hxxps://anonib[.]al/bj/res/192[.]html#466

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2023 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonib.al/bj/res/192.html#466

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1872	vlc.exe
1748	vlc.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
728	msedge.exe
728	msedge.exe
900	identity_helper.exe
900	identity_helper.exe
3356	msedge.exe
3356	msedge.exe
6140	msedge.exe
6140	msedge.exe
1176	msedge.exe
1176	msedge.exe
1828	msedge.exe
1828	msedge.exe
5980	msedge.exe
5980	msedge.exe
6008	msedge.exe
6008	msedge.exe
1368	msedge.exe
1368	msedge.exe
5880	msedge.exe
5880	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1872	vlc.exe
1748	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	5484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5484	AUDIODG.EXE
Token: 33	1872	vlc.exe
Token: SeIncBasePriorityPrivilege	1872	vlc.exe
Token: 33	1748	vlc.exe
Token: SeIncBasePriorityPrivilege	1748	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1872	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe
1748	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 2224	728	msedge.exe	39
PID 728 wrote to memory of 2224	728	msedge.exe	39
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3476	728	msedge.exe	89
PID 728 wrote to memory of 3848	728	msedge.exe	87
PID 728 wrote to memory of 3848	728	msedge.exe	87
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88
PID 728 wrote to memory of 4040	728	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonib.al/bj/res/192.html#466
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffedb346f8,0x7fffedb34708,0x7fffedb34718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FinestOfLeaks_240x432_1488944347886366727 (2).mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1872
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FinestOfLeaks_240x432_1488944347886366727 (3).mp4"
  2⤵
  PID:1568
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FinestOfLeaks_240x432_1488944347886366727 (3).mp4"
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MwfPIjsvKU1lw2gn (1).mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MwfPIjsvKU1lw2gn (1).mp4"
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:5028
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:5888
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:3212
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:5248
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:2608
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4"
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8681003280957752360,637538609444082668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
114KB

MD5
2d7e48b48e9e196df70c4df3f9f14bad

SHA1
4c4626f20dccb7d8b78e55812da881533a4426ba

SHA256
ca03450d46dd4337453f9bba40680ae1b5ee7e6c580dc68a8dacd7d481093aad

SHA512
77c5e12cdc43dd4663c6bce31cd790203ac729abd2ad78778d79b7793b4f89ffdbe1dd2e28f4b80a17e208fed0c01330e657234cdd37536ef7b97b2b289b9451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
73462054286a98225ae61b4b5e1d00d8

SHA1
098896954926fd4965f214af483e62cea2dbc1b9

SHA256
c8428a59f838ad2f47a5b52bd16886f1be28b3e61e0d436b73397ac988582d84

SHA512
57defdf595a68ad8c7842f2f29d75c75c48f9c589ff490b3da444a288c1d19a79fcc635d9c398448fd4bea7ccadb7aa6e805e4b8c6d8c738572dc158f9a025d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
905B

MD5
39edce4329dba9660def5f7eebc0597e

SHA1
d43c0e000d9340b2d7024ae5859769ed0b03995a

SHA256
04a3a222a8d6fe0d13dca9d48c39f09467d52770a4c8c40faeb43ea475043e29

SHA512
2316aa5f2694bc2bdd28a7415d128453f1fa4f80ea306c209b7d21ba3b69828a5e277c5b63118e1154dab3caa8a05518e56320e889dfed05fa9cf5e725437277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b3a8040d16b54504b8768bf56fe5667

SHA1
0423490c4bc66891bf34906104166867c763ac5d

SHA256
ab0242a66798de0ee329b8aaf945756d9cacbd68c4f31d119cdc8c76b2b197c0

SHA512
30edff2e37593dfb072981f7c08d17aa059789b9437e4dbffd55433bfd00710b343237086781a55a03fb1c8be387dae44ff618ac9e023087766844cea56a338b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41aecdce76b669972b0a520cf6ae2080

SHA1
3ae4eb2eadc50e240332794afbdc954d8bf4f634

SHA256
553f04d55f5e172b0f05ff171cc8850cb5121514ffde2b5d81c7584f2b0a8538

SHA512
cd6bb8dcfca8c0eb2afeb8397c7772a84592aa934b4d569607ec2c1e6e666de9d4658593402cafc156a656ee228d2238a9c90cc1b5a34621c707da75e5374856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1816477aad705478018df5d3d674980b

