538dd553c5c9e064cbdea35488d231a5ac1a269971c10ff9edd832ee4c3831d0

Resubmissions

26/03/2024, 23:58

240326-31d1dafc263

26/03/2024, 23:55

25/03/2024, 23:41

25/03/2024, 23:38

25/03/2024, 23:14

25/03/2024, 22:57

25/03/2024, 22:54

25/03/2024, 22:53

Analysis

max time kernel
785s
max time network
789s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MegaBoyVM.exe
Size 102KB
Sample240325-3pykmsdf4y
SHA256 8a16e748ca24d7f8a5205501fd381cef33c6bbbb2e715abf6b91f486ad6afd2d
MD5 f0de1a04aa9ee6d1e8d6fb391ce10034
SHA1 e0ccf4a81f920997b5f2dbb7209844491e774647
SHA512 12818c13cb4084dcfdf0c804ef95eb0c131d71a2ddc1323eee35dbf1848f140bbd24f6e5e6265629eabf5de46ae8cb2e74eb42016e285dbcef7314e4063fe5ab
SSDEEP 1536:3yU9NZjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCB8u4jx9bSHACiH:CwNeN3w/jhlhE1Z8Nig9L8u4N9bSE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	MegaBoyVM.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	MegaBoyVM.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
4700	tasklist.exe
716	tasklist.exe
2124	tasklist.exe
5600	tasklist.exe
2928	tasklist.exe
1280	tasklist.exe
1712	tasklist.exe
4200	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
5864	taskkill.exe
6016	taskkill.exe
2656	taskkill.exe
1956	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004a6b2c30d55de341b3e799a3c014a78200000000020000000000106600000001000020000000edc58e27c9630f719e88a677a8a96b61e0df776d2c0746f6fb4c2659136dd52c000000000e80000000020000200000002ebee1987ac355c2c2a8c1e647f175a84f275562026c6b1a772eb976a4ce2db6200000000d8658fc5ec10717e614c839d772552b7a519dd4b7ac7e8d164192b63288865940000000a3fd9621d5362f3e13742419fb8760d5fa96cb0b30b93846269d0ea0d99cba3d0c6cc0b10e929f0fc212cbac4021ce14cc4934996ef79254211b8dc7e1bc25b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31096591"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3762508163"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31096591"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c4d3e10f7fda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004a6b2c30d55de341b3e799a3c014a7820000000002000000000010660000000100002000000074352b4088278f94ac032ecfce4736c1ef2bb52940e9d193a956d206faf4754c000000000e8000000002000020000000324448123b638e5aba879c3a8453775c8626efc7bb77e2db1d4a6d0aeb05f26c200000009c0461f8c61aa59e0c438a8fe860bce2e3fd68dcf5ede827486e15fa56d88df5400000009daae7e038f8f56c953ae46a71ce870560d37345645414a2dff0503f82f367c6939eefc7604dd23ed3818c9e73d58b884b7afe70996701e694b9e6d134842391	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06cc5e10f7fda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3762508163"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0BDC2816-EB03-11EE-B49E-D65EEEF40ABB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell\Open	MegaBoyVM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile	MegaBoyVM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{C22B6BAF-93E1-4988-8367-B93F24F78338}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell\Open	MegaBoyVM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell\Open\command\ = "cmd.exe /k START C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaBoyVM.exe & EXIT"	MegaBoyVM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell\Open\command	MegaBoyVM.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell\Open\command	MegaBoyVM.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile	MegaBoyVM.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell	MegaBoyVM.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\mscfile\Shell	MegaBoyVM.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3272	msedge.exe
3272	msedge.exe
3068	msedge.exe
3068	msedge.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
5232	identity_helper.exe
5232	identity_helper.exe
1688	msedge.exe
1688	msedge.exe
1844	msedge.exe
1844	msedge.exe
960	msedge.exe
960	msedge.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	MegaBoyVM.exe
Token: SeDebugPrivilege	4500	MegaBoyVM.exe
Token: SeDebugPrivilege	2368	MegaBoyVM.exe
Token: SeDebugPrivilege	4624	MegaBoyVM.exe
Token: 33	1368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1368	AUDIODG.EXE
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	5600	tasklist.exe
Token: SeDebugPrivilege	2928	tasklist.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeDebugPrivilege	1712	tasklist.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	4200	tasklist.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeSecurityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: 33	5948	mmc.exe
Token: SeIncBasePriorityPrivilege	5948	mmc.exe
Token: SeSecurityPrivilege	5948	mmc.exe
Token: SeDebugPrivilege	716	tasklist.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
3948	MegaBoyVM.exe
2884	iexplore.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5948	mmc.exe
5948	mmc.exe
2884	iexplore.exe
2884	iexplore.exe
6080	IEXPLORE.EXE
6080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2024	3068	msedge.exe	126
PID 3068 wrote to memory of 2024	3068	msedge.exe	126
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 4060	3068	msedge.exe	127
PID 3068 wrote to memory of 3272	3068	msedge.exe	128
PID 3068 wrote to memory of 3272	3068	msedge.exe	128
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129
PID 3068 wrote to memory of 4836	3068	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3948
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:2536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:2040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:1364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:4092
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\windows\system32\eventvwr.exe
  "C:\windows\system32\eventvwr.exe"
  2⤵
  PID:2020
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:2824

