hxxps://download2388[.]mediafire[.]com/qxhwguq3tylgj0x1u7XSrGsVUnKb8CfiLo6U7voW-zYWUBkttbuPGVuaWbP3Xwb98Ch_anW2e3d7T8bZzObrz3Pcad7-dJSNqiHDa0PzS242gSWjt023LC2IpjlYUg-8EMJAPOR0piZFyKp9pRWL66yfv1Wzlv1wHQugkSfFNsU/jdxff8bsksd7ee9/MegaHack+v5[.]4+SETUP[.]exe

Analysis

max time kernel
75s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://download2388.mediafire.com/qxhwguq3tylgj0x1u7XSrGsVUnKb8CfiLo6U7voW-zYWUBkttbuPGVuaWbP3Xwb98Ch_anW2e3d7T8bZzObrz3Pcad7-dJSNqiHDa0PzS242gSWjt023LC2IpjlYUg-8EMJAPOR0piZFyKp9pRWL66yfv1Wzlv1wHQugkSfFNsU/jdxff8bsksd7ee9/MegaHack+v5.4+SETUP.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3484	MegaHack v5.4 SETUP.exe
1808	MegaHack v5.4 SETUP.tmp
4228	MegaHack.exe

Loads dropped DLL 25 IoCs

pid	Process
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mega Hack\translations\is-1QDB7.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\D3Dcompiler_47.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\Qt5Widgets.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\dlls\sorryforlovingyou.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-9C4FV.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\hacks\is-P5KMK.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-47ISP.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-HJHL3.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-FGH1M.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qjpeg.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-VLP0Q.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-5TJTF.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\imageformats\is-RB7KF.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-KH6E9.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\Qt5Network.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\unins000.dat	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-DOBOJ.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-52LUT.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-3LJ1N.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qwebp.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-DNSE6.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\hacks\is-NV0AA.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\imageformats\is-76NL2.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-TEL2L.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\opengl32sw.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\Qt5Core.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\ssleay32.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\hacks\is-HTU1G.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\imageformats\is-QVMA6.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qtga.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-00N2B.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\dlls\is-LJ3PD.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\imageformats\is-9R00P.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-RD5H2.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-M8I5F.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\libstdc++-6.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\libgcc_s_dw2-1.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qtiff.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-VBDVI.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-GP85J.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-COGU0.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-PQ698.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-COC5G.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\bearer\qgenericbearer.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qgif.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-2LS40.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\dlls\is-G1NCD.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-4P87Q.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\libEGL.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\dlls\cosmiclove.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\platforms\qwindows.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-A02K7.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\hacks\is-7P754.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\is-IH5IU.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\iconengines\is-1A9Q1.tmp	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-J0OMC.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\libwinpthread-1.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\Qt5Svg.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\imageformats\qwbmp.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\dlls\hotmilk.dll	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\iconengines\qsvgicon.dll	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\translations\is-UATCM.tmp	MegaHack v5.4 SETUP.tmp
File opened for modification	C:\Program Files (x86)\Mega Hack\unins000.dat	MegaHack v5.4 SETUP.tmp
File created	C:\Program Files (x86)\Mega Hack\imageformats\is-DMEAR.tmp	MegaHack v5.4 SETUP.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MegaHack v5.4 SETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MegaHack v5.4 SETUP.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MegaHack.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 211025.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4228	MegaHack.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
1712	msedge.exe
1712	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
5108	msedge.exe
5108	msedge.exe
1808	MegaHack v5.4 SETUP.tmp
1808	MegaHack v5.4 SETUP.tmp
4228	MegaHack.exe
4228	MegaHack.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	MegaHack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4228	MegaHack.exe
4228	MegaHack.exe
4228	MegaHack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3944	1712	msedge.exe	87
PID 1712 wrote to memory of 3944	1712	msedge.exe	87
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 2012	1712	msedge.exe	88
PID 1712 wrote to memory of 5096	1712	msedge.exe	89
PID 1712 wrote to memory of 5096	1712	msedge.exe	89
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90
PID 1712 wrote to memory of 1760	1712	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download2388.mediafire.com/qxhwguq3tylgj0x1u7XSrGsVUnKb8CfiLo6U7voW-zYWUBkttbuPGVuaWbP3Xwb98Ch_anW2e3d7T8bZzObrz3Pcad7-dJSNqiHDa0PzS242gSWjt023LC2IpjlYUg-8EMJAPOR0piZFyKp9pRWL66yfv1Wzlv1wHQugkSfFNsU/jdxff8bsksd7ee9/MegaHack+v5.4+SETUP.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffddeeb46f8,0x7ffddeeb4708,0x7ffddeeb4718
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Users\Admin\Downloads\MegaHack v5.4 SETUP.exe
  "C:\Users\Admin\Downloads\MegaHack v5.4 SETUP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\is-MRRCV.tmp\MegaHack v5.4 SETUP.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MRRCV.tmp\MegaHack v5.4 SETUP.tmp" /SL5="$A025E,15016215,57856,C:\Users\Admin\Downloads\MegaHack v5.4 SETUP.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1808
  - - C:\Program Files (x86)\Mega Hack\MegaHack.exe
      "C:\Program Files (x86)\Mega Hack\MegaHack.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://absolllute.com/api/redirect?mhv5
        5⤵
        
