hxxps://cdn[.]discordapp[.]com/attachments/1203642046229774346/1203650746558713866/VAPEV4[.]rar?ex=65d1de1c&is=65bf691c&hm=1589e00dfc7456aa2303e41feb289c7405636c2400887a4a574f99e12465659b&

Analysis

max time kernel
37s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
04/02/2024, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1203642046229774346/1203650746558713866/VAPEV4.rar?ex=65d1de1c&is=65bf691c&hm=1589e00dfc7456aa2303e41feb289c7405636c2400887a4a574f99e12465659b&

Score

7^/10

Malware Config

Signatures

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/3776-108-0x0000000004E80000-0x0000000004F22000-memory.dmp	net_reactor
behavioral1/memory/3776-112-0x0000000004DD0000-0x0000000004E70000-memory.dmp	net_reactor
behavioral1/memory/3776-119-0x0000000002880000-0x0000000004880000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
3776	VAPEV4.exe
3068	VAPEV4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3776 set thread context of 2596	3776	VAPEV4.exe	99
PID 3068 set thread context of 4908	3068	VAPEV4.exe	107

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3472	2596	WerFault.exe	99
1944	2596	WerFault.exe	99

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
3924	msedge.exe
3924	msedge.exe
408	msedge.exe
408	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
276	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	276	7zFM.exe
Token: 35	276	7zFM.exe
Token: SeSecurityPrivilege	276	7zFM.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
276	7zFM.exe
276	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3908	3924	msedge.exe	77
PID 3924 wrote to memory of 3908	3924	msedge.exe	77
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 3160	3924	msedge.exe	79
PID 3924 wrote to memory of 2476	3924	msedge.exe	78
PID 3924 wrote to memory of 2476	3924	msedge.exe	78
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80
PID 3924 wrote to memory of 2524	3924	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1203642046229774346/1203650746558713866/VAPEV4.rar?ex=65d1de1c&is=65bf691c&hm=1589e00dfc7456aa2303e41feb289c7405636c2400887a4a574f99e12465659b&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbfd253cb8,0x7ffbfd253cc8,0x7ffbfd253cd8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\VAPEV4.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13100043251594963859,9990485914549330124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Users\Admin\Desktop\VAPEV4.exe
"C:\Users\Admin\Desktop\VAPEV4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 1256
    3⤵
    - Program crash
    PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 1268
    3⤵
    - Program crash
    PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2596 -ip 2596
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2596 -ip 2596
1⤵
PID:3304

C:\Users\Admin\Desktop\VAPEV4.exe
"C:\Users\Admin\Desktop\VAPEV4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VAPEV4.exe.log

Filesize
137B

MD5
8a8f1e8a778dff107b41ea564681fe7b

SHA1
08efcfdc3e33281b2b107d16b739b72af4898041

SHA256
d09cdd05da4e3e875d3d5d66c542404519759acda2efa7c00ca69aa3f6234de4

SHA512
a372330793e09c661e6bf8b2c293c1af81de77972b8b4ba47055f07be0fcdfe5e507adbc53903a0cd90c392b36fe4a8a41d3fea923ad97fa061dbef65398edf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5cabc17286e25c0ade7a7f050b6e92a6

SHA1
c25ab09177ad0da9ee6caf78310236bdc2cba319

SHA256
0e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6

SHA512
0cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
9ae16d66130bfb12539d639fe89ba995

SHA1
00a79a778b72afb0961c2fa1fe38476e99b05afe

SHA256
76a25c0a71060b785145959592f71333af3befd28298d0e815f32b94cc244784

SHA512
512deb32723393567538033048e4ab758bfbdbd03dc6c21a4247bfbd3e2540b50556d858d885318d84fd598e61327cc0caff236ea4b136747a49c7d5b6ad5d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0b87c7d2be8593d14b7867fec88f8ff

SHA1
143d0a4026fec27e4aa59bc444419967e7f7390a

SHA256
09489f93d830bd8c890a7c453abbec25df31c0f9ff5553b8690c93cbee8f6e28

SHA512
b2818e6dd04b2d48528ac4b95a260115ae4b22291adddb1e602977dc7e3edf5b7bc86f633f1b1339181da91e1a926b0b93cbf5b7c048444d958068f81c95782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d81a437bff77e8925f2eb19b1f69e6a8