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:1844

C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyVM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe
"C:\Users\Admin\AppData\Local\Temp\MegaBoyNVM.exe"
1⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa9f6846f8,0x7ffa9f684708,0x7ffa9f684718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1033045009160558220,18238258877702017953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9f6846f8,0x7ffa9f684708,0x7ffa9f684718
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,8455019391259346666,17216948620043745779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,8455019391259346666,17216948620043745779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,8455019391259346666,17216948620043745779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8455019391259346666,17216948620043745779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,8455019391259346666,17216948620043745779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5744
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2156
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5600

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3740
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2928

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3648

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4712
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1280

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1820
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1712

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4088
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4200

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1484
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226141837_002_dotnet_host_6.0.25_win_x64.msi.log
1⤵
PID:5028

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226141837_002_dotnet_host_6.0.25_win_x64.msi.log
1⤵
PID:5548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SendStep.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:6080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MegaBoyNVM.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MegaBoyNVM.exe.log
Size 871B
SHA256 7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
MD5 386677f585908a33791517dfc2317f88
SHA1 2e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA512 876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
MD5 a774512b00820b61a51258335097b2c9
SHA1 38c28d1ea3907a1af6c0443255ab610dd9285095
SHA512 ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
MD5 fd7944a4ff1be37517983ffaf5700b11
SHA1 c4287796d78e00969af85b7e16a2d04230961240
SHA512 28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 06c050115272d0e2f48455e4be239ac79de1abf6584fc73ec979369a8ae91170
MD5 af89932625523dbc750e3693c0ad7546
SHA1 3ce9614269bfbcd86899c76dedd736531e662385
SHA512 6dadab7ea972dd98bd9c1f5e08df302c4a394206c6648a7a695dbaaa3cb4b966c909d92e2251ea4b87420fb048660956d76576f438381a5f6525d23aa7f30222
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 31842a5f7de5079c3fc41219455ec67a3c086e33af44861ac84c44ff4a91b4ed
MD5 dcda8b707ed2a9bc1854d2d7819fa28a
SHA1 2f736011c66fa9e26af6c0b2dec96238753e5bca
SHA512 f894123917b0e85f65631ad0e605451878e9a86855a7569961ad6c149ada0fc5210e14246154d790788638d4b40be6908195d797ebc67f3f26581d00ab296cfa
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 dab4f718d096bb510b747cf0b3f7d52d29f08cc032c9efe31a5cb87013fb606a
MD5 e27c9cc79e5925b55c4724b311bef624
SHA1 3dc539ecb88d50a78058c2174e18aa80ec8496ac
SHA512 8a28033a0b61acd4377036bcf4022ff067fe2ef4ff1ba1c2981c4fd32c098104202d4b4f5c604d52578044a89f41f4daca4f75b814c4e8a683a3ab76b147dd04
SSDEEP 384:AJQxNe97HHvB/3xc/nYJgCVdQvIa+/ZI8RdSIPtFY0FCK8S4a:iQ7eI8meYjm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 4fc9482ed5c469d8717f0d9e0e8fd59c40f2f527a11b63d1b6a60962a85035df
MD5 6ac4e45668fd123c51eb264d004fcdd8
SHA1 191085d0211125190a89b6cb7d2e1334bf0a9976
SHA512 f690efd6716e92efc1c691e02830bd3e16bae9fdec3c13d60a0b2e938f20ba0394a6723712c3a8e0dbde83f0e64a7ef589a15f1efc23fc96b308bd20b04303a9
SSDEEP 1536:sm+GXnuZi1QpT8BMyrf5w6+LmcRux5QKNKSaWblCn0XWsBJglOPZUho0KSSX:fxcsx5Q4RaW5muurKSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 b93224aab1374ed41e82540a712edba5beb9b63e59814332281a2d79be10d89b