        PID:5240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffddeeb46f8,0x7ffddeeb4708,0x7ffddeeb4718
        6⤵
        
        PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16852340916997862706,16926190573086618337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mega Hack\MegaHack.exe

Filesize
232KB

MD5
ca8b5dba03f3a1ecc3901d156251f590

SHA1
dda8a51fe14e793cd1498bff2b0f07f029f6b7c4

SHA256
d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05

SHA512
bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f

Download Submit
C:\Program Files (x86)\Mega Hack\Qt5Core.dll

Filesize
5.9MB

MD5
06404c98b8f8a4854be00928d2661553

SHA1
31c48d3901244169a7a090ca704f3abcac24a419

SHA256
7b4e48c1ca2978b8bc6a005906168e6f3ef75c401511eddacf9b5842a56a1893

SHA512
9232a07dd419eaeef80739f9624ccc7a358b65801e9c281bd2d4a95e59f7f2275b112aed150ac7ba82792adba1c3edce1b0d0fd3746b4c0cfe3c2bbcdee8e87f

Download Submit
C:\Program Files (x86)\Mega Hack\Qt5Gui.dll

Filesize
6.2MB

MD5
47cd60478b29937e4c062cad74b16807

SHA1
592b512e1f78cfb10bf155ad5aedd10890506ad5

SHA256
a522369719e5bd8ad08bcebcbdecc10a4b60eacd9f43254e2f31a4e9972bcedc

SHA512
cc41506e359b9611c5fff0bce47f7c883538b95864c00dd316bfac8ba97bb20eed97e939958a43ccf53da487a87b2b0fd79f77549d019ba843006cc72ed906f9

Download Submit
C:\Program Files (x86)\Mega Hack\Qt5Network.dll

Filesize
1.7MB

MD5
c0e51bf4d6a0fddaa3fe824017b3f05b

SHA1
7e858d9cd8783a1d752c7839ce0193cedf31a569

SHA256
71399010c6a8e4a1a152fb82b25a76901d37ce4698379f1bda50d2334a3b24ac

SHA512
bed2bd80eae3b81f2c1b055611ed0e8fb02ff126ba2f19173048baa050faabbbe7718af91df0682f20b807a1a1c4f527f435d241228f8fdf3626f027d6b10b4c

Download Submit
C:\Program Files (x86)\Mega Hack\Qt5Svg.dll

Filesize
352KB

MD5
0fb72264c79129bed090afbc108489e2

SHA1
17e71ac4abb536a83cde9216f2d0df3a1719f4a8

SHA256
61045074a05b139b13ab7d2adc7b3492b0206f0c4ecabec67cd3c7469f77d9ae

SHA512
b80afee38638bb0d5af646cf197aa591508d9bad8b84f83f81f120c7af6e265e30849236c27f4cb5de959bacb9475cab60387f4b39382ea21654bdf3fb13d956

Download Submit
C:\Program Files (x86)\Mega Hack\Qt5Widgets.dll

Filesize
6.0MB

MD5
de81310251ed7fe9df01b78cd27ab63a

SHA1
ef0bdbbb73ecd4a3e9398e87ffe4e64ef0ec6d25

SHA256
56f10b75f48e7c3e00ba666bd85f07009a4ade0d8d8ca6bc9f4ef76535858985

SHA512
6a4d8cb417cb69c1ed9f4ea5e425d7312ea40208a852d4be5fb4f8fb657fd088f5fd527ca5a9fbd398aec806ad4efc4aa56e4ab834c06dcbab585b45016c73ae