SHA1
061916082f5477535e1ed630c32f4284b7e32aa6

SHA256
77732bbe1ee38c2d2c59a8ea900d49b8c56978b33c973139fdde535e0cf62ca4

SHA512
861dab958423dfa617d9935e4552fb9c6ebc7af8cef8eee785dabc6d6cbfe76b28c5552c4c197ab0c1fba4cbdbdd7a9ffa09225d6501afa47f32bb94fc272cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
68fe6f34e7d6603a3d2f4c95919f8408

SHA1
c7be30582f94d46f05338cc39726f72c9e2fa4cf

SHA256
8cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a

SHA512
48eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23205b6f93e7d9bd899da7b849984aca

SHA1
9f7aa1572635125cc152daa8935f6dab74fba83a

SHA256
8ad8473733186cd166ae9dea9489d99e500cf62d3f849247f4a198a7c0dd7098

SHA512
f6eab72f3e356787b0f897d1298b8d39cbaeb1a48305462d219c9b62b320ff021b05b896150679e022a6ae6b08ffd18568a55406542ad854d79355d38514504b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9075c3bad5ffaa2dfd266a2392bc2c96

SHA1
2d4fd837c3e20fb7200b620e2835e183f5ae79c4

SHA256
10018190d11695c18a1d0680dc15cc2f2f85c00825c2a59edd359c982d6d5ab1

SHA512
31844b8734b88d1de310672fe952b377a4930d0a9b0fd7cc48962ded637e1a2c31fef345a4d3aa5a8e806d4563bf2d6715b8dbb6d03367893d37390dc3122cb7

Download Submit
C:\Users\Admin\Desktop\VAPEV4.exe

Filesize
733KB

MD5
269080d3bbec9bbea3995c5a088998fe

SHA1
115ee947afdb07a005aaa63321375450ca8f265f

SHA256
178e842d5d286ca9effe0fe9e545d6e5bd751ca7a491d96d7aeeececc7b5ca22

SHA512
be68cae5832ead9817617ad84f337bb8931403b5006acebb110ad3b6159cb3f6e9f85507b7e04cf89eaf6d5d95adce06d133b4cee4bbd894be61920a9057bca1

Download Submit
C:\Users\Admin\Downloads\VAPEV4.rar

Filesize
666KB

MD5
0c7fea7d7b3f476b8eb3a01d8ba80281

SHA1
1369315b5f3d22a21b7d301e5057b221a271c30f

SHA256
60f6652f8e85e6747c3e79ebc43babbcd442d33812954abc829c56e9250199eb

SHA512
a80473bdb2ecfe295ceeabf4a181c3346247b5f639bdc754f5bbdeff2c6e21facc5215d1e424ecce32693c61b4304bcca56a2412bf763a6880b0cae1905b6fa5

Download Submit
memory/2596-122-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2596-124-0x0000000001690000-0x0000000001691000-memory.dmp

Filesize
4KB

Download
memory/2596-116-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2596-123-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/3068-131-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3068-130-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/3068-127-0x0000000073760000-0x0000000073F11000-memory.dmp

Filesize
7.7MB

Download
memory/3776-113-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/3776-109-0x00000000743F0000-0x0000000074BA1000-memory.dmp

Filesize
7.7MB

Download
memory/3776-120-0x00000000743F0000-0x0000000074BA1000-memory.dmp

Filesize
7.7MB

Download
memory/3776-119-0x0000000002880000-0x0000000004880000-memory.dmp

Filesize
32.0MB

Download
memory/3776-108-0x0000000004E80000-0x0000000004F22000-memory.dmp

Filesize
648KB

Download
memory/3776-110-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/3776-112-0x0000000004DD0000-0x0000000004E70000-memory.dmp

Filesize
640KB

Download
memory/3776-111-0x0000000004F20000-0x00000000054C6000-memory.dmp

Filesize
5.6MB

Download