hxxps://youtube[.]com/@boffy/

Resubmissions

27-01-2025 01:26

250127-bttzgavkfm 7

27-01-2025 01:13

20-01-2025 05:23

20-01-2025 05:07

31-12-2024 05:12

31-12-2024 04:49

31-12-2024 04:46

31-12-2024 04:31

Analysis

max time kernel
457s
max time network
445s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
27-01-2025 01:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://youtube.com/@boffy/

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
53	camo.githubusercontent.com
4	camo.githubusercontent.com
50	camo.githubusercontent.com
51	camo.githubusercontent.com
52	camo.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 6 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Beryllium.exe
File opened for modification	\??\PhysicalDrive0	Beryllium.exe
File opened for modification	\??\PhysicalDrive0	Beryllium.exe
File opened for modification	\??\PhysicalDrive0	Beryllium.exe
File opened for modification	\??\PhysicalDrive0	Beryllium.exe
File opened for modification	\??\PhysicalDrive0	Beryllium.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beryllium.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31158423"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "44108877"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\.md	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file\shell\edit\command\ = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\Winword.exe\" /n \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file\shell\edit\ = "@C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\oregres.dll,-1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\ws䦈悕╲谀畆\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\䦋悚≩谀ą\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\y	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\䦋悚≩谀ą	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\y\䦊悛⍣谀痄\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\es䦉悔⑩谀耢\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\ws䦈悕╲谀畆	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Di䦇悖♯踀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\y\䦊悛⍣谀痄	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\es䦉悔⑩谀耢	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Di䦇悖♯踀\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\md_auto_file\shell\edit	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BerylliumTrojan-main.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Melissa-Core-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2600	Winword.exe
2600	Winword.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
1224	msedge.exe
1224	msedge.exe
1516	msedge.exe
1516	msedge.exe
3872	identity_helper.exe
3872	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
444	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2996	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2996	AUDIODG.EXE
Token: SeShutdownPrivilege	1540	Beryllium.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
2600	Winword.exe
2600	Winword.exe
2600	Winword.exe
2600	Winword.exe
2600	Winword.exe
2600	Winword.exe
2600	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1084	1224	msedge.exe	77
PID 1224 wrote to memory of 1084	1224	msedge.exe	77
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 3620	1224	msedge.exe	78
PID 1224 wrote to memory of 4588	1224	msedge.exe	79
PID 1224 wrote to memory of 4588	1224	msedge.exe	79
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80
PID 1224 wrote to memory of 3868	1224	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://youtube.com/@boffy/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbaf43cb8,0x7ffbbaf43cc8,0x7ffbbaf43cd8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1212 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,3300289245641185536,3704035318421538184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Melissa-Core-master.zip\Melissa-Core-master\requirements.txt
1⤵
PID:3544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:444
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_BerylliumTrojan-main.zip\BerylliumTrojan-main\MBR\readme.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_BerylliumTrojan-main.zip\BerylliumTrojan-main\MBR\game.gif
1⤵
- Modifies Internet Explorer settings
PID:1992

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4860

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:3700

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1736

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:3388

C:\Users\Admin\Desktop\Beryllium.exe
"C:\Users\Admin\Desktop\Beryllium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
26KB

MD5
8ce06435dd74849daee31c8ab278ce07

SHA1
a8e754c3a39e0f1056044cbdb743a144bdf25564

SHA256
303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

SHA512
49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
63172ee0f080f1ff61c18e3f99877721

SHA1
e962e4a509c9b13f24a22b6cbd4a1ca3d5fb6bf1

SHA256
43438d16d2de7303cb565b6bfbb2f4b32439c7bb8d308ee8c24350b8c98915e9

SHA512
85c8aadbc7c0da61586385c3f00f8f3f39754aa012c43a1d57efc324e9b5010f80af0cf63a4b8fe63a10964e6712bfcc4e4f1ceb08fb479f4ed0593b8c0c716b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ad5ca1c14af464a21451695d96af5117

SHA1
a16e4240d734b7a95ef109f73a6ecc57460b0170

SHA256
93f42646e6fb5ca454314991ed34268a2182660da8242d0d7895d6a1fb1b439b

SHA512
e697fc4d6d0e18b63dee0d9c401c4525762ab02f00665402cf5b17764a11824d53c49cb0308e1d57deae7017f223c8ccd407d40b523556f7ea3e9d520e3c20e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
2f020e0bc2809fae8ccd36bdee3e1304