SHA1
9a6483bf923f65bf473152e8fac481826272e46e

SHA256
d966de6a3f4186c07c29ace1cfc8afa862a075727c4abc4824ceac6c7db3f3a8

SHA512
f3749d630baa62130a25aebd0c9a630b64b72e636f039b8fc2589789028a6249e1449ad94792b51b66b78a73c6d2eca30cdb1af6fdc40851199218d1b1ec85f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
157db6c6155f917267cedc6f1def0d44

SHA1
0b8c38de7d3a8f5d12c1e112481d4511bc08dfe4

SHA256
8138877bb56c0c46c1ad401662bfe2e7da8cd40c2d1b2c4810d76afa054770eb

SHA512
151c08b26f34d0fd80b35f24ebf4edd46aa197520975fe76f743f0f4cae3cebba72766e7002005410d089536c293959d771b6eabcdbde40eebbac32250dd47dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b160cd6c9e48ceb83f73e189f239e759

SHA1
5507a43adf21e953b02621d8d53ab7483c27bdd8

SHA256
ebd6217facadb14a1ea20fe3c5c24e2a7fe1265ae7dcb8830e514362555509c6

SHA512
06eb4181efaece20968967901d307f7e2c6c1d5cfef5cbbe95a3a435dede189a62bd5b034becd330530906cbf05639cec900cef4563bf928ca88dd29d862d80d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7d3962aa2a58acd7eed5cdd698b98c9a

SHA1
f20ec22e084fba630126401d936e119c5b1375c7

SHA256
782cb7984b6f72742ee7b133ed96469d99320162e17a2a7827b848aad595c02a

SHA512
39d572cf66ec9a8423957a20b2a3369714f855a408c79601b3639c3d4325af24725705af840ec3a662a3c8f5ddbb56ed40ea0d293e8f2a851480e66aa0fcdcae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f9b461d7fb011128674e54032d650270

SHA1
ad0b43f7399864f081a03e21d8c85c27cb2e2558

SHA256
f14a306d305187eeff3f8b470a6f6cda4b0c9754335e75a9109e9797d047d75c

SHA512
e1d1e9ed2e157d056b922deda6c070b48b277b9a7b655713f62f9c750c4afb16c3a15851e6bcb49fc0274afc6ac49c4556e5ad96d5540433a3ac17666d0b8814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6e93b483ff66497b2fec87b2dfcd88d7

SHA1
f677a402becbb95583508178b9d7014c4802c919

SHA256
d82b8498c52dc800d7a0bb508b26a7b2528dfa469d7d1e9db32193a5226a1d35

SHA512
74f3a4eb395d7ceea4cc779914d76feaf272c064c85d802901c7b14e98d82ec9b497b8c25514db9f55dcd8a33838ab99caf0e641358a2f0ef4995966cb0ff646

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf.tmp1748

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
644B

MD5
c78e59c0b9136665d0d0cd403daaa383

SHA1
e301158d67a5a57a574b921e7c34353b5ca7ea03

SHA256
b540965daea3c0adc56914640cc74898d7d20fce874f2125a29d52f6f8716065

SHA512
11fdd2e32c588f3f525de63aa524233ad12b1905c9191689f776ce484bfdcbf8852481d2651f57e2f6aaaf5f4aebfb605f4bfaf4272c8f353a1c6eba6f8de74f

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
575B

MD5
9d3575058fcbdca2dfede9db288b521a

SHA1
f9eb249ed81c393325cb6f6226e296c1059d41eb

SHA256
0a0392113e6465066c71a13de4b01166567844ba4e5b0d61a879a41dc104f9ba

SHA512
481d0f120b7db74f1685cf06e98be94f6dfa2bdb8f71a28f7f1c95a831ef04e2daa86148dd65ce39b3dd9e6222661d9cf672913b348ae4260b9ab71e6021ffc7

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya1748

Filesize
718B

MD5
c6fdf7cf312b39af4150e097eb01d47f

SHA1
60c9913e19ceb5ad773f1384d348fcec91d1379d

SHA256
8bbcca6cabc4ddcd27ccab71560e03fe1f756a8a16c203fdb55538fc1ee17c2b

SHA512
ee9763d537dbeb939b08030750bfce1b02b80e2cd049a2c4a74ce77b8b436431b3f61f26049ededcd5a25656a9b427b4c1c2b8af94de3e03b205847f07e5959b

