da740c40b64acaf07347d07fc48188a7
SSDEEP 384:aZcIh8NYqKAE/CePXK/OnKpt7Of5UrzVKDr:Yhx56/OSt6SV8
TLSH
T142928D715CB8AD3A5DE3E945F8463217AEB48077E3C82B98D6ED3B2D05AA1DC1703C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bb9b280e2d7bf6952dc8b8c2139029a2e78cfacfe2c185bb0d7882eab1a528cb
MD5 b4e4d39e5088829dad34cb2dd72faa6a
SHA1 307c3aea2ed29dd909be5f499f52fb1dc2a22633
SHA512 3284380a4e34e70305f34e4a10913705d67e5423af4d10632b93a4d2247c055c17631fb5a975559c4962bda7793e16be59c4a9f9ef3bf87e0360493df8c35e8d
SSDEEP 384:0ZcI88NYqKAE/UFQXK/OnKpt5/BtdKTWMEf5UrzVKDr:y8xv6/OStTtoTWDSV8
TLSH
T102B25A7C9C74693E84AEB708754D362B5DB8813BD2B41AA8D7EC2B1DC47949CF703816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 5ba7099dd0b5d28ec546df82a8801380daacd5c6f806e9efe01100f4e82ecca6
MD5 b6e6f1f5b46afe08ad9af804faae8e18
SHA1 2f547b71ad309884004c9054188b13a89bd1c6c5
SHA512 b691d5b4766c2d0aa60abd28a61d8a0f05327ac0f66edd163e3df47a79b049872a8df4622873256d6b6ecf6e4ecb5af1d0d9748c5fba4b1a974326f304330a33
SSDEEP 384:nEZcI88NtqKAE/k5RXK/OnKH5M6f5UrzVKDyHx/7Izn:i8gY6/O45M6SVA
TLSH
T135A27C746CB8BC779AE2E909B65A37077FF45077D2C41B98C6ED3B2E04561992303C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fdeb915d850d150e99abf83ffbe2e8d64757e9e2566f2c723774bcb25fcbb787
MD5 4f8e9fcd7e02f988ff2f35f5f3633c0b
SHA1 3a06c6b36f905bbc38c69a629acce61575a2bd77
SHA512 e87702babef3803eff6c4e20dab9c32b4ab5b657fff3e6916f7cdd61e209816c2b8efc7c1ee7dd3bbc9a719f98cf5dfb02e4e35ad887951407d6b1404d462d0b
SSDEEP 384:0ZcI88NYqKAE/UyQXK/OnKpt5/BtdKTWMEf5UrzVKDr:y8xS6/OStTtoTWDSV8
TLSH
T12EB25A7C9C74693E84AEB708754D362B5DB8813BE2B41AA8D7EC2B1DC47949CF703816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80aee9e6c3f11cb29dd559d2047d78b09c56d1ca5983e8f19e31ac494f583eda
MD5 d0c19715b78bfd0d061d1e252ab86e95
SHA1 0ef152a0227b1ec7870255130b872da6ceead782
SHA512 9d11ee242deb032202f6a21442d9bc67e7d92976f056f61d150be7cf4a9242417253ef0b2eba8bc54985ffb5d792aa0594064254564fa02464fa55a74e7dfd61
SSDEEP 192:7GNt6fNNQmiUylzHBPL/GPTy2ntV7qC+U6:7GNt61LGzhPL/OntUlU6
TLSH
T1D102E935ACB8687B8EE3AE59F58737179FA5206B96952F54C6E82B0C00D759C2343C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a39721dfda1acf92040ed9f9bc8f8684b081f6c32adaab9de0c739ed059952a
MD5 d13ee262a71eb422f88d4e45941760ff
SHA1 430468e33becf740ffdac2bb1c9d346073b99f2c
SHA512 0b320f41456ed1be43296ef05e9ee9d8370add669c296a288262822ab47126e3976b576b9609e0fa93edc770b0eefee5fd06e90cc28fde41be798b71388725af
SSDEEP 192:gJGNp6fNuQmiUyXSBlL/GPTy2nKkn7V3ZpqaOU6:mGNp61qS0lL/OnK2L7OU6
TLSH
T1B5121835A8B8AC3B4DD2A965F0873613AE60412BDB896F54C6EC3B1C05EF5DC6307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1167fc7f-c378-4edd-8750-751c8ea34a5b.tmp