MD5 2365e612eb58dd728c8997a07dd09f8d
SHA1 ddd9198444ea0ee3a591fc5a230f6a04a6765363
SHA512 4abb794f22140fd8b8ff29fdddda6eecb82987c888c2f1db1bd1f8f30dc51bc729561f627bfa74bbc72d48486fad61690681534e6be1ad226ca774eb2e354f7f
SSDEEP 3072:8XuofhImFzf/dolto9TeIrsas4s2Qz4u:chrjKmKIrsas4s26
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Size 4.0MB
SHA256 ee4111b8160570b75bd184280559fac9040dfbe15cb510ee98bcb10bc0361fcc
MD5 077eb9a5b99642c6eab80c6f9d5cff6c
SHA1 95c0a6c55d3204692b1cd313d5d39568952d5e7d
SHA512 dc48e4a5d4311dcbffba08d6f2be8b67a82feb539421723b083a05c448222904ad8ac532524c101d524cbdc56b920150aab18852a3152503a062650247f67290
SSDEEP 6144:YjhKMnEWk7223BYDkSrBPAyNRb+o6i0wmDu+kp2dfWCpJLc+UKuhliUwnnCbV:+rPeovKuILpjmaCb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 34KB
SHA256 1d98076cfae6a0a8f0b0b1c654270b900de83e633cc01d98ef63e6a8e485a3f4
MD5 02214b097305a8302b21e630fa201576
SHA1 90c2a31521803b73e847f7a3e0cfceec84df9fa5
SHA512 553c81eb51880f83b9918aef766ff0f41170895b1cda2589f0b69c3d1362de8e8decf14a413f6b5df1fb7ce07fc939211407b29046188b37c290133c9d5e1cd4
SSDEEP 768:48fHuXvNmk1K9ShJQmjhekGFPc9jqNwgJx9:dfHY4qOE6mzB9Rg/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 69KB
SHA256 3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
MD5 a127a49f49671771565e01d883a5e4fa
SHA1 09ec098e238b34c09406628c6bee1b81472fc003
SHA512 61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
SSDEEP 1536:O76VBiDmGlrMd/+kdwYZwLnUU+wI8jDfqyToN:O7bm+romkd1qUU+w5Df9E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c9864077a1030bfaf09bb6af20775641beea65bb6e85380c0b4a13136f37050f
MD5 3142954be41643ef94808a78793b1af3
SHA1 4dc7528f1facad50da8da5e8be8f72176c2c1b86
SHA512 38cb1ddcb6ffeb9f5bccc3e27253a2b95e21fa775e0272ac547b6260e021943f96b5847ff7fb10d79027289692f84f3dc524501801bf6c9f37e307931d5c8eff
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 20KB
SHA256 60f49bbc13963ec9254c0fac393612e1adf07f6a92d782946576ef4aca2a226d
MD5 8660afef0fd55f43763bb14e56dbb69a
SHA1 4a7e5f465cb4e1a6fa12e3b560da1ebf46da2ac3
SHA512 3b29eb5b0914317d63523e452de018c99b0e3883e745588d87c83c40fede434b9ada31373791fa7cdb695bec7d535f5c34e9f177f288a20f2f353aaaca9e4204
SSDEEP 96:oNwCz2TssRs0enXUErdL0Zhbs+1nv7sjsX2d:ouZTwXU+kRs+N32d
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 098021705ff56ea5af00e26f261bd7f5145f976d039939106b6ed12650337394
MD5 656b45c383fdd44d6be6520b5cb0814e
SHA1 44f7219bcb8703e655bbd34f451e99af9f746921
SHA512 38aa8d6e5defaa14deb33e7738cefd7cec526efe543f21fd9acda78d5baad45c3f1990e85ae48ae735098906a545f7feb52f3a7968ed4d4d477489b5e2f3df83
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 a7ca7e6157db8132f16337c91d4edc71cff8e1c35411ba703c59fe42b15fdac9
MD5 cb0f6d8d739a2b0169440586a2918c5f
SHA1 a273571888e42bea95c4f40b71a9bf13b256b8b9
SHA512 e300fa342f86eb1d9635748994bb95b1b1caf8c58a33d1eba10e26a1a6edee798e1399d07c8b4759b2f64fc5f47a6549d6e76a02b8b1f65affc26f2a031f3b94
SSDEEP 48:NBmw6fU1zCJO2ruNEI1XZJlruNErZuNkJkd6ib5zPWDMv9IgXU+dAdUO/q5vvRbd:NBCt/qNHqNiTkgSZ9TXO/A8KPhnEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 1e70c10cf6224bf918bc33b9238c3edfe2dfa4ca7d349c0b40cf604e4baef455
MD5 9294cd557b941e63356ed46df82a1c26
SHA1 32b794e2e7dda65bcd0b9ffd3e7a52813c3d673f
SHA512 532f1e6ee8bf70d6e30a365d7dc1507f8a1c2dbb9776b6b8c9ee7d020afe89afdf367feb0321212bc71a6558411e90e602369a5a4f2ed8c11f3922096868ce59
SSDEEP 96:xfqNDbEU+bDoYysX0uhnyTpvVjN9DLjGQLBE3uRqNY:xf0bD+bDo3irhnyTpvVj3XBBE3uRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 2KB
SHA256 3951b58b58bf61d150ec540f00e5c1e0917cb67ea3818b9643f64f65710b65c1
MD5 da03a1f671db8d305f59b794522e947a
SHA1 08817a9cfb239688a9ef61695e866ba041e18d2f
SHA512 688c5c4b2c9d278e9d2fda385f4cc8a5d3b5f88c1d1c47e246fecbbf07cfd58e968276ccac3c6b6456cecaeb4cec002f553fa2a1ae45daf984c8f8589d4adc4e
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 131B
SHA256 f1c3b3074827c1ae24fa55ca620dac102e76f54f90d6c7e82f19bfa0c4225afb
MD5 8f9ed67ebbc395ccd6d0bd6f125e613b
SHA1 d9148f2046b4222689e5741b3f5a2d4a3cf7e2a8
SHA512 22601f8a0fdd37ac229bc654e664cce21ff450996e3d0c33895b9d667578c539b829b781a3f00c793407fc5a1adf89e15975a6ad8862f73fa2f00c3e9ee43f5e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9cf4c34c6ea767e9a31cd22192822b91263e5f9a321e43773e91b261f1c1df06
