538dd553c5c9e064cbdea35488d231a5ac1a269971c10ff9edd832ee4c3831d0

Resubmissions

26/03/2024, 23:58

240326-31d1dafc263

26/03/2024, 23:55

25/03/2024, 23:41

25/03/2024, 23:38

25/03/2024, 23:14

25/03/2024, 22:57

25/03/2024, 22:54

25/03/2024, 22:53

Analysis

max time kernel
1367s
max time network
1363s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MegaBoyVM.exe
Size 102KB
Sample240325-28bdsaaf66
SHA256 8a16e748ca24d7f8a5205501fd381cef33c6bbbb2e715abf6b91f486ad6afd2d
MD5 f0de1a04aa9ee6d1e8d6fb391ce10034
SHA1 e0ccf4a81f920997b5f2dbb7209844491e774647
SHA512 12818c13cb4084dcfdf0c804ef95eb0c131d71a2ddc1323eee35dbf1848f140bbd24f6e5e6265629eabf5de46ae8cb2e74eb42016e285dbcef7314e4063fe5ab
SSDEEP 1536:3yU9NZjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCB8u4jx9bSHACiH:CwNeN3w/jhlhE1Z8Nig9L8u4N9bSE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	MegaBoyVM.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	MegaBoyVM.exe

Executes dropped EXE 2 IoCs

pid	Process
6024	Screamer_by_LuckyKazya.exe
2296	Meatspin_v6_FULL_by_LuckyKazya.exe

Sets desktop wallpaper using registry 2 TTPs 4 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5169.tmp.jpg"	MegaBoyVM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB73B.tmp.jpg"	MegaBoyVM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp158A.tmp.jpg"	MegaBoyVM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp70EA.tmp.jpg"	MegaBoyVM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
5664	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5672	taskkill.exe
3636	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\WallpaperStyle = "2"	MegaBoyVM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\Desktop\TileWallpaper = "0"	MegaBoyVM.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{9404543E-A7E4-4290-97B7-395DAA9A7C0B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 673091.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
1696	msedge.exe
1696	msedge.exe
4884	msedge.exe
4884	msedge.exe
4808	msedge.exe
4808	msedge.exe
1924	identity_helper.exe
1924	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5400	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	MegaBoyVM.exe
Token: SeDebugPrivilege	5400	taskmgr.exe
Token: SeSystemProfilePrivilege	5400	taskmgr.exe
Token: SeCreateGlobalPrivilege	5400	taskmgr.exe
Token: SeDebugPrivilege	5124	MegaBoyVM.exe
Token: SeDebugPrivilege	3556	MegaBoyVM.exe
Token: SeDebugPrivilege	4592	MegaBoyVM.exe
Token: SeDebugPrivilege	2760	MegaBoyVM.exe
Token: 33	5400	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5400	taskmgr.exe
Token: SeDebugPrivilege	2868	MegaBoyVM.exe
Token: 33	4628	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4628	AUDIODG.EXE
Token: SeDebugPrivilege	5664	tasklist.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeDebugPrivilege	3636	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe
5400	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 520	1696	msedge.exe	99
PID 1696 wrote to memory of 520	1696	msedge.exe	99
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 5016	1696	msedge.exe	100
PID 1696 wrote to memory of 4364	1696	msedge.exe	101
PID 1696 wrote to memory of 4364	1696	msedge.exe	101
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102
PID 1696 wrote to memory of 4860	1696	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd465646f8,0x7ffd46564708,0x7ffd46564718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11185482521758648325,1384822916007526710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd465646f8,0x7ffd46564708,0x7ffd46564718
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15992162518229908666,9890149835278853709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5400

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:3132

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:5216

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:1048

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:2868

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:3340

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3504
- C:\Screamer_by_LuckyKazya.exe
  "C:\Screamer_by_LuckyKazya.exe"
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:4340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Screamer_by_LuckyKazya.exe\
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Screamer_by_LuckyKazya.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- C:\Meatspin_v6_FULL_by_LuckyKazya.exe
  "C:\Meatspin_v6_FULL_by_LuckyKazya.exe"
  2⤵
  - Executes dropped EXE
  PID:2296

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1472

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4bc 0x4d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Meatspin_v6_FULL_by_LuckyKazya.exe