SHA1
ccdc567a6276283d8d16115a6bd74995caf46b5e

SHA256
3f95f3e1065ee530e1f139d68947e3a99ec86136874cedad4d4b2a79305d4202

SHA512
86b35303476e1c026f266dad81f7ec1c790b716ba66d10d74479fd8b3ce5c23ca8191cddcb8e92bfcdc2459014c2940a050c22dcbcea7175c809efc619d24277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4e48a44b05c3a8040021c3e4a4d26a61

SHA1
d3886d4690bac8ec035c4693998740faba16cb8c

SHA256
ce307cfac6b8a87fb3b5ea0a045057ebcc6e958ea487e29d1f754e5bbd0cff53

SHA512
98f5ead02b8074540b3279fe8de1cc74eb09759a8faf7309312de5bb51771171619fd1e88668593a78f999c264cf44da69bd2f6a6078d90bb3a01c8d5ce7dc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b3ee6a10f6034bae6e5bbd51cdd76665

SHA1
1c70bb63cf21077f2eee881245f91efe610630f7

SHA256
dd950b366f0ef1166c25517b3616407fb3f5fc636996740c977dc192435ed8de

SHA512
0090e738ad52b031647c976a70caef5a651b15a8dfa5cdaedc456fc6262c6f394e8928e1f836f075cae9d0e60810f99914156eb117f73c63eb324bb6377392d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b4075619ed6656ef71775e57528092f4

SHA1
64c0b7e8c6d8d9e1dc39982a32078d2f759cf4c1

SHA256
8f6900adabee7274689d67bc1cf253b399f3efa30eef133bdc5b338c165ce9bf

SHA512
22d2440a4d691d4196503075575388dccfa8d928c1dc703a7ec92792d2c04b4cf9a91932b899c3f1a68b949035bb0ed0472d890f46596818d0b402b62c72f1d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4f73932c6792a70072e5a539f84cb80b

SHA1
697060f82dc5ed41d04c96a6fef8f2c3d470cb4a

SHA256
c1928f6a43368a525dab13ab1e877355862cf9d2943c4bedeeb5cd33b9455c8e

SHA512
a256bf539595ba3cc561150daeb6655905b1b9fb91537e1b37139090acf46620608fb1b8829f895066446e142ebbf3b12524a1885cbc5c8c0cfd42cd18713f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
92f06eb5dbf370979be3b7d6cfaba16b

SHA1
72b31a7054671bf9a3ee3e1e6e34c8f6e6f154c4

SHA256
3443b35a30d3851cebccb456583a2c07ffa7b1d3876c9347eda17f59ba9e2cc8

SHA512
096e21bf3c3ba9c8c051f437539b460e9b077963dd1208a1b9d4269e6af8c7fc6d3ac9efdf2cd1335f3e0937c42f19a8e27b0abced3f676b98a387cb9cedc3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1244f92ae28a33401cadfa6987e1e00d

SHA1
4176a7c16ff9cf529552ca26e593bb0f0e0dc869

SHA256
57643689efc9db2694033b452a8b86c6d8988a0da12ecc1b7066cfbc0eddb25e

SHA512
94e008c8f8604c1986ad7ff09783ae3a2a15270449b4549d43fa90f87868a9a2d6fa55c74cc324d00330328799bf55ca05ce598f3fa8688f0f57f551a46c950b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0888286346461446310bc58d82126bec

SHA1
afd297046156c04238d191952d583b803b21541b

SHA256
b925ea7ee393b252439eab8608e586285a33b014c3f296426a33a0220e54792d

SHA512
b336ffea66f88b80dabc596ad9f109cc9e5134135b2e763a99c9b50aaf3b6a8ba04111b7aa1a8a57bfff5e52625e2c7b35f983ead05976326669c0b291499cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b874d251b739f1ec458e56fa590c6c59