MD5 2e9c3c4a25bc0651b6fb89c68036b2c4
SHA1 2d9b2ce8a2e3d604bb6c3c8f0969085a12926f2f
SHA512 581cfea94af72e1d0be98354bfadfe1080a9a7edbbb8a47ace23f0b61611f821aea0754fd6826d97970c6f1eae6b53af3308713a0c122d432819718773cae9ca
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 484B
SHA256 18634c830774d53185a2ccad8af21d0051b5609f67fe926d1a828a52666325f6
MD5 c0f67f4f373f2ae180fb7c66289f0fba
SHA1 6f8c13bcb2919f1110f874538d04ff185dc5812e
SHA512 80d2f5b1e49a5702641c5f9ca6e3aebbc5cd4a6a9fc126becf949421ddcf506ebe2b5b5c07faf4b70e918981582a6d91a9779e5dee47f4552d16467882c59c60
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 484B
SHA256 b54f2e343c7a595bccabb76ad4d627d99e17b3c8460465b8e5661145691163f8
MD5 cb3c43deb07c0f689883c3676d332414
SHA1 303ed3dc5abdc8e728cfdc4e54438731bf0563d3
SHA512 13880236672f4ac8984681b57cc0a74b21257f8d30d2b396415ffe39ee7f0438cfa4872d050cb279ffbe7630ff6a76d6119cfbea9a5ccc2ff9366b15ec2ddb58
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 95c3a928118c12b4de3cc24c56dc686da1cfebc548f5b2ee6c0d26f8ac44bd0e
MD5 6ba82c5c6e8bc034a52f259fd3fb2b71
SHA1 452d294e7283e1ba299f437501d2a68c9d76a209
SHA512 68fbc3a4bb7e9f442c893bc152c9c95064594a2d0d7e24884ebde693681cc1125aff4a6436031442b69672c5d2f63320e72944dac11149231f83881ce9509533
SSDEEP 96:n6+Wk/K+/1mp0wpvWMoiVmdeHI/r+ZS+6UWQyV+VD7ziEwb:n6+WkC+/Ep0GWMX4+ZS+6rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 25b52a703c3120dcde7ced8281f5df2970ffecb785b2ecd2cb64c4f48ff6e070
MD5 b154cb2813549c947dfca9dc9aeacbec
SHA1 cb096e0cba11b28a1510ae653bea1a63c8a0acd3
SHA512 1a55ba17e6991c55deb6791a37193bd12a506aea970500ff5b00a6b1bb1435fc553baa7cd7bb1cb5c4c2a3ebdfa9503d6c03d905f182c9727a161986682bd568
SSDEEP 96:n6+WkgK+/1mp0wpvWMoiVmdeHI/r+ZS+6UWQyV+VD7AiEwb:n6+WkZ+/Ep0GWMX4+ZS+6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3dc9cd410a1bfb68446bfa9debf119ceee6b4affc09ba446df1bc7c9a19b4c75
MD5 565d377f0f8d86c7684a8ac3237e195f
SHA1 b638c121358e784c69d8a9d9678b116ce998a0e6
SHA512 d323247ab2988d6084cc75a1592c787571906df174bb1ed12cf32eb8e4669bf1e01c386de60c8b98a6ec0ecfa3d1ccb36137936bdb384a7bcf174475005190b6
SSDEEP 192:n6+WkG3+/A30GWMX+E9+luxghO+p0+ZS+/+Flg:n6+WP3+/ARWm+k+ggQ+q+c+/+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3f47e725954bc57600ce35d8cf785a5d857152db491cbd3540bf7d5ed5593458
MD5 63b5c32ff92bebdc6a5be992f4bb75e8
SHA1 575e9bf66341226a9e4ba0e316338b9bf3f5283e
SHA512 1630bae9739871137f20a459c5df22ccb4de9322a33dca7f6fc74d03c623b2317a0f2b9d82de961c7b114615b1c22a03e1d6857ba85b177f5ffef438928ad9db
SSDEEP 192:n6+WkIk+/K90GWMX+E9+luxghO+f+ZS+/+2+I++hlg:n6+WFk+/KrWm+k+ggQ+f+c+/+2+I++Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ccd48b09fd04c70c76f8757880582b0bd4597cd3a5de09e0bebd0120ce49dcb2
MD5 453e4b04a083626e781279d9ca6518f5
SHA1 e10b26a677ebde90f880ae4b5831a8fe6bf6b1de
SHA512 5137ff4730c937087e19ff83ebbfff0c18542dd28bcfeb55ae7079d17260df93628ae31ce4b65344d97027592cc09e7fa919b7edcbbc9af6f4db451658663f66
SSDEEP 192:n6+WkU3+/K30GWMX+E9+luxghv+p0+ZS+/+2+Krt:n6+WX3+/KRWm+k+ggd+q+c+/+2++
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL
Size 36KB
SHA256 c2c3d966608c81cd12c4f9c74d043168996a5fcac9fa911849f12e601ef765cb
MD5 5f0e3988cbd0efe8d96fa4da5c5e6bae
SHA1 e0d8a153b327016666718a2997d779982e469884
SHA512 208df350f8df5eceb2621f599c9599bb8715e0ef5859ad1c7b67ade30770952d330f74ca47f00f5ebe2ddeeb2f4f7abd763da8aa9646a2a5f6cbdade69764eac
SSDEEP 96:AIEumQv8m1ccnvS6nstsUIGuVs5TnjsEQ/R5sxGmmsvQG:AIEumQv8m1ccnvS6A2kjZiAt1R
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 175B
SHA256 93c2b2b9ce1d2a2f28fac5aadc19c713b567df08eaeef4167b6543a1cd094a61
MD5 6153ae3a389cfba4b2fe34025943ec59
SHA1 c5762dbae34261a19ec867ffea81551757373785
SHA512 f2367664799162966368c4a480df6eb4205522eaae32d861217ba8ed7cfabacbfbb0f7c66433ff6d31ec9638da66e727e04c2239d7c6a0d5fd3356230e09ab6c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 3eeb8cfaf5706926b64edfea2a6f7138b4fd7549565d737648b0027924f5458b
MD5 f5b714c740b512a29d524bb56ce74d43
SHA1 437e05074992980020c29bf5115b72e771d719ea
SHA512 1bafd20590fdfed527adb9120d93cdb18ca2526e267d8f547104f7592d45cd17cc0b6a616d4d20b1986705ab5bb1f08c7378f9a7f2ffc2f96da0671eae0d75b5
MD5 SHA1 SHA512