Path C:\Meatspin_v6_FULL_by_LuckyKazya.exe
Size 3.5MB
SHA256 a2bb41685200dc2b088156734e9d83d6239817831b3a022692102fe5de1283ab
MD5 8d81ca67c0e155f489c6a1d2ad11d423
SHA1 3839a7001036b246474db38c05b6469c9175b264
SHA512 ec95e606fc3d08c7ca46d3305c5605e463db048eb92cc3b8d0fe59f2e899b305fdc0afe49510230feb52594ce8f6733c1389268abbd5316d94a2378b0af951a1
SSDEEP 98304:weGLANOwhDHV5pHml1VnHPC4d8EbRLFdMdqBzY:8LANOwZ15pHmlrPCL4RLFd+szY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meatspin_v6_FULL_by_LuckyKazya.exe

Path C:\Meatspin_v6_FULL_by_LuckyKazya.exe
Size 2.8MB
SHA256 19e12102a6e68dfcc4d7e7697e8c04f0689d47f108ab60036de35c725a047a67
MD5 f9dd21606004e73ed94e0b9c2d5b37e0
SHA1 48c59caccf2979ef18d37dcf285fdde2b2c405df
SHA512 02292af9e3f1f9647c784307d7bd8584bceaf9efb30fe1ed79e87fe82cabcc47aac77f9816f15eccbca47082972513523c104da9dadb0dca188e56a3b00fc438
SSDEEP 49152:A/beGHi4uZqANETwhD304pVJIEpR8sZmyin1VsKVBHBxu94Pl8z63bRLt:weGLANOwhDHV5pHml1VnHPC4d8EbRLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Screamer_by_LuckyKazya.exe

Path C:\Screamer_by_LuckyKazya.exe
Size 4.6MB
SHA256 a3d50c8bf0de5d88f6d44cfd55b6b1b4e11d524f6c0bde70d1b5cb4d07510c8e
MD5 ee22242272e5bbc963fd5a7da38b8800
SHA1 b44d5407375aec9c7c66eee26be833927ec6e1cf
SHA512 2a9dafcb8e91672a1a6cacf9c52b3a8b83e89c3389fe2dfe23469c1a014ce473819776a6b123cf93efaa30e268f07571b07c4dcfb7193d3128ec8c185687fbb9
SSDEEP 98304:RWaPi95brhiYYIOyWLFA/pr2LFsoYe91+BZoNIr7wqscUz:RV6QqOyjr2LF3Ye6YmnwqdUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Screamer_by_LuckyKazya.exe

Path C:\Screamer_by_LuckyKazya.exe
Size 7.2MB
SHA256 5d21171656846805a5e0d0048d4d7e5a05e0842aa347af170cc4ce31fdcd8215
MD5 3c0d90493ffe13426af72c68669637ab
SHA1 a03cb4f7aecb112990d5dde97e87682e0a58656c
SHA512 90716e3287241b8fe17967e1eb500a15f0b8cfff6a8def9acea8a02cfd7e0f4be584365cb309690bb1626a7e7c3e2ac7de128acdf78943447403953bf41408b7
SSDEEP 98304:RWaPi95brhiYYIOyWLFA/pr2LFsoYe91+BZoNIr7wqscUByK1mn2UH+UMUIZHdrd:RV6QqOyjr2LF3Ye6YmnwqdU142UM7Vd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Screamer_by_LuckyKazya.exe