Download Submit
C:\Program Files (x86)\Mega Hack\hacks\global.json

Filesize
3KB

MD5
5c04bc0c54d01e17bf4f0305d6140e99

SHA1
51551d3f9559fdf82d156dd146980e1ef9bf8c91

SHA256
1d5c8307b167158bc5e0729bbc97d1b5888bbac56aeaf9c90dcf8e94ae646be4

SHA512
1afeffeb06a820d73351e8b4e744fbec3bbaaad156e2630772fe31cf2aee25a8a989c29990ca3c7a49bf1a0c27f88a1c7d8f98bec427fb000ab259c187386b56

Download Submit
C:\Program Files (x86)\Mega Hack\iconengines\qsvgicon.dll

Filesize
42KB

MD5
0118e0f8581511fefed70c5dc015d887

SHA1
fa07a144bf9e2ee196a9438f395cebea1d7a2e1b

SHA256
96e7f5c70da6de0539dae7adf735a31de93e198caf93cc9bdda30811018728db

SHA512
13a518296a7ad8e4870aaf3373337cddc6ea40338f83177c5b847d6bdbf653c06ca03a39adc68505072068406afebe2449de2eeaa90aa2a4b9ad05dbe050853b

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qgif.dll

Filesize
33KB

MD5
2c7f06c9e12c879bb486be59c05f4720

SHA1
34817b9fccd12b02aed93b117a7872b533368899

SHA256
3a2dd488a5aebccad3363e773ca15115e66db956cbedc148f5dc42de78b4e6d5

SHA512
486ff1287f1f577ac60e491c7f91fd73b5c70f7448798cf5d1888440c9ffea423981488b4d71736eede98e8d25bd95ed7ad042f8c9ef0be9ac37c42d270042e5

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qicns.dll

Filesize
45KB

MD5
364f8a99db20b014e86821aff4f7a498

SHA1
6ede30d52a82dce3b7d9a6c9b8911181c8912678

SHA256
a26b0dfb4a824756d3d673b9168a811a2b5b4fb7e038a6658067512e8d857662

SHA512
5dd36d3be32948d4a44865c4c7c9828cff547ad241a7ab5c2db766d71e990d9dd1253efd00a7e5a5224535c2e97e12fbaeedf7b4501392c5fbb7af6ed07f245b

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qico.dll

Filesize
35KB

MD5
60ce9fdf0970e65719e2295e9ccfc341

SHA1
c0ed5d34896eb4da029a5d868d3442a1f029d360

SHA256
7f00c336b7440c9b0ef16db08e7acd32e0124185b61754481a9b6572c4e75cf5

SHA512
61ddd7e91ab601d8dc0cfceb60878724172cd4afb38235da32084d5d6d82ed20cdec89e3c68eeb2a95ba8dc8e15c079562eed08fd4ed8168d3aadbe17b9cc436

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qjpeg.dll

Filesize
323KB

MD5
aa37113d7929d7ef90ddc5392dc46fc0

SHA1
79f7ebd53acbf1f9024c9c1f49c05f74b1c182d2

SHA256
a102d608ad0b86b0def3cc69cabd59f8dbdce4aff714fef9848de606cab40b3a

SHA512
1b4e8d5260314d4e6b58d26b9f8615ba6528a3bcf2016c542d63c1ac3e26ecd50cda436be399c37fa7be8ca3c8a98ee1c8981ffdbda1ad55d995a56c8521fe83

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qsvg.dll

Filesize
27KB

MD5
d420e1e7cbd0793bb834a42688063445

SHA1
2a5cea81e4c62a88244108f1e1746c52a40ca3f6

SHA256
ccd1acfdcfd9fd248e82df7459238ede71a3945a5a45aa3913263ed078eca62d

SHA512
474c09e495e7aefb729fc17542272ddea827dec3c1d012df91511f915360e0a4e417c5a98ea05765ae82a8a815fb1f4ce1ca02240cbb511317c54c9b23359e5e

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qtga.dll

Filesize
26KB

MD5
df21cdf7e1a9895aafa1d01f25e4038d

SHA1
9012ce7ca75dcb07e2356ace94d9a4fc60cfcc5b

SHA256
cf6aa2383474ce89ca14acf79dce86a035c4f383e09d58c7b83671165299b5a1

SHA512
e5141c4ae9de568a738ffd87af4126948b904177bfdd3ceecb65f6a3e5c55e01ecde1bba6bcc45903f6f881ae26ac4aa9a4bf238e8eeb78a1c9c6212e5109453