Submit Download

Session_13355883835058266

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13355883835058266
Size 19KB
SHA256 974595650f06164c5431dc7be180bb43918e72eac52042595ef5ae984ff0e37a
MD5 667aa835fe5a875aa4c81b322e06dd3d
SHA1 49638c1650a56d6cdfe744f23c82305bce764357
SHA512 3fb6a93596dcf8fa3843737da5d30ea1b12a7947fff471bd27b1cdb01f98ddd4cd2e4a1e0ea4c2434d92fec25c0b3477c6991ca7cc840fdac05455b480c01e5d
SSDEEP 192:3VmteCSmA0H4eszK5vJ6nPuepq8xDvbXfrVB8WTvefeOTA8sKeqx2v1e:L1asQB6xpqYDTXzrM2OTAHVqx2v1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tabs_13355883835342266

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355883835342266
Size 11KB
SHA256 681f6a459c47bd1be2115d7202bff60a035d260a8946edbe9f45c68042da7b75
MD5 8dca431d47b7b3dbdaefd55f8722eaca
SHA1 82ab649b5222b39d6ad4cbd3d442c0bbdbf1d99f
SHA512 e445cbdc25ae775d12e7b9dfe7bbc1897650f1b6d549545185ed50d569ada0a2bed39b2888a33182748eeebcfb79d4dd3ff2cc642dfa60bf391b4d09e359aeb0
SSDEEP 192:3NEemoepq8xDvbXfrVB8WT7efeOTA8so2v1:CjpqYDTXzrc2OTAHo2v1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 fea193c2ce406ddb146a77291090bf99af48c11a3fa0845446bdd2a5b0d9c32e
MD5 72e01b91d38c01a4bfb2b0a49578daea
SHA1 734265b3771d3a1ec0e33204ae9125a9aff7bc91
SHA512 37171413aca97ce8af94f202743b52854ee2f8ae9a0abf937bad9440da0436f42afe6f94560a54f073c2c262b01259ec3cdc5f6071d0b7c283e512a65026068a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3468d7b2a48f0145d7510ed6afa4d7e182effaf23f367dfc5cc4223e8708f240
MD5 5cf35cea05a5549c87a59fd80a943b75
SHA1 887e4159000c3809da92a8eb36be1b2318b01d98
SHA512 b9d2eff38600cc86ec1198d609805372a3fb9d00d9c92135d3e9ca9a86821b25569f9fbe30490bda50b086bdf9845c77d53ac18ef8fd5169ac392c6730255979
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 536B
SHA256 06995782557406225c95b70141ae581245210382126ff2f8335d6b0a2589b8ec
MD5 887dc3eab7977ec6ef532be61e5912e2
SHA1 4d9547019de3dbe40c019166357a7254410bf246
SHA512 df5557e2e0c142294cc492128662936b4694ee9cc4bb8f5e91b51ed6e3059128477d844e41dfa5a323bc34952d3010d736d71dbdfc7f82f0d4e908814b339803
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 5494df38f721adf383f417886afc70b4b992308c3fad66c712d77495c81bc7bc
MD5 b0dc6a3fbed2f96b8e6f6967b2dfd29e
SHA1 94d32f191d401a3e502c95cbaa224cfb5b32dcca
SHA512 c4bbbeb8209ba897f34e68d367215eb18bf67dc43770940a84f22a530ed4cf1f746147907f608bd7fff8726d2eadfbdc2f341e33319a144aa33a7940f3d53d10
SSDEEP 3:ImtVzoV6o//l/nAUllll:IiVzoUo/tpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 116KB
SHA256 7ba8276ac1dd80a1282a880d43a5c51b6a23d04db3eca653b04823467a367407
MD5 0065d6dd2197cf8e5396ac151f07c7ef
SHA1 55559030d9a6ba932b55a86e4132276ff534a786
SHA512 b0d1bc50656d2d4cc414b8e279c0c1ba76ca8bd32be81a24ff9a2a37d753727900d86f901e47b95777721960eece20ecbf90e75f3409119006adb66fbaa2559c
SSDEEP 192:yTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWambVumQ6W:kPWJ6a9xpnQLqtzKWJn3VumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Size 4KB
SHA256 a641f89a700b0079b522c568e75036b2c5d4b7fdfda76173edcb7198878ff141
MD5 188b6c1de0b410e409ec42ca6b238ade
SHA1 d722082ead1b40c8f4c592d9202dc280d8b3d873