Path C:\Screamer_by_LuckyKazya.exe
Size 7.4MB
SHA256 f91c14c328544a2d4cc216c7c2115283806fa3201d40bd3c7c5d79dccd025b09
MD5 3c3d1168fc2724c551837a505ea4374e
SHA1 86c913a12067fd2c1bbc31fb64a5b5d056175841
SHA512 0f181c9753a3f55e4f4a434ea3e972e00b46fb7319d95a4b7a5c7d09888537df4a8fc4c2c5e0232f96b441727e45a595eed42721ff8c7799302e4d3f13156a8e
SSDEEP 98304:RWaPi95brhiYYIOyWLFA/pr2LFsoYe91+BZoNIr7wqscUByK1mn2UH+UMUIZHdrq:RV6QqOyjr2LF3Ye6YmnwqdU142UM7Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MegaBoyNVM.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MegaBoyNVM.exe.log
Size 871B
SHA256 7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
MD5 386677f585908a33791517dfc2317f88
SHA1 2e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA512 876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2b28663660d122c1646a18f0c3cf9e62bdd5b7db8d4764c339d8c04c190835f0
MD5 537a3e71a799908710457f7d5a0aa23a
SHA1 44df976b864716d041f42be50f1c5ffc1405acb2
SHA512 20c151e85316c5bbb63020266297c4923d76886768eb495defb96f082fb51a425a68be864f9fdd4837257cbab5239f8a25b8ff203aa58e95c1598daf9a91338e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 9547698a392fda502d69b3efad314f8da37e55eb8bd5c3b27e0400813c4623b7
MD5 e5d1f49c4d66761ecf4358e0532260e6
SHA1 d30a672306d945b5bd5efd6a3286e9c24ef45627
SHA512 00a9b9c8886904e8e2f7f190bbb7a5c98a4a6962781e7a9810b1e3840c892fca44d4385541302ceb65cca7d4a66792f6e82d38b9e23048cf55db4ab62376f26b
SSDEEP 3:MsFlYhXllLlX8lXHeOVl+clI:/Fiz10XHfVscy
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 d504db629fa871a21c138e336eaab5df21bdee2170413d99b04aaf60d45eb8f0
MD5 365aac573db2a64814940be3aedfee49
SHA1 d05b30bec2c9834045efdb0e6f363e415611700a
SHA512 0da07752c370a68b9b3861ebbd8f198eb6079a2fce06430bd4bc51720dbf145c2124d5f7f3e57ce9b2eeb8055d141cdac46cb27396887a047e354f79e1d87414
SSDEEP 6:/M/PXGuEjQw3kl5HT/lcQoiT9xiT9xWMEbGjgDeAPDgLAWiXwMhc:U/PX+kn6Ax2xWMEiUDekOA/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d3629cf8022d89225c224286acfbd61634e3644ca1273cf7b49fae97e6eade89
MD5 1e8682a5ce5107377ccf73918d69542a
SHA1 dacbe60eba4b0c09658c2bd1ff5096c61fd9bc7f
SHA512 7d112e85e2e2e4a00f9521cdaf4665bb7c5f39857df56fbc4c8dbd93f6eb617f27121521dfb2a989bf7ca86dbf6b41044bda3eaee5d0f9adbb1021aee7215aaf
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 a250c584995727969100de9197467ab7a16f4e1126f048a29ba9ffaf1e564344
MD5 47614207b67453be9d707b4985f7d59d
SHA1 aa2359618983845e5206190a4074eb282cb86ebe
SHA512 1cc3ef8e52c09cc98c47705cf3e13ba5946e757ce23f858eee07c986f0f8abe3a637bf10358cc0f72411737cf497572d4b483ada2269896dcaf10a1aca1dde46
MD5 SHA1 SHA512