SHA1
96c86aeaa9b226f943501e829b07de1dca7e5a12

SHA256
72423b931b54a46fac5b1983d12ee55708feb9946f85a7ccc8445000127e20d0

SHA512
8473c37cd80e756db89e242815c4d85c5713bb9581b4a567f1544c243f9fd1ffced09eaa6f85e9ba1d3c849d517265ad0fdb7ef0b6699d32cf0a18483cecad11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
041b5ac00b4a2e37691a0de75c94a84d

SHA1
57e3190f5149764a819684625616bd0177680b30

SHA256
72f9bb2af601071606cb2ccbb7679441409df3642aaf8d71604f7d689ad8b47a

SHA512
6fc5f0a41fe140e4d593af3d8fe8aed32db1aac5a7b8c75370b4bcfc0fa51d6544543057ab17764d33ce69953816ed99ac730902d50197aeb7cfb4b445cf17ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d443f321e24cde9e3c59d59f26f708a5

SHA1
7bf7a2368d6848f2c864b628c90ac5d0ee3d11c9

SHA256
4c910482161580287eef2d10a9006f54557f9e9f466a859687d87e3d5897249e

SHA512
2fc159581437208495de6db2a6a376025eac6fcfe5c0b93fd1f6a720d6a6c4ce182b80fb377fa9106db764d009cc91570270eec018c7eae0528bb7a407904367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec4d5b1725e610cdf61ad5aeb6e67c57

SHA1
bb8320ebcbb4a11f0f1fda6d920c4962f4143a0b

SHA256
8b8565f21da5411a6a5aa6646157dcfab589720d8add90419d5145e9d09432eb

SHA512
ebbed6bcbd83a89418f1dc0c1f40cca0e0e549556862f4bfcd22fb97c8f32439e46b060c1c66a55f032eabb96a01343fd5ad7ec6935caf40a216c4c6d14de867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87437f4ac7663a4fe449e71da5c61a01

SHA1
b556d2bac342f8c158e1d2d8d19269dcb9d17ef1

SHA256
5374963b2dcbec031fdbefa140cd4887578e4c1bd832da28ff1c29a10f9fdb6d

SHA512
aa617e3490369e91904e0e32aebac819a81694237d35745fe7e1d525a32bafb85d3bce205d99bb7b2247b9a7c223f1edb231fc595ff2ca65a29a09263cbb48ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
738df08917f731cc03f62541b766ebdb

SHA1
6dac7ed5e5b2f1fe184d9a0e7ba5a0b6dd730a53

SHA256
ff995c562d34f8a4fb80fa2589c5ba8bfa3bba71462fe0e3e5e121e8b570309b

SHA512
93011d7c6ea76c7c4718c405f769ac59ebccc027d24efec2eeeec7bd686516bc776e4f7c839015bc1e4d1472aba3612c7fc7fe6a9affb1197e54abae7e951bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
deda3f396fa005c41cfbe6de1de188b2

SHA1
2dd954368361f62dcad4aee76f30405b780d65f0

SHA256
e38b80b98713eb5b6f40f9edd04ded1f10fc9eb4e8cc275014bc91ccd9d9f59c

SHA512
ac090a4453783153059e189bb6ef2a6ac7cfd698146faa7136811118570ed657d4c0713ed5b2ecda9a8658c3b746cc470db99330a8f1ab515ca41e54faea2d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3514c05a61fcde97d04ce3b579e9e9b

SHA1
0232e6cc22da9f8e7cc23f93869f3644735ce935

SHA256
e735c9b4161e7bb88ecefca0ce99fd1804693bc154613e45a175d50556d5da10

SHA512
7784c113c5d267b1a92d3ce002a86dddc527f5aaa381d744aac0f57a018fe87e19b498d6faeed35549b3d19fcd5294a33a114343bd4ac73670d4af3afc2111d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6fd53ea1df9ddc2b11d2a040d6a3cf4e

SHA1
228116ec2dbdb449ac67870fbae20a1f3f870a9d

SHA256
f230ac1b1c7c7ad1a2f5d8fcab49e1341a41798a1593d1cdefd4890f66001a3e

SHA512
e7c1dbee0c6d80a07c761181f8c26113549a6daaf0afbb1a8fc847ab9cb6279658b75e3fc404222e38dfa00f93bf7b1869040dd8da12ad6e51418ae8fde0bcc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2155f789b02f50d166026f483ad193fa