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qtiff.dll

Filesize
496KB

MD5
db39d1c5e7d8514d4652aa506f434512

SHA1
f3ddeeb4ec75c17ca43a6b6309b060c191f260dd

SHA256
610c7815a6a9f3bf286c2d0be97582a14f263c8cc987e45287a966cfd8c14f86

SHA512
42cb2caaaee09f22d988046f37e05cea5fa49a68678bbb336e261a30cf821e0d63c409a7e161aa09bdf2702a84472b6c65c0928685add72d4c707d4d3323bc93

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qwbmp.dll

Filesize
25KB

MD5
6b1ff159c720705af0504512797b2b8a

SHA1
35f3a06ee4f5e2e8f0a87ec3f0ba9cafccc25417

SHA256
c2d4feb490f798e12b8684a8c96ee003a491f5a3b2e09823ac9c3f0cd690d768

SHA512
61d9f232570616d49e50bd40ce9bf13858698815aff7ca8c43f384129ae752df616eea943d473d2a4eb6be23d6958ab73036f3bf8727b054d2236d60b9a24f3b

Download Submit
C:\Program Files (x86)\Mega Hack\imageformats\qwebp.dll

Filesize
444KB

MD5
932ebf9b4f848e137862a5cd9c9dfc8e

SHA1
bbd2200628947842eba2c31e4c171eaa90592e4b

SHA256
d32c3fe1eafaa9d4493ee388e79c49d1aec406e618c989e010ab5475336a03cd

SHA512
e9caea98e13c039178e47125c8424ba20bd72f82299fd798c0adb89edc63455d2ff1b03ca12b21365d9ffcf3dc5b83996205d8e68e358751be10dd5c2b8ac20e

Download Submit
C:\Program Files (x86)\Mega Hack\libgcc_s_dw2-1.dll

Filesize
117KB

MD5
043b39434829ce93637b1801d57b2082

SHA1
297b5f72104130e17d92789adbbcfab8fe700a82

SHA256
4d2e2d408d399d066b0aaef2047f7a33515c13c589832de0d9f1ba87a530c394

SHA512
eee912b21d31c54bf913d11028f1637a041809bbe4cd6a5ca28c664f72b397d67d03230ba652a06b86916aea7e7ff5999a5b26cc14c067ab1652ab82f565edcf

Download Submit
C:\Program Files (x86)\Mega Hack\libstdc++-6.dll

Filesize
1.5MB

MD5
63b4f37587334014fda842a04b1baae4

SHA1
86202ab04e3e69daacae4ea2612d5ea6f5f1b256

SHA256
544d488fcfd76749c5ef2cd6bf9f73cc9fe59a86a819d369d710cca6e43cf4b1

SHA512
f14c708789d64259ac37b9b631949dc29bd1d9e91bfeec1ef716ff13747893dec32c82d95d07a7ee629a9f554e059ccb2286a38d84366406ae4d536f5e318014

Download Submit
C:\Program Files (x86)\Mega Hack\libwinpthread-1.dll

Filesize
77KB

MD5
a8b06665266ff02d5e9847ad828f9ee0

SHA1
899ccd262be567d481321b96468e3bcae38cf728

SHA256
712003aa990c4f9a1ee3cd044b8fd6abc44531710b7e42688b3767348330564b

SHA512
2ccc86b6a44d23039f2344eeb8ac629d0b9671e84a79b11d0f8d13684731a61434fd5509574d15cb03bb1f0714a81a660e0313d5b8962d4a367f5faaae759d17

Download Submit
C:\Program Files (x86)\Mega Hack\platforms\qwindows.dll

Filesize
1.8MB

MD5
bcdf0628822bc7d4b9b20945340900c2

SHA1
292157bc8a2dfddd269dba1debd41e5834d3e9f8

SHA256
9ae17f5b33d62a672e29003a6213aa36ccfff9783425abe9349cb979ee443fa3

SHA512
ac31e9286a827724431def85c458e1f51e0225e2241f7c2a964eeba7ea7a70d1c74603cac2cb133c5af78220a2fbceb6b8a60c02140636a3506376eac1ff8111