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 2ac806c2971ffacfd315d9a88ae7628ddfa43bd25fad601e89ab529d7e3f9ef9
MD5 aa5c6ebca1d3c07a35b78fa5c2c03095
SHA1 a3ff66a000309b0241b8dfad9b50635899e5bd36
SHA512 143af6e8306000d2b0fe6501022c793d6778c5850b484048ac44c24ba01902a67b61a9ed55d5e516e80e650d2a4bfe641d7eb04131739290c7457270df016ace
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 6KB
SHA256 b9ad1f535d1cbc16fe0a82239e800f7d89a3962f84f763bebba4d1849ef3cfee
MD5 c8eef1d89f8ba11d04246c3fca62e6d9
SHA1 ef1e0d4da00be72f083091066f6cee3c745b20f4
SHA512 40e6cf4844e7d34d6e9354458212119e2154c037b9eb42837f5f1d26d975bfbee0b157b5dff99ce1b308a1138751878876830d51ea8623461cbb7a7c949f4f97
SSDEEP 192:sRVyN5G0zo4FN6Q4o5zJeh60s68D16TOQG0nz6VFJ6UYu50IrwFJT+FMZIy:sRVyN5G0zo4FN6Q4o5zJeh60s68D16JL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 629b637eb37d5ad02aaa89f3c09a7084ba11101e4de962d638f17c740f8d0e5c
MD5 0409e03429913fe60361b83b900f52ed
SHA1 b69172ec9322f8af70ac574b7fa19caa32ca505a
SHA512 e66afc1163cc0886c18b12139e7bcdf5f8da5db86e26152952adf231ed91298f660449823ffd760fe0da001e5acb3dd97023c245f70201763a2836bb7aa927c2
SSDEEP 96:n6SkNKl1s5sV8wpvWMoiVmdeHCur2mUWQyV+VD7ziEwb:n6Skglu5sV8GWMXl2mrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 03d9ef878efae4bfa03c26e3e5867db5531887b5d3be660d04e4ca8c28d7f7c9
MD5 51b6746d897fe64740ace0c6405fb490
SHA1 7ddde7fe77260c6c378bf3568a23d5d60a85abf2
SHA512 c6f32a3877ef22004f2a0d13dcdd27a4a860148837bf3c0ddd4076d4ba55db966d59cc56d65e1dcb0dc7259b6bd2b31536b7b4e3a06165d43acf1d2fd6756a4e
SSDEEP 96:n6SkVBKl1sFsV8wpvWMoiVmdeHCvh2sGyWQyV+VD7AiEwb:n6SkVMluFsV8GWMXo2sGlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e1a39af5af493df1d9c36f49a8e20309d98ae1155f744788f3ab3def719c7ea4
MD5 eb60e38cbf4a8090a30ebed691b5b357
SHA1 acff0836dd2f497d954a38d072ce0d79b13403a8
SHA512 517968e95dbf21f8360cf657c8be5a0d11aeddfe753b4f95868fcc746a1502210113555542689f45c90ae125aa52374e577915f1dc3dfafca69d252457ea9886
SSDEEP 96:n6SkV/Kl1oNsV8wpwksWMoiVmdevjum1jCLYh2sN1UWQyV+VD7AiEwb:n6SkVCleNsV89ksWM/jumhci2sN1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8d31450ab40c79d05a9ecd2dc80e5ec3bccf230b990d352d2133ab097a17365a
MD5 67cc25397306768b9318cae26f4209f9
SHA1 dfd490aa0064e193297adb73d75f0f10987f8d73
SHA512 422673ea07896cd47ea88664ad1c8754defa9ab9c2c2b01ab5779e4a0a541ee68929f4d5bc7baf85ff4111fb10b54cec5f8490a4b20db9e25da3212f5c115f2b
SSDEEP 192:n6SksWleZsV8GWMXxF/9jum1+yU+A3oVXDDVT5oY4yOBaXIkEfBEV4ozBkJLA2bH:n6SVWleZsHWmfVv1E+mST5lr4Bs4ZfyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b503f1c44dd577abf4880a61d7338a569ac2027746548c380a665b8c0ebd0d81
MD5 4bdb04824cddc3991cf5d981ac965050
SHA1 f9891300bf618113097d48fa7f569cbaf0e55670
SHA512 ddb4e1f2c3d1243b59d18424d91977a901f2a0ffa737dd5feccc2b6a5b2772bdaff4cdd3af1b0b07d94f84b975df84ea348112d05986377628a0067677254b5e
SSDEEP 96:n6Sk8sQzrKl1orsV8wpwgIWMoiVmdevjum1aDTqCLYh2sN1UWQyV+VD7AiEwb:n6SkcWlersV89gIWM/jum4Tqci2sN1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fe28f05ab5dc2fa7e45351403eeb7869d402adff29419630ea3b8914dc449634
MD5 6af3b4888713627455ceafd6b0d440ff
SHA1 10beeca84b428d342134942c516b85ec68adb3f4
SHA512 1a2f9c5e629915f1674a1b466bf8388b7e3d7749eb2fd72061cc9c6d8d3ab7ca9a62ea980ddecb789954a4c919f809774dbf0358b8f2bdf6edec8a3e395d4f4b
SSDEEP 96:n6SkPBKl18FsV8wpvWMoiVmdeHCuh2sN1UWQyV+VD7ziEwb:n6SkPMlGFsV8GWMXP2sN1rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 175B
SHA256 93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61
MD5 6153ae3a389cfba4b2fe34025943ec59
SHA1 c5762dbae34261a19ec867ffea81551757373785
SHA512 f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 e76ad387e8aa8790d383a309b38a49ebb0596dbf50320117aa1c867d7b68ce11
MD5 eb696fbcb6b9481dc3da6f8a69073858
SHA1 b89d5b9e5187043fd4c1e78b19063479bd53c95e
SHA512 0fe6d48fa0608158e2e20ea0152cb2e48ad7706bb4744e0dac72e3554712c4b8364b187915fb3962b30e8f7e026bde9a2f4ff64ca80d7998b47f3c9823d910ca
MD5 SHA1 SHA512

Submit Download

Session_13355882131281693

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13355882131281693
Size 1KB
SHA256 6ec3afab2bced6c28d2aaefb22d9f209727febb74fe44d739421f51a59541a7b
MD5 0470f27fcafe758f4a8fbb47ba3df6ca
SHA1 434227d1d8752994e73db1e951f01d460f064338
SHA512 df4fb6b6f00221c86032b3b4cd08dc80131f7e56def0f32935189e195e819cc1c51201f5daa3de07911a55da07ee84b9dcc7f167cc769c7ed606559c724b2c31
MD5 SHA1 SHA512