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
7766463a2619648c9382e16f73d16274

SHA1
446608611da68d6edee1561e055dde968167d7d3

SHA256
13fa0e4a081cb65d8aa12d8dd046bb436063f992e5f5316fc5ba10fdfbd827de

SHA512
fa3f0a36eb14354591268981cb29b088f9724c15dffc8328359ef07a748a8455bb21d2baa2e8644875fdd80ab0404e87a48879ef09240c3e9ce1a33685b1c092

Download Submit
C:\Users\Admin\Downloads\8de4c65b-e05d-41cd-822e-4eb59d905250.tmp

Filesize
114KB

MD5
b36aa86e52d9ffef6422650c45bfe2a5

SHA1
ab512da2ac43623d58672d412430ef84de9e6560

SHA256
e45046063ba11bd7ca361a1d553b11015031cbe9116c5087b8472533b7958a52

SHA512
efaff991a6ad1cd2c05e3bcc923e0c448ff99a38e31ab307785e207539d10b52f212d960fbd5db0c1786bc14967a4d362e46c784fb4fc83956d10443359ba5b9

Download Submit
C:\Users\Admin\Downloads\FinestOfLeaks_240x432_1488944347886366727 (2).mp4

Filesize
114KB

MD5
b36aa86e52d9ffef6422650c45bfe2a5

SHA1
ab512da2ac43623d58672d412430ef84de9e6560

SHA256
e45046063ba11bd7ca361a1d553b11015031cbe9116c5087b8472533b7958a52

SHA512
efaff991a6ad1cd2c05e3bcc923e0c448ff99a38e31ab307785e207539d10b52f212d960fbd5db0c1786bc14967a4d362e46c784fb4fc83956d10443359ba5b9

Download Submit
C:\Users\Admin\Downloads\FinestOfLeaks_240x432_1488944347886366727 (3).mp4

Filesize
114KB

MD5
b36aa86e52d9ffef6422650c45bfe2a5

SHA1
ab512da2ac43623d58672d412430ef84de9e6560

SHA256
e45046063ba11bd7ca361a1d553b11015031cbe9116c5087b8472533b7958a52

SHA512
efaff991a6ad1cd2c05e3bcc923e0c448ff99a38e31ab307785e207539d10b52f212d960fbd5db0c1786bc14967a4d362e46c784fb4fc83956d10443359ba5b9

Download Submit
C:\Users\Admin\Downloads\MwfPIjsvKU1lw2gn (1).mp4

Filesize
114KB

MD5
2d7e48b48e9e196df70c4df3f9f14bad

SHA1
4c4626f20dccb7d8b78e55812da881533a4426ba

SHA256
ca03450d46dd4337453f9bba40680ae1b5ee7e6c580dc68a8dacd7d481093aad

SHA512
77c5e12cdc43dd4663c6bce31cd790203ac729abd2ad78778d79b7793b4f89ffdbe1dd2e28f4b80a17e208fed0c01330e657234cdd37536ef7b97b2b289b9451

Download Submit
C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4

Filesize
216KB

MD5
cbe3c164dccd4f9d9ce2e26e911599ff

SHA1
366d943cb922f33f45304bc081e9bc0268538f01

SHA256
f8395b202eaa35bed4cf99b4dd5080b86fc4c7cb3ed8ddd9d958ea729c43956e

SHA512
5d2af71a5cb2b05971d7513e66657d79f8ce006cd4ef74a842e0fa98c0d095f9bcc45ec77e9e710b78a5b98561150c3e0e46b74ec7bbf16379b20d67a8d233ca

Download Submit
C:\Users\Admin\Downloads\VID_20230930_021834_553 (1).mp4.crdownload

Filesize
216KB

MD5
cbe3c164dccd4f9d9ce2e26e911599ff

SHA1
366d943cb922f33f45304bc081e9bc0268538f01

SHA256
f8395b202eaa35bed4cf99b4dd5080b86fc4c7cb3ed8ddd9d958ea729c43956e

SHA512
5d2af71a5cb2b05971d7513e66657d79f8ce006cd4ef74a842e0fa98c0d095f9bcc45ec77e9e710b78a5b98561150c3e0e46b74ec7bbf16379b20d67a8d233ca