SHA512 da677f52a9ace12d764639b80219ea02a0796edab652fde28dd23b5d0fe11b27443fd10448b3eb50a52ff323c318eb6714b6800854bbe8aa3a468f5db310b7ef
SSDEEP 24:QTZpBPVrJw7dhEYG+kA0FMTALWj5zJTVsu3Br4g6qBBAcEMzkKik1yLb4:QTZ7rw59FlTALWjxJTVsu3BraqdFztbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 efd8b5685f9ab6a3073af12d4d7f7ff85d9882b2e2ac9857a93c36cbe5dfb8fe
MD5 7496aadc980870dd0c3602bb759b3a45
SHA1 d6a1f1825d6a8f39f4f096d8f82c6be68701ab35
SHA512 c4c06b78a31abec2dc1cf03ebeb244a5b97c70ba1bccf8b6f83e35bfbaf1d109d3365d79e78413c8d502de75da0d3c312d9aea0a0169c6ca22854df515d671f8
SSDEEP 48:TtUYVAKAFXX+zoZTPz+s5VyjRfj1hyXb/JnMhy4+s3k0l/qM15lVMEc:4NszoJPasSdyXb2y7sU0l/VVMb
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 206B
SHA256 64a26fdf71af7925da4b641c64d43420b87659b35176ec827eadc268a766c9e1
MD5 3342e43fd862a5f70f8a026e701b4c0b
SHA1 7dc07c27a9440eb7835701800f3acc2dba5da402
SHA512 87768b228cf31cb91a6af72562869dd65f8b498b899e1ea4440705fbab8a8af973c8868adbc3f7da1319370779e5d5fd709f57ed11679257b4ea19e6f15c2c4f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 cbc82b42e96d0ee2c954ff4a6771f8f8e24583ed2b2b17cbf642ae653df11f95
MD5 228393ce163a599c26929919473758ae
SHA1 ede8265875b3dc094e42096f12fdfd7a4d29079e
SHA512 fb0975cf33fd2fed0c761ba18236850f31379b0585109f1ae3ed572907a0716aa84684beb8f082c9c994cde1c8999c8457c5e2d41f6fae3e4114bda49d28208a
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 594B
SHA256 82dea9fdac612cc29e18a087fd8f337445cccb12fb2037ea235b8d7c488caf6d
MD5 633f16723930d8acaedeba05f3780aa5
SHA1 e6274562f707a11c9ea65753977c56e0d8a2319c
SHA512 1184722932cac8a54550b5579f0da2b044f88be6383ae604059679e94de6f4aaa228f9a0485b365cb83ae69fafb9da2986fbe185271d2d03561f4cc6d4203c59
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 c015e3dc65460754d9e1134b7baf5326ad113dddc82f2bf0124dfd671bd8e659
MD5 1ac71b15a368c166ad3bf9f1328568a6
SHA1 8effbd8a33038f0b208cff3aebc384f41b9d0b5e
SHA512 755a8d564bd55e03eccb24787af7bf1febcc71c4b5945c7c1c9db538d7dd9e26346e2951cb35066beee5c931d33ddbcc64d7cae904b90b009a9a85bbdd22a8e7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 4f2ef1b6db122535b5d0a8e04c9c4730b778d1127c601443a70496b0ee759936
MD5 b5aa76b837dc2af3308eed9f44bb4b43
SHA1 0986ea9d4091f4640d86968342ef1ce2f8776724
SHA512 92bcd234d33a08e679f8f155e882321d357d756cae9f0458f8c52928d226a783900edb4bf0e39084b50f34f6ad2c6d81c00961dfd467b30865f4ed6ffdda870c
SSDEEP 24:doIEvqjdnjNlmlR3Pr/yiadVXh7rFqOvn8kEqZi+Wk+v3PH/KRv3s1O3zriwEaWN:9xSBjeXh2kCpZYNKNvZzKQDRkLZyr+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 0c562d4b1fa43e524125f04f769da0e3ee194b4a1cdddb30e329b40798605409
MD5 91b5b20f4f5d6721f475299adcaee90b
SHA1 7ec94837e5e1ad13e7a97e3d0620b81dc22ae75a
SHA512 7bac782e34556b6e6649e54ec32d3824d08e5359cda9b5f5b8d2a0b05dbfe6d1bbf935dbd02af85cce6e413b3c1e5756d46588c9436600f889d3086699bcb1c4
SSDEEP 96:+oHjSGyTjS3djSdPjSdfjS73jSGV5VjSG05jSdyjSG4jSG8jSj1MjS7sjSDBsPjm:ZzyqAJ5GyRtM72pmKg/Ae5Jw
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 410505f920bad1d420dcf5c7c2df494d82ab71fcef1949ce3549795261f5792f
MD5 ff664d4f189ec301118b2d89c28e821f
SHA1 c0604191f2c238402f84ed020f24c17e53fc223d