Submit Download

Tabs_13355882131499693

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355882131499693
Size 1KB
SHA256 bad744ee885b81200fa4f217ac202c87645ddc4337ca60ff452ef30a021e263d
MD5 8d53b0354de2cf5a0a01a63f24c10eec
SHA1 a566650a1b93f852470357cfb5f188e58669ee07
SHA512 3e57147d326d46aadf7de46e908d46ae20687264f4ade3e7fec0fd4f74c5203580ee279eb9814c13df81f6e7f23da49441a344c9f8f25d95c3a1f826a1e8b1ca
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 9e5c8ccfefd280002e319ba2ca4c7663062371224d43b1d97d07eb0c6c67ec14
MD5 18e6e6a6dca7f9e5d3cbf7c87447bd5e
SHA1 569094eadcf9615b663dab6fe8db129ef558f67a
SHA512 01eb75175a153a5fa1cda33e62fd1e5137158b899f0a14cd220a4805499132969f0f5c1d7dff2032a0bfeeb2793e1ce914ec72bf263363d38cc4d99b5d94f3eb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a0caf7ba663f8bd8744a69785153e18b06a260580e7eaacd69074fabcf81acad
MD5 f30c82bfeccf596c5815fb904a4f6f47
SHA1 3877ae649bd140b6e1d821145856d2363b3266a4
SHA512 550b3a2d84952629cfa1a066f712aee943794c21e65739647e1b0246dc802aab3e6fafdb46993d7f4699db64b63cedd46ffb8164a4da6e9c710a7406328617fe
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 d17d3b835846ed4e38d792a1d2c9ce83cb88e6815d6771da31b6900d4f04c55b
MD5 9367496816645c4d4fd79ea5229eda7e
SHA1 db3c1ab21aa1d8a97d9984ff7bea13a61ab7a955
SHA512 30c4323e0730ae941837eefe9593fccb09cf870ee32b889091b3ae7769681382eb161cacd64efe69142eb41900fa8c0ebd33798abf9f87e6bd4fa06cdaeab141
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 272f34f497b8990ec4d3405d09242514a2c23d847bfc65cea7c76314f0d72770
MD5 b9cc32b1fc13b8eee4007a11e79bdbb9
SHA1 ea3408aaef755b474d9b4e28c86989c8a3ab4617
SHA512 5e60a9da54ce24ecda8663465339069ce9b68dd0071e9749234a8b84733e359d209a6c73f564b06cbc4c2836da4592d47997630d5e589008bce52fca14c490ac
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fc61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc61.TMP
Size 1KB
SHA256 e4b58cf287211dc98cff1c0dee4648d12f60929bd6f150474740b5f3723670d2
MD5 a5f3b319f8f1ad0223550da56f29b96a
SHA1 9c8357197d96269f8cdde0f38b356f9d97b2b080
SHA512 b05f8f7d51843074dc52c9d6b7a5f6316a2f035357a77ffd0406180be59614a3826250e69e2173e5cee8b7401ceb59e52e9c0484e04881224e6a0af45c87b6cc
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 c9138474d7915d004025b33734302cb8eb10e73c613f04519a74ac128fd991a0
MD5 2da293829ffec7459a09429b33899f13
SHA1 78fd8360144ee9bce16c05dd4faf9e3f4400f6e2
SHA512 3b903e397241abfcc2a5cee5537038f6aef3ba6ef69e755ffee10a75fc1e24f5da139b8071fbb8b988b11246103fa1314cc445ab3dd5ba10272f5ec53cda202e
SSDEEP 24:TS4UYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy859+VvFalhy1AiV83hytYLAlcI5U:TtUYVAKAFXX+C9+5FYhy1NMhytFlcEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 2d3ddb21e6665eca597729c6197fd00d204fa56b254dc95791a2b245be81545a
MD5 e9e0860e29ba9a92762ca5fdfeac7cd1
SHA1 ea13ca1faec42a4e30175e12cb8efc39237cc051
SHA512 79a01c1439cc07dd58523e6b657acaf19d5d870a662eb958782fd754264c07c878d342e4de55c28ba93982657db1b3d5d5a95c271143b27adb679451598e2a48
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 565B
SHA256 218e73d1cc5296bbf8382d9951d4ce0740edb39dee874b2b93e1e3c34115440d
MD5 dbb805a0ebd21bca3d0aa93ccd995326
SHA1 d839471308547b9fba1fdb2d4d9a120df099367b
SHA512 878fffc094ed461d24088ec641c317044cbd25deb24dc19d2c24d5d90104819c1c45e9d65aee4a188969ecd4ff98a20b93db13e877e024079cc5e8016a4ba879
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 b347f437676970933e267cd98423410cee4700ed669e9261cfabc8e6472e3841
MD5 95e7546814a901c6604def471abaf20a
SHA1 3726aa863a618172ecbf44e8a63f629bc7124f34