Path C:\Users\Admin\AppData\Local\Temp\1167fc7f-c378-4edd-8750-751c8ea34a5b.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_1359337700\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7521aa7-1960-415f-b9eb-a99bc8f04789.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_1359337700\c7521aa7-1960-415f-b9eb-a99bc8f04789.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MgqXuezhbSpjULBkgLvxcrXZT.dll

Path C:\Users\Admin\AppData\Roaming\MgqXuezhbSpjULBkgLvxcrXZT.dll
Size 111KB
SHA256 ca73020f75873e8634b27f68d5c7d958846842e4faea38ad0c4f6d18a4848c1d
MD5 0ebcc1687b485410656ea63b00583e44
SHA1 d21ed89fe56335a56045c3817ba9ed0c2bdf0a3d
SHA512 00a22680f43f9d56968c3f0049a99c918b887a1a48f736f3bd1399587fb032cb8b192de5a766c025b0f48d069d3e69cb1bf0f57f63bae0298ea597325c98e75f
SSDEEP 1536:kZNmZlzhivZdNbPUyrjMABbvxR6QgFZmjoDZptJengY9to94+Vig:bnhivZdNQQjLdd0ZmjoDX7egYc94+Vv
TLSH
T15BB3072B76868B19D0581978C0E74A3403E3BB87B377D3453E9452C90E057E9DE9BBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lycron Crypter Cracked.exe

Path C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\Lycron Crypter Cracked.exe
Size 13.0MB
SHA256 622ed14ae83ba77cbbf99f2fd86ba88623163ea1e9da28d8d95d7bb9e153aaaa
MD5 70b0b2c30efb621d4bb3ebe5b017b580
SHA1 2a262775967f5ed20799a449b1ea3dc0a40348e9
SHA512 93442e01faf03d8e4e43ae579e6392f434d4575356c6446a6785bdd717a8dd1c5eaa28fb8f2695961faec8e5d8c97128d3ad8afbe05a01cd82d9fd576e07e9f6
SSDEEP 393216:JrTrH1oDw42+MfE41GLGLoGIm9UJIDkS0nBF:dSDwc07cLGERJ0kF
TLSH
T163D63302B38CD8A7F77543338570F925DE1DE6104FA116EAF7CB1B2E5A61180B63A627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crack.exe

Path C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\crack.exe
Size 348KB
SHA256 ed2ebcae0714811795b90fe1a2558288f8d031286af097b746e2707c293e6bf1
MD5 2084b25c16b8e90e41460f730f1f2a2f
SHA1 f688038db9deb2dddd4c344a988d0bc453727807
SHA512 e8e8b0188d7354ef7dcc52540efe4a64c00dec74012d36979c9c80998859295c067f9edb20a666e74d3ca7997c29bdd758394fa9a1c27430633d2997adb66bd2
SSDEEP 6144:Gw68nsBtw5pH2Bvi06SkCpJ9ugiXzuwvZ7+nV:GosBtw5pH2BviUyzuwv4nV
TLSH
T1DC747C01B9D0C432D67338324B74E3B689BDA47029556A8F27ED0DBA6F30781A73566F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search on google.txt

Path C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\search on google.txt
Size 377B
SHA256 bdf8e638c97c192c7b461e43b275e1f90db56d8519a7e1af7407488358ad9891
MD5 4d77f3312fa1e9d426f727637325397e
SHA1 995b9d4158b5859b52009dc316e280b13a66e545
SHA512 92e36f922066afe6f0283523ae58d1b35eaaae3bb844af34c7d7a365ce44adfd3d77854d6c4c3e94c9fb078dd810f94f9c6908681f3ff12ba2da1018dbc71326
TLSH
T188E092EFA17361434330CAA6A1247A19D4CDD469EAC686D0FC804291703AD5BE9A218E
MD5 SHA1 SHA512 TLSH