SHA512 1b9767ac7dae222230583d025af67b12b3ccc3d69e6ffe26af67373faf7778eb92725fdcf26afaa2bb169d8de84625d77e3a30b63257012867973c27c54b7c04
SSDEEP 3072:pubtoeZDhn26OQ0uur3LLFT/vZ32fX9FFldCqKYyJE7AdDOjt0vnylAu86wnO0+t:YtVW03we/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 22KB
SHA256 4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e
MD5 1ac9e744574f723e217fb139ef1e86a9
SHA1 4194dce485bd10f2a030d2499da5c796dd12630f
SHA512 b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109
SSDEEP 192:NY5VVWBObOIXjv7nenqWXF14yEQ0yJq8lnRe8/kLog15n6ZbPPoSYp9gZY7Aemaq:NY0VIpWCqJq8l7kLpnqJYpCTem
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002
Size 17KB
SHA256 6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e
MD5 fc97b88a7ce0b008366cd0260b0321dc
SHA1 4eae02aecb04fa15f0bb62036151fa016e64f7a9
SHA512 889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175
SSDEEP 192:8v7IVdLfOLLIojy32RnoWXF1eyEQ0AJqgMwm96pKR0AU:78IvW4oJvMwm96pKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003
Size 17KB
SHA256 abaded8e235fdf329521806af30a1cc7701eaca3fe2efccb9da760ec6d8e5e4e
MD5 6bc4851424575eaf03ebe2efee6073ab
SHA1 2d014fe2feb929d03a46322645a94556ca5c9e96
SHA512 af3b7d93fa2243475d74d4bd7f918ce2706bf6eca28029b9e49869f5f793e483efaafdfab1fed6306d5fc77a5ed3b27097b27448cd04560bed4df6fa3268ccf9
SSDEEP 192:8v7IVdLfOLLIojy32RnoWXF1eyEQ0gJqgMwm96pKR0KAs:78IvW44JvMwm96pKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dcff4b3a3dafddcd1ef48b12e787340c3ec975504276e40b6b96ebd028cf6ee7
MD5 e89c69bd0862ac6b15d1091655b1b936
SHA1 cf0ce31236b19737c2c970ce7a194403e20fcf1c
SHA512 fd688e0710bfefbc54b98119a2641d0c5faa4717ead056199d14c17b7fe6df74d3d81c394508ecf06ece915508bd7dc3148768a17a1bd71548142ea06979890f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT+Mt+Ye2RU1+7+Zbblr+Ka:A9iIxuERzA83h09RZxYT+m+W0+7+fr+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 41f555ca32a524374d5dfeb35d5f3afa0c47d94eea507e9030d9ceacc27ed881
MD5 f312506b7ef3c4709a6b17df63b5f166
SHA1 50826299f8b6e74bf7de53a452e05afcf3606b01
SHA512 e19c59993505855b2d2f7bbc0378a3d35088772fdf0710ccb4f52b9804146a76fc3653790a1028e634a6fc4275bdb1b4c80605e9513c77ddd2697f6a015b248c
SSDEEP 192:5oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT+Mt+Ye2RU++DT+hSCblrP:l9iIxuERzA83h09RZxYT+m+wZ+DT+hhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cce84e6f283705033cd1b0f099f235ce5cb108dcf6ccef536241d4b49923d0e4
MD5 f3dbabe6211c37622028f6317dad220b
SHA1 7c70606c02f45309f0361989fbe5212f64ece71a
SHA512 1e5472de036da09f05b42d15d354473c68a7fb828800c56fbd421cdabf3559f95a8b1b8fb3323dd2c2791d4f2788ddea47674279e4d49be3694a680a8b8a0de3
SSDEEP 192:xoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT+Vst+Ye2RU++i+hSCbEru:t9iIxuERzA83h09RZxYT+VG+wZ+i+hQa
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 c97f17975ba512a8a029a8a0785db52f637103b90ad272ccb0eebdaf19c925fd
MD5 e9794920be03537f88110814293518af
SHA1 329de7e9203b5009dc00df8563c05149e173cace
SHA512 25a46cbd04d8b8c29bacbbc6175e711bbe5dddfc64a880cc0696d3aca2d622f9ce567227e813cbfbf29c24d30d0d3ecf757043028ed963692554406d3e534dde
MD5 SHA1 SHA512

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 c6cc49185c38a3ac4cbe9a9734bdb0f80b372e9f4ddd3737b48ebc4464e624a2
MD5 947fcdb8f213259d3e3461192a41f6cc
SHA1 15dff80a0e5d87cbf54bada8f1edb33fbbfc7343
SHA512 ea734e76acf8639d25495490e588244401cd65acfc937a79652a789aac45792b31b6bbd64b4b5a26dd228a36db42a33f8dc11a7f418b074839532df01fb6afae
SSDEEP 96:IxYoI0MwlYkha+FQ2KgNR9T3zmoy9m777SO3MuxG2JD:IxbMwlw+FGMx3zmoy0777zMuwED
MD5 SHA1 SHA512 SSDEEP

Submit Download

Admin.bmp

Path C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Size 588KB
SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
MD5 908fa2dfb385771ecf5f8b2b3e7bff16
SHA1 1255fa1edbd2dbbcab6d9eb9f74b7d6783697a58
SHA512 573c9fde441fb8debaa44b6fa2d3763c3dc4714497089b82bedc8ef0720eea4a907f75cffb1c0ec4a77ac89cfecbef8e6182a2a8fea5b51a2e91920ceaad5f69
SSDEEP 192:hea40TugkKyauaoIO6AaiMGmWIeQ6wO3eTiwmzWzsAWyk2QgK:hMnqGKK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1844-13-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/1844-88-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2324-9-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2324-7-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2324-6-0x0000000000900000-0x00000000009C0000-memory.dmp

Download

memory/2368-42-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2368-56-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2368-11-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2824-12-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/2824-66-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3396-15-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3396-16-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3948-471-0x000000001DDF0000-0x000000001DDFC000-memory.dmp

Download

memory/3948-467-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/3948-4-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/3948-478-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3948-73-0x000000001BF20000-0x000000001C066000-memory.dmp

Download

memory/3948-318-0x0000000001290000-0x000000000129A000-memory.dmp

Download

memory/3948-63-0x000000001C940000-0x000000001C9B6000-memory.dmp

Download

memory/3948-0-0x0000000000A30000-0x0000000000A50000-memory.dmp

Download

memory/3948-3-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3948-64-0x0000000001280000-0x000000000128C000-memory.dmp

Download

memory/3948-65-0x0000000002AE0000-0x0000000002AFE000-memory.dmp

Download

memory/3948-2-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/3948-1-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/3948-470-0x000000001C5E0000-0x000000001C5E8000-memory.dmp

Download

memory/3948-463-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/3948-464-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

Download

memory/3948-466-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/3948-469-0x000000001C580000-0x000000001C58A000-memory.dmp

Download

memory/3948-468-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/4500-17-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/4500-5-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/4500-44-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/4624-67-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/4624-14-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/5948-472-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download

memory/5948-474-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-476-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-473-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-477-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-479-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-480-0x00007FF4D98C0000-0x00007FF4D98D0000-memory.dmp

Download

memory/5948-481-0x000000001CD00000-0x000000001CD10000-memory.dmp

Download

memory/5948-486-0x00007FFAA5320000-0x00007FFAA5DE1000-memory.dmp

Download