SHA512 94592c3647c6f8f2a8d8339183df17bac6b3bc55c31070c581deeda644d22aeb2c40ab2617083e9401ee70fdb479ff1b63a1117fd0d7306f9474fb3ad27dd27e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 4689ece9c513548df1954781f8c8a52aec1e648025a0e7ded7ef173e4c6617d9
MD5 f916c9ab4a7cfe7ab8b8e85a8efced1e
SHA1 845bb11e2834f5edfaa819ff5496f6787eea39c5
SHA512 e920fb7c5a48004755cce951ad0f055200e5d1405c1a23d6637511ff8de9cd93ca09668d19148ba09c45d45922968e342e7911346d214f18870683797d0e48ab
SSDEEP 24:dMlwEzNVQrjK83Hr/rod+qsA+gFPhvgankELAaMlTCE:ilfVaLzTSGkkfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 7fe32db7cb996736c847663b33311c6b6b2108a96bb8dd123b843f05d9bf2555
MD5 45910753ac242d5975bda44834a028d6
SHA1 594c177e7ca5cea6358f25b5c2a235e2946a0969
SHA512 5c7d45c63a54f80c780e8ac473c473d4af50d2b056f813b2bd1f490b9207950947ff0911117c58194dee96f987491ab84d04bad703547836a3a13bf0e0c06fa7
SSDEEP 96:cCjSZrjSIjSdijSdmjS7MjSGVCwjSG0VjSdkjSGTjS9jSjZXjS7MjSD42jS/mVjf:clQ+CHpr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 3e475872858b54744979dcc1423c6db18352563abd4f1f6094f10e9ae35f0c5a
MD5 e96766daa3331936f0c90e15f0cf5012
SHA1 7e5f93a703b757062c79a3dd47efc705112bf215
SHA512 4cd6032db04e814d7f462be65ef47a35d75715ab88d152e8344c2a538416ff7498803609d8cf42973b74edf99a26a3a8243427b7577992a7a3211fd18548d3f2
SSDEEP 1536:UI82vNFtYNDHheZDil8JMKjloJURO6VOk0uuxzJYm9qLXW1MQ+qr3Rlu15hJl6zx:UubtoeZDhn26OQ0uur3LLF+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 22KB
SHA256 4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e
MD5 1ac9e744574f723e217fb139ef1e86a9
SHA1 4194dce485bd10f2a030d2499da5c796dd12630f
SHA512 b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109
SSDEEP 192:NY5VVWBObOIXjv7nenqWXF14yEQ0yJq8lnRe8/kLog15n6ZbPPoSYp9gZY7Aemaq:NY0VIpWCqJq8l7kLpnqJYpCTem
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 093a98966d059d80bb512bcf1aaa1c89697f020b5d8b1726c4f6eb03fc8adc8c
MD5 4226fcc4094febefe5740e828ce98c97
SHA1 24a91e1cee9735536a54208425ec2d86dba46ed1
SHA512 15d70595684917121234990d33156ceac76e779a0acd68cedca442193e00f7ca80856312d3cfa060756f8007d8ed3fef79bfe02dc4eab6850135c7c69cd25e15
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR4KIe2RU+6cNvbqrMIQJUm:+9iIxuERzA83h09RZxYR4KmZ6k+rMIeD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dc33ea5ef2bb355351b69a878ea91da17d6b6bc113005c2b33c131adac12f409
MD5 e5438d83ca97af93c85789d10a56451c
SHA1 c4f1641fb16708efac1fed7f0f65b73ae798076e
SHA512 7249d30b2b79a31655f6136ee704a005aab68b8778307272143c88353f97418dad4746f4518fa5463ca8c5b5dbb2d69f69a28def5ee8a3229a85e056c0907991
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT3IfI/2RU1zcNvbbrZlIQ0:A9iIxuERzA83h09RZxYT3Ifp0zkfrZl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b955fd93-9c49-44bd-832f-1ae28f38be8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b955fd93-9c49-44bd-832f-1ae28f38be8f.tmp
Size 11KB
SHA256 1b82b23d08e152ab8efc819f521383f3e3d91704c6f4a9bbb0e4ab1ea1682d8e
MD5 9992e46d676aed4f2c56fa00bcc99da2
SHA1 9c5fc6bf5e168542fa994788171467e720e4ce01
SHA512 df4b42587fb4319e44b025034eca23c609f584fac3203d171e6b8534a0a513b9bc9f0f0e2bef256b1961843cfa71ac8ddb80f2d00d52f94362c5d3a0f4452c47
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT3IfI/2RU+mTeSKvbbrEl4:29iIxuERzA83h09RZxYT3IfpZmTeBfrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 3287f67682ab9db9e9f2d87292a2a7667684c7240f60269fa058ee89ecc66123
MD5 bcc8df82118ba7dbc4c540e3e019cb03
SHA1 9dea839d276f4726f86384abf5a59f6b5f05c42a
SHA512 ef2aa870df8e1795c3429df9764a5c5608aee115e5d254314f25fd14b88492ad8fe186e7f03f1b59b31cb656723413c28b935270a4e7c47870f819c3953008df
MD5 SHA1 SHA512