Submit Download

setup.bat

Path C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\setup.bat
Size 120B
SHA256 a12e1ab36129d36bc748a96b0ab3655c22637de6199d98669319be01d930a9c2
MD5 0fcbff71d5101e8e3c572566e2f08ac9
SHA1 811bad4931c9cbe45cea3705982a78b85efe041e
SHA512 335f772a36e7f77c059feab608f79ce7a4ecb639b6cf7a966471ee0caf95c34025f5a924d63195ad8730a96571a0002458e04331ee6d637d4cd6631c72d0eb72
TLSH
T1ABB0220E08832000C28328808A2A2AA03A8E002A038BA3C23000EC88A0000FE82A08AA
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\Desktop\Lycron Crypter 2026 Cracked\svchost.exe
Size 10.5MB
SHA256 6adc3c68390848a0df96531df0cc8b70404d7a7bd1b642b95a50d514e083043d
MD5 0b46ae075fc8d91e76bf338222d81f15
SHA1 f5853fb5258f28595fb92e2a895a0fd093504cb5
SHA512 e53cbd18fab33d50776c19d1735da689d767a14af9d5d5dfaf824634e59e8d457423659c305b3adec81b2398d21762264c189e5d90d02c5ab059dd3605f77c16
SSDEEP 196608:vIvv8Zk80W8/LadcdQmR8dA6l68Qnf2ODjMnGydSIaC2ccQKPoOB:+qkrW8BdQJlSF3MnG3IaC2RQKPoS
TLSH
T1A1B63381BB490CF4F89EA63994C2451A53A3FC7103E886935BAC1D540E6B2E4FFF5768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lycron_Crypter_2026_Cracked.zip

Path C:\Users\Admin\Downloads\Lycron_Crypter_2026_Cracked.zip
Size 12.9MB
SHA256 4d098c40182535b2962ebad4ad8498813937b96296979630465424a4e8638f60
MD5 dd24e0c7611a028d5e27c0c738b38dba
SHA1 7f53cfe8ff15ca0e9a31c9eb188b89e178ac96df
SHA512 f9765ee5b40519588d195a4a98fce67dfeef8c7ebb35ffe890a22d5d2ac714441d9453d0815d50afc341a41c282933205f696cad404bbdb87605b4a2f2146e83
SSDEEP 393216:Bny7bPLUNC0eGKZgc52vWBeooQBmT8HoemPzX:NyoNCO6f8vW0BTKEX
TLSH
T148D63342A24CED8FBB79435381A5FC15DE0EC3115BD212F5F6CB271E5A8118DBABB01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lycron_Crypter_2026_Cracked.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Lycron_Crypter_2026_Cracked.zip:Zone.Identifier
Size 333B
SHA256 2765aa828df24a2777d5a1fe38d267f252983dceb7ad47efb7c4081b9d915dd4
MD5 bab16fa9e0d542281f2a52f466d78d92
SHA1 01d6059c03d06fa5322c2b30cca4f29082c1eb57
SHA512 6f963de9ebd490c671715f0f94af614f9177e084af2f0120fdc9f947b6350694e6b207d88699095155a4408d316e7038443737be3c4ac40084ae930a0b7ec40d
TLSH
T1E4E07D97C8C48973422665B2437F64BEA84F74CC4CA9CA10FC00155FE6A5834D0E5D27
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1136103294\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_979243013\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4636-3090-0x00000000655C0000-0x0000000065669000-memory.dmp

Download

memory/5528-3155-0x00000000655C0000-0x0000000065669000-memory.dmp

Download

memory/5712-3206-0x00000000059F0000-0x00000000059FA000-memory.dmp

Download

memory/5712-3203-0x0000000005A10000-0x0000000005AAC000-memory.dmp

Download

memory/5712-3204-0x0000000006060000-0x0000000006606000-memory.dmp

Download

memory/5712-3202-0x0000000000BF0000-0x0000000000F40000-memory.dmp

Download

memory/5712-3205-0x0000000005AB0000-0x0000000005B42000-memory.dmp

Download

memory/5712-3209-0x0000000006880000-0x00000000068B2000-memory.dmp

Download

memory/5712-3207-0x0000000005CC0000-0x0000000005D16000-memory.dmp

Download

memory/5712-3208-0x0000000005EB0000-0x0000000006032000-memory.dmp

Download