Download Submit
memory/1568-246-0x00007FFFDB820000-0x00007FFFDB838000-memory.dmp

Filesize
96KB

Download
memory/1568-248-0x00007FFFDA650000-0x00007FFFDA661000-memory.dmp

Filesize
68KB

Download
memory/1568-247-0x00007FFFDB800000-0x00007FFFDB817000-memory.dmp

Filesize
92KB

Download
memory/1568-245-0x00007FFFDA670000-0x00007FFFDA924000-memory.dmp

Filesize
2.7MB

Download
memory/1568-244-0x00007FFFDE5A0000-0x00007FFFDE5D4000-memory.dmp

Filesize
208KB

Download
memory/1568-243-0x00007FF686250000-0x00007FF686348000-memory.dmp

Filesize
992KB

Download
memory/1748-369-0x000001CAB6880000-0x000001CAB792B000-memory.dmp

Filesize
16.7MB

Download
memory/1748-363-0x00007FFFD97F0000-0x00007FFFD9902000-memory.dmp

Filesize
1.1MB

Download
memory/1748-382-0x00007FFFD81B0000-0x00007FFFD8362000-memory.dmp

Filesize
1.7MB

Download
memory/1748-381-0x00007FFFD8370000-0x00007FFFD839C000-memory.dmp

Filesize
176KB

Download
memory/1748-380-0x00007FFFD83A0000-0x00007FFFD84DB000-memory.dmp

Filesize
1.2MB

Download
memory/1748-379-0x00007FFFD84E0000-0x00007FFFD84F2000-memory.dmp

Filesize
72KB

Download
memory/1748-377-0x00007FFFD8520000-0x00007FFFD8541000-memory.dmp

Filesize
132KB

Download
memory/1748-340-0x00007FF686250000-0x00007FF686348000-memory.dmp

Filesize
992KB

Download
memory/1748-341-0x00007FFFDE5A0000-0x00007FFFDE5D4000-memory.dmp

Filesize
208KB

Download
memory/1748-342-0x00007FFFD9F50000-0x00007FFFDA204000-memory.dmp

Filesize
2.7MB

Download
memory/1748-343-0x00007FFFDB820000-0x00007FFFDB838000-memory.dmp

Filesize
96KB

Download
memory/1748-344-0x00007FFFDB800000-0x00007FFFDB817000-memory.dmp

Filesize
92KB

Download
memory/1748-345-0x00007FFFD9F30000-0x00007FFFD9F41000-memory.dmp

Filesize
68KB

Download
memory/1748-346-0x00007FFFD9D30000-0x00007FFFD9F30000-memory.dmp

Filesize
2.0MB

Download
memory/1748-347-0x00007FFFD9CF0000-0x00007FFFD9D2F000-memory.dmp

Filesize
252KB

Download
memory/1748-348-0x00007FFFD9CC0000-0x00007FFFD9CE1000-memory.dmp

Filesize
132KB

Download
memory/1748-351-0x00007FFFD9C60000-0x00007FFFD9C71000-memory.dmp

Filesize
68KB

Download
memory/1748-350-0x00007FFFD9C80000-0x00007FFFD9C91000-memory.dmp

Filesize
68KB

Download
memory/1748-352-0x00007FFFD9C40000-0x00007FFFD9C51000-memory.dmp

Filesize
68KB

Download
memory/1748-349-0x00007FFFD9CA0000-0x00007FFFD9CB8000-memory.dmp

Filesize
96KB

Download
memory/1748-353-0x00007FFFD9C20000-0x00007FFFD9C3B000-memory.dmp

Filesize
108KB

Download
memory/1748-355-0x00007FFFD9BE0000-0x00007FFFD9BF8000-memory.dmp

Filesize
96KB

Download
memory/1748-356-0x00007FFFD9BB0000-0x00007FFFD9BE0000-memory.dmp

Filesize
192KB

Download
memory/1748-354-0x00007FFFD9C00000-0x00007FFFD9C11000-memory.dmp

Filesize
68KB

Download
memory/1748-357-0x00007FFFD9B40000-0x00007FFFD9BA7000-memory.dmp

Filesize
412KB

Download
memory/1748-359-0x00007FFFD9AD0000-0x00007FFFD9B3F000-memory.dmp

Filesize
444KB