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 7b8eee956011d0d6ecd47559dbd982b0b8df1ca03d861d205d5e910f866eb653
MD5 a6a0e095e651dfd605e75d616482990d
SHA1 b26a8a6a8ccf6f331f3cf17716d23bcf69d77100
SHA512 18f98f09d80aeb5155e1b3f8301827b6f9d197b92d4138050fe505452b5ca6c12cc395da018c171fd55ac6c43dd49fdae70607b0bbdc1b84d65b512cadd8d35b
SSDEEP 96:I7Y8xI90c2qLSzWhuvsqH2QUIKXXeJYMT594:I7LlcKzAGqQUnXuJYMT52
MD5 SHA1 SHA512 SSDEEP

Submit Download

Admin.bmp

Path C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Size 512KB
SHA256 185e0a18fabaffad4052d0cc39abdefa5170f11e95c4e3fb1b4789777748b64f
MD5 0c6c537df1c67ad6de2fc7bc65c49307
SHA1 fb0843c0b35551be1c5fe8c174357243dfe93cd1
SHA512 8b90b6d1e4020c80990df97628e319546782c82ae2f30f3f61742f69f6cdfa930b1b75ffaa964a25498cb98be1f1e67f47743b91a5eff30d357e5cc040a635b7
SSDEEP 192:hea40TugkKyauaoIO6AaiMGmWIeQ6wO3eTiwmzWzsAWyk2QgO:hMnqGKO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1589.tmp.jpg

Path C:\Users\Admin\AppData\Local\Temp\tmp1589.tmp.jpg
Size 76KB
SHA256 8877e7423e0eaaa5403e96c981619b57e1a82bb254e6ffc72449876eabfe989f
MD5 f88209d50b1072a7c847d54bf606521c
SHA1 ca3cf54b53fc81d471433dc73d72d18c16142f14
SHA512 028fd09863cddd0997ef3d3d243c90fdff334c4f653a9353ebf030e2b06518259c221611433d876762543a7669a1eb1f6121e80cfd863b4d4625237baa6c5c9b
SSDEEP 1536:hteftsaImhCUeI+4WUf9QjNotOAqNTD4U2GVIF+RHup6S+qhD:refnU8eR1NTD55JuF1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5168.tmp.jpg

Path C:\Users\Admin\AppData\Local\Temp\tmp5168.tmp.jpg
Size 147KB
SHA256 6315252de63de98413c0404a86a1fdcdf998728bc7b2a1e6d23b84914aee5aaa
MD5 7d2f38ca4bec0124cfefafafe9deccaf
SHA1 f7a46510d260df4f5afdf6fbb3d6815a9e9c7ee3
SHA512 545e0df0639fecb34427cac8188a7313650042bc79903aba04e97e82df26cddc9c8a574934452bc7f41f622d2ecda25a76bac42c74c9c88f730d863e2dbe9441
SSDEEP 3072:O17MGBaMEFGtn9NHlvxttM3fMBIfxK/U9FcLJut41E6pjPB:OfaMEod9NVxfMUmxKsULJuteBB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp9856.tmp.png