SHA1
022598a43f27afd297cc934206eb49420bf54ce4

SHA256
87e962802c0a931d5c579793aabd34725994923ecd0c7d55c1fdf6fd35b71767

SHA512
855023118e6a10cb123b2b92fc874a8367b8adbe26063e47447c507b918dc0d80e2c7c7ff45c8ffde4105a71a3ff1aa18673fb88231b06552792e397f79c97f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f7b030f20350f225628e9a940f692a7f

SHA1
e87e87472bce64788a63019fee71c01b92262f86

SHA256
b01ef50556a98f08a5bd9ee28fa4a4340fb76685eaeaa803411a5c0ff60d972b

SHA512
80765aefeae158431c227a8adc1324f9d281faa4d30121af6521fc0661c77976d5c451c69922d8f8e13ef32e1a462324528462cf16f12df3721a681f6035c95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d3d0b539f1a66ee978aad250ec210e5c

SHA1
012c208620f9ed902ccb904d64dd7da38b178ceb

SHA256
bcf541cde4ed1462cbf8f4aeafd8cf24bdd1d44441b3d789eb5b8d0a68095b75

SHA512
aba9dcd2034ac46be1a14df9901f039a37ae38716fafe9115d912f0302d25cb51e0104ba3ee26c08d1032c4a1ff9e0582512963f02a5c1342e9d352c3a2f99b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cbdef86d5449f6861a4f903fa29fe460

SHA1
33e55d022264303e75474056c8fea71a6aa5adf0

SHA256
64570278440d6c6594802fdfe0d5ea18916dadeee6ba41a2f59d1bf415ac6d88

SHA512
a468cecab50486fc69112d0f865a55a26b87eb3c5f066b81265649506ca1f1eb6f81ee33496dc7c3950ccd714281b9a31071f206420fbc1cc230e8d6894af7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1b19a57f4a9e08952012fcdade37f853

SHA1
eb46da9d409a3d68d8811cee145d84dc6e8ee765

SHA256
af0a4a83abbf5eb6eba0d33c53698a2bbc966b753135c1e5b8e62b276c63d14e

SHA512
7e45890c3e6bc5d38d44d5415871bc96cc3b85909ac7999052be4ef8e8056c44e9afba896fc941e9d8d348589f651484c2f3772a24af5b84e63727d168673f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1231f5127f21fa6ca7b98ea2d17b3e1c

SHA1
3a4e93f46009c52d633dc43018a895cdd77f351d

SHA256
e34de5187d03527e2358c9dafb79888f58cba5cb164c7c7e437036c27ad9a35c

SHA512
f88d0b2b281be0e8fbaca3f0a5d11a8e30b1b2c4e3def908f9c5be3d5f6789adc00d1a6bac45539e189284bf2f80354e3c8e9f2536f92fade063f513cc745c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582f1a.TMP

Filesize
539B

MD5
3b122307e8616851fcab0583ac183c48

SHA1
9a28c25f1d109fe9325fb4511b5892acdf5bc5c7

SHA256
d8e1c7fee83fbc002c7bb3d019b04605454766fa9bf426449600d2cbf07c9058

SHA512
93f7d02610f1b6f8f43c19e90acde92033281dc181a85d2857a4747bf1949321fba5914e52ddba56cc855270f196666e20ee1e52c8e42b39ff1b50d42625bc8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f3f98b27c8cd6138ba845ac875acc52

SHA1
316e0d2c50fe615ff0f8ee5c2f896afb58647d6a

SHA256
54bc609bd2cddf19583da9b2fa3163ac0daed01d1808aa7a53a7ef3c0888b654

SHA512
023959161d547b0f0302080089b1ad6c3ac16dd0f153b90e83205d6bd733d42708a91a345c2a13e82363fbae42c3fe359dcc721380f8b6d878c65d818076896b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40fc51786fcdff0509389151770fef93

SHA1
1823fbed8a8a7941c8f9c8422787a9154f0357e2

SHA256
4995a3ef96e86e90c923cee483c2c8695d26520ddf99f3ad38f48344a409bbf6

SHA512
11241533a3a9bd3592333b134e4e6387d79caa7956263950106ad53b74e645941f2622de35b306022aed9faeaaa7b91d10c24acd9f0e4c5986a87928eec64193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d46508453d440e7cfaa922bfd74c0661