Download Submit
C:\Program Files (x86)\Mega Hack\styles\qwindowsvistastyle.dll

Filesize
192KB

MD5
33b4703310a6a04315fbb6044c49fcbc

SHA1
06d1bb9a97753bfd34d5c03f59d9a49532f83fcc

SHA256
ad9181977da980a09463f555740b7bd069441a4deeaa36113973a2d1e9ed5170

SHA512
e5b8e5d59bda850e92f1790ee849a4a1ae99f431f39ef370538f9c5c26bc791769189d1170885288db4b3a5276581d32c77e667f9dcf693f1f6bf1c4a4f95a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c5f412d5a91707ab7cbdd4de063d6758

SHA1
5b75cd5ef3f14c589e20b2fc125d9a0cb56726ea

SHA256
4cc2248208bf5b946e257244b5d66bb06fd058bc22f1293387e516a1cfbd53ff

SHA512
733219fdd47fa07c51e24d343618ae2bf4393f83391e44e5cc9cee98ec184c908349519f19b4e5a294d0a2655477a7bfeb6f8762131d4c40a21c5f9cc5021e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f1b4294fec932a9f274eba3a51baab66

SHA1
a874952339f946b9680b4c33e5573b512ac3b4c5

SHA256
3d035378b9849095319f54250f8591b4ebe2d3b85e09788d5d9b01ad01d51b4b

SHA512
35a6f58e4b094cda7f2341caef04aeea5ce626706a5ff21ed944b3795d90755cec25cbe28da4d3c49225f566e7a05ca2040da377f651a147b159b880527d1ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
351fffa35075863b296339b365c2e556

SHA1
55ab048e412ee878088ccd7dec3387d3eec80fe9

SHA256
75ab36c80544a287939d9675e93a9a07d1236e69d39e5ce0ba1e7c00ea97e4f7

SHA512
8dbf8b5b03dfff4a8917a8cb3bffded21103abca46b2d72fd3a713a55e8a109015603a92e56633ae28da7270d345c2e5f97e1a23f9d7f6c28ea93b18db641bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15d6b7b4c8992801a5bb66246a3759e6

SHA1
6900c11f7096fd21f9485125d6fa027bf49ce427

SHA256
3e27b86e89a214be5bb1664323aeb0b3690dd84a551effd3fbc58cfabb4b7c41

SHA512
64e3b73068cdcb43a8cb7b4624d02f5bfdf38c0c4076bf4be5980d9cce4662d59a5ea195ac2ca452e471fc8c14e54e750f5fae2c077530c66eb5e50076276869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f468f63a418be13788cca1467776cff3

SHA1
e13ede2db61074ed45b993fe422f07871f3d7bb7

SHA256
4cfcd66b4f3bcecab9af38d60e7da3443131af857694f672d0fdca622fec3803

SHA512
31cae96ab2cc95648c4f6f93dd6b741a29ae3cdba082bca7354420d6da4d6909637023e7a06e1042e22ac6530383fa06fc494fca930e50630cde0fbb6443a641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67b151de24b2af0f3bb77aef463a4c27

SHA1
3172c044fb34c94239bcfafb40cb8976eb0dff5d

SHA256
38c5d17d0549766ead03dcb7d31f88a1ea83f5984d7444a3e1e5b79148a7fe36

SHA512
6f9e9ca4d5a572b897a102a85733df123233f42cbf0b102a1eabbea0e0a20f2138d2d56e5f391aacf27668d83bdfa91de434151bedfb4ddf3e0df669b56aaf3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ba52.TMP

Filesize
1KB

MD5
0fdc9c49b50bb3dc0eac884b6954be75

SHA1
a31da1e9f58034b352602b2897f9883f81fcab4a

SHA256
5cae50256af4858f6720b3efc58583002c38a401e88673853c899a0f23fe3b63

SHA512
c89df6038695f3974929d8a65218d97c66ea2adf16017b810185519b49730b04b049a9ffdc9e1c7fc456aafa232f1f8dc75edd5b72dbbb3493dde33cbbac906b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3468f46a9abb6579635ae0f49b03395d

SHA1
6799dba9c12c47b53dfc1c30f4feab0d059e6a62

SHA256
751026f73a2acfe4b67d6c37be01f434d3aa1fd504433212227f86c8d8fc4bc4

SHA512
8d83ad1ea4fd9a49cc222fe4c87761b7c029f2d48afce5b90c2fb5b548db78753008da1d7f07c18a4c3b2d6a452c265ba65a6eb86df58f947097be759e68fc2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64516cee0cd48a7397befc7ed697eddc

SHA1
a35030a53dc08c7142a825fdd862b4eed7c36b67

SHA256
b50b49069649981060beda2f49efef2c455f7bdd35036a0dc7aa8ab7753b5292

SHA512
07ea4c7b25a1d3656a7940178df3c82fd4ed64b21c3cd9cea9fd5d720755e21f703461fea7ce569454e18653f85bb7e91c1ef9d6fb3ae223d1d08a653efb40dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3b8c0e4794884bf64d97e022ef6d306

SHA1
c61f4aea6afece9e0986e4dde7b4b05c4649adb9

SHA256
d6696239f0778d04aca759056feeb7f7029754923e2985877d6d97b1310fb702

SHA512
a69beeae23b227f9252a4f47982e31c5f7290f3fd4f688359d744ca9af769de935d46454b219d098d59ca1e4ee0f224724131222c4a88a2c23d57489cd06ec7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MRRCV.tmp\MegaHack v5.4 SETUP.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 211025.crdownload

Filesize
14.6MB

MD5
21f8588ba383393390d76ca642d73183

SHA1
292d500d0ab46c701b33a93284e99a5144078be6

SHA256
85f9e216a24dd777f8e4b7db008128d402355eb93a316fa6ba6c6d8392720a19

SHA512
6426425fcf4ca0ae1ebfbc5b1b91f86a4b9a1bb7a9dc1f648879d3f810c1e5a36d0f3b56effe1f204d0e1847eb93b0ca00fd7c5c2899a8097268f9eddfcbcbd0

Download Submit
memory/1808-295-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3484-299-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3484-294-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3484-86-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4228-416-0x0000000067780000-0x000000006779F000-memory.dmp

Filesize
124KB

Download
memory/4228-398-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/4228-399-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/4228-415-0x00000000677C0000-0x0000000067838000-memory.dmp

Filesize
480KB

Download
memory/4228-414-0x0000000066CC0000-0x0000000066CD0000-memory.dmp

Filesize
64KB

Download
memory/4228-413-0x000000006D100000-0x000000006D186000-memory.dmp

Filesize
536KB

Download
memory/4228-412-0x000000006B840000-0x000000006B84F000-memory.dmp

Filesize
60KB

Download
memory/4228-411-0x0000000067940000-0x000000006799F000-memory.dmp

Filesize
380KB

Download
memory/4228-410-0x00000000036A0000-0x00000000036B0000-memory.dmp

Filesize
64KB

Download
memory/4228-409-0x00000000628C0000-0x000000006291A000-memory.dmp

Filesize
360KB

Download
memory/4228-408-0x000000006EA40000-0x000000006EA52000-memory.dmp

Filesize
72KB

Download
memory/4228-407-0x000000006C800000-0x000000006C815000-memory.dmp

Filesize
84KB

Download
memory/4228-406-0x0000000003680000-0x0000000003692000-memory.dmp

Filesize
72KB

Download
memory/4228-405-0x000000006CE40000-0x000000006CE78000-memory.dmp

Filesize
224KB

Download
memory/4228-392-0x0000000061B40000-0x000000006217B000-memory.dmp

Filesize
6.2MB

Download
memory/4228-403-0x000000006AA80000-0x000000006AC5D000-memory.dmp

Filesize
1.9MB

Download
memory/4228-390-0x0000000068A80000-0x0000000069077000-memory.dmp

Filesize
6.0MB

Download
memory/4228-401-0x0000000000E10000-0x000000000140F000-memory.dmp

Filesize
6.0MB

Download
memory/4228-400-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/4228-566-0x000000006CE40000-0x000000006CE78000-memory.dmp

Filesize
224KB

Download
memory/4228-564-0x0000000000E10000-0x000000000140F000-memory.dmp

Filesize
6.0MB

Download
memory/4228-559-0x0000000068A80000-0x0000000069077000-memory.dmp

Filesize
6.0MB

Download
memory/4228-560-0x0000000061B40000-0x000000006217B000-memory.dmp

Filesize
6.2MB

Download
memory/4228-389-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/4228-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4228-258-0x0000000000E10000-0x000000000140F000-memory.dmp

Filesize
6.0MB

Download
memory/4228-607-0x0000000068A80000-0x0000000069077000-memory.dmp

Filesize
6.0MB

Download
memory/4228-608-0x0000000061B40000-0x000000006217B000-memory.dmp

Filesize
6.2MB

Download
memory/4228-260-0x0000000000E10000-0x000000000140F000-memory.dmp

Filesize
6.0MB

Download