Path C:\Users\Admin\AppData\Local\Temp\tmp9856.tmp.png
Size 39KB
SHA256 96487209d8bd5d5c8b92b2cef8d8ac27211a422717c2e819e68a3eec5b324ff3
MD5 2a801dbd22a79636b9f34635c79ccb8f
SHA1 5a40990c64ced4330cf06af7b2e2a4a8ccdd3cba
SHA512 bee135856c35c4b1b70e4c56280d7932f264bf887d3860cfc6cd7ad7f46a8f5a43ca6318a0bfa67e4b08192e10a538e747df03c13b1d3aaad5bfb7239aa5c7ef
SSDEEP 768:sQ+tslYkI0C+5oZg2+gYhSonb3vOBVJhNMsvr/DuoIZ+4//6o1rQZ4ew/ifJ2:sQ+YBZO+nSa/OJc7Z3ioBrb/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB73A.tmp.jpg

Path C:\Users\Admin\AppData\Local\Temp\tmpB73A.tmp.jpg
Size 9KB
SHA256 d82cb54f18a61a31a09822f8dcc081d1525c05949a6d2f38b9250d41b992cd7b
MD5 38c7c8b268063c394b9ffbdf6c90fe2a
SHA1 c59dde20c7630277528b38c221e0abf1601d7076
SHA512 13ee117c8f7fc2424c0049a78243b79d6762b1f2b69cc19a61a89fed630d63ea725eccc7adcdf4eeed9617d60b936ed7882cf94d2e1350ddd4b488e856dd8294
SSDEEP 192:XbaDu0aqZR90G5cHnRICCRC/W9SPmuJAPBeT13vH+thv1kToSzeQ8:LaDu0aqZ4G4ICCciSPmuiPBeTJHiv1kE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-650-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/1048-632-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2296-741-0x0000029CCF660000-0x0000029CCFA24000-memory.dmp

Download

memory/2564-615-0x0000000000460000-0x0000000000520000-memory.dmp

Download

memory/2564-616-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2564-618-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2760-649-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2760-635-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2868-659-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-671-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-651-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2868-658-0x00007FFD44440000-0x00007FFD44F01000-memory.dmp

Download

memory/2868-660-0x00007FFD44440000-0x00007FFD44F01000-memory.dmp

Download

memory/2868-728-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-727-0x000000001AC70000-0x000000001AC7A000-memory.dmp

Download

memory/2868-726-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-725-0x000000001A920000-0x000000001A92A000-memory.dmp

Download

memory/2868-703-0x00000000213C0000-0x0000000021442000-memory.dmp

Download

memory/2868-673-0x0000000001130000-0x000000000113A000-memory.dmp

Download

memory/2868-672-0x00000000010A0000-0x00000000010B2000-memory.dmp

Download

memory/2868-634-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/2868-661-0x000000001BD00000-0x000000001BE46000-memory.dmp

Download

memory/2868-670-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-669-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/2868-667-0x000000001B8F0000-0x000000001B900000-memory.dmp

Download

memory/3132-621-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/3132-622-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/3340-656-0x00007FFD44440000-0x00007FFD44F01000-memory.dmp

Download

memory/3340-657-0x00007FFD44440000-0x00007FFD44F01000-memory.dmp

Download

memory/3556-639-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/3556-648-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/3556-623-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/4592-645-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/4592-647-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/4592-624-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5076-638-0x000000001B6D0000-0x000000001B6EE000-memory.dmp

Download

memory/5076-655-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5076-653-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/5076-652-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/5076-318-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5076-0-0x0000000000920000-0x0000000000940000-memory.dmp

Download

memory/5076-151-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/5076-646-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/5076-1-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5076-640-0x0000000002B20000-0x0000000002B2A000-memory.dmp

Download

memory/5076-637-0x0000000001160000-0x000000000116C000-memory.dmp

Download

memory/5076-636-0x000000001CC00000-0x000000001CC76000-memory.dmp

Download

memory/5076-448-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/5124-631-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5124-619-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5124-625-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5216-628-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5216-626-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5400-608-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-603-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-602-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-601-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-612-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-610-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-613-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-611-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-607-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5400-609-0x0000024EFFF90000-0x0000024EFFF91000-memory.dmp

Download

memory/5528-629-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/5528-627-0x00007FFD45910000-0x00007FFD463D1000-memory.dmp

Download

memory/6024-722-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download

memory/6024-723-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/6024-721-0x00000000052D0000-0x00000000052DA000-memory.dmp

Download

memory/6024-720-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/6024-719-0x0000000005130000-0x00000000051C2000-memory.dmp

Download

memory/6024-729-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download

memory/6024-718-0x0000000005640000-0x0000000005BE4000-memory.dmp

Download

memory/6024-717-0x0000000000020000-0x0000000000780000-memory.dmp

Download

memory/6024-716-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download