Download
memory/1748-360-0x00007FFFD9AB0000-0x00007FFFD9AC1000-memory.dmp

Filesize
68KB

Download
memory/1748-361-0x00007FFFD9A90000-0x00007FFFD9AA1000-memory.dmp

Filesize
68KB

Download
memory/1748-362-0x00007FFFD9910000-0x00007FFFD9A88000-memory.dmp

Filesize
1.5MB

Download
memory/1748-378-0x00007FFFD8500000-0x00007FFFD8513000-memory.dmp

Filesize
76KB

Download
memory/1748-365-0x00007FFFD97B0000-0x00007FFFD97C1000-memory.dmp

Filesize
68KB

Download
memory/1748-364-0x00007FFFD97D0000-0x00007FFFD97E7000-memory.dmp

Filesize
92KB

Download
memory/1748-367-0x00007FFFD9770000-0x00007FFFD9781000-memory.dmp

Filesize
68KB

Download
memory/1748-366-0x00007FFFD9790000-0x00007FFFD97AD000-memory.dmp

Filesize
116KB

Download
memory/1748-368-0x00007FFFD9710000-0x00007FFFD9766000-memory.dmp

Filesize
344KB

Download
memory/1748-376-0x00007FFFD8550000-0x00007FFFD8562000-memory.dmp

Filesize
72KB

Download
memory/1748-370-0x00007FFFD8640000-0x00007FFFD8657000-memory.dmp

Filesize
92KB

Download
memory/1748-371-0x00007FFFD8610000-0x00007FFFD8638000-memory.dmp

Filesize
160KB

Download
memory/1748-372-0x00007FFFD85E0000-0x00007FFFD8604000-memory.dmp

Filesize
144KB

Download
memory/1748-373-0x00007FFFD85C0000-0x00007FFFD85D7000-memory.dmp

Filesize
92KB

Download
memory/1748-374-0x00007FFFD8590000-0x00007FFFD85B3000-memory.dmp

Filesize
140KB

Download
memory/1748-375-0x00007FFFD8570000-0x00007FFFD8581000-memory.dmp

Filesize
68KB

Download
memory/1772-254-0x00007FFFDA650000-0x00007FFFDA661000-memory.dmp

Filesize
68KB

Download
memory/1772-249-0x00007FF686250000-0x00007FF686348000-memory.dmp

Filesize
992KB

Download
memory/1772-250-0x00007FFFDE5A0000-0x00007FFFDE5D4000-memory.dmp

Filesize
208KB

Download
memory/1772-251-0x00007FFFDA670000-0x00007FFFDA924000-memory.dmp

Filesize
2.7MB

Download
memory/1772-252-0x00007FFFDB820000-0x00007FFFDB838000-memory.dmp

Filesize
96KB

Download
memory/1772-253-0x00007FFFDB800000-0x00007FFFDB817000-memory.dmp

Filesize
92KB

Download
memory/1872-280-0x00007FFFDA670000-0x00007FFFDA924000-memory.dmp

Filesize
2.7MB

Download
memory/1872-279-0x00007FFFDE5A0000-0x00007FFFDE5D4000-memory.dmp

Filesize
208KB

Download
memory/1872-281-0x00007FFFD9290000-0x00007FFFDA33B000-memory.dmp

Filesize
16.7MB

Download
memory/1872-278-0x00007FF686250000-0x00007FF686348000-memory.dmp

Filesize
992KB

Download
memory/5160-310-0x00007FFFDE5A0000-0x00007FFFDE5D4000-memory.dmp

Filesize
208KB

Download
memory/5160-313-0x00007FFFDB800000-0x00007FFFDB817000-memory.dmp

Filesize
92KB

Download
memory/5160-312-0x00007FFFDB820000-0x00007FFFDB838000-memory.dmp

Filesize
96KB

Download
memory/5160-314-0x00007FFFD9F30000-0x00007FFFD9F41000-memory.dmp

Filesize
68KB

Download
memory/5160-309-0x00007FF686250000-0x00007FF686348000-memory.dmp

Filesize
992KB

Download
memory/5160-311-0x00007FFFD9F50000-0x00007FFFDA204000-memory.dmp

Filesize
2.7MB

Download