SHA1
d94e7f74c051c448b394ebfc3b2bbdc863473718

SHA256
7489eab3422e67e7e0b6967259d8c75f33b6d4d1aeea2d1f401e04a700ae4484

SHA512
1f339d8e9c3ba370a20d3ea0f113f09344f2823429e62e830ca4dc46a41a2a8254e78081cf3356e0da35b2a2743476d3507d39a466cd4a7ee024b1a071b7c273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e811ccea5e5bb323522d71b4b7dcf1ce

SHA1
0b7cd196b8473f401d95ede01ad3ffe9022fb69a

SHA256
6f343411c397c5399d71d82e650cee8137f4f2f0a24c20918ac5e7fcdc7cf151

SHA512
df3dcf220208f973c31ab673a0fd24a93a238300c8674429db211e38055d42e37260d39862578c6a3f9c0ac6115c3ce9dac211071917c5f3a30eb77fc3773db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2340b694d54fc1cf04d3ddecb34dfc02

SHA1
50d8c65234d89f2a55e3345bfe30831be9470492

SHA256
38077fea00bcddcc3bd99e07a28d8683174c32f5dae7c734ba48e4828a5897d7

SHA512
c6d813635ec07e7be3f930be483f3b633ef793b56e7446a9da392a9dc1fc53dbbc758101c115c5a5c2913a2c03a04eb74ebc02fa6f57a474209d34f55785cc23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\Downloads\BerylliumTrojan-main.zip

Filesize
365KB

MD5
c894fbcbeff935ebfbc37a35369ee6ea

SHA1
cb2b886b403729421f1fed4bd39d1edc8b20a645

SHA256
9f3fec9b487c277001aed6169cb1fcd882977a03e29008abcd997873d3310da2

SHA512
dcc7dcd23a131606b64c4d2a3d4604cf4f87fa31f56d21b851bea9bccc2e74b4db88943e76f80b905e4d5510cc76ecb7cedd26f9e914294e85dbf9db41bf706e

Download Submit
C:\Users\Admin\Downloads\BerylliumTrojan-main.zip:Zone.Identifier

Filesize
171B

MD5
7488291210e64be6624c0f8fd8280e19

SHA1
639c6415b8b6ab731a8ebf12bfc095e432c19281

SHA256
fe07b3f061ce44ebb400b65571d47ec0be595c9b5547a12a6695bce7d13b516c

SHA512
b942596f9f2fd7ee034e1a793114def71d9c7807c2c2b375bb2bdc0c2e7ad0c7a383016548f05f3700987919b68a2cc0f871d6a89635a909442a4fca5458c703

Download Submit
C:\Users\Admin\Downloads\Melissa-Core-master.zip

Filesize
2.4MB

MD5
c61462c97518d64287f3fd5fbc79e080

SHA1
25c20f2353b6aa129cb46b02ed5f10919191aca3

SHA256
d344712a8adb66fc897225114ffe1b30bc73b80c939af7221b4d90305438c8a7

SHA512
e01e1eb73d58204fce1c072948294d6a81654be944c4cbc9625335df57173c64a9980f5cd17791e480f093340b512b0c88e542224970f5b9990f280183383eb0

Download Submit
C:\Users\Admin\Downloads\Melissa-Core-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1052-1198-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1205-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1177-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1217-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1199-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1193-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1211-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1540-1223-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1736-1220-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1736-1187-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1736-1226-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2600-999-0x00007FFB876A0000-0x00007FFB876B0000-memory.dmp

Filesize
64KB

Download
memory/2600-996-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-997-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-998-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-1033-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-1000-0x00007FFB876A0000-0x00007FFB876B0000-memory.dmp

Filesize
64KB

Download
memory/2600-995-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-1034-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-1032-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-994-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/2600-1031-0x00007FFB89B70000-0x00007FFB89B80000-memory.dmp

Filesize
64KB

Download
memory/3388-1194-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3700-1213-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3700-1219-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3700-1183-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3700-1225-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1215-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1209-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1203-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1221-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1179-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4860-1227-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads