f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264

Analysis

max time kernel
859s
max time network
832s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HandBrake-1.7.3-x86_64-Win_GUI.exe
Size

22.6MB
MD5

1a1598a4f8a2d8d6b1925cb22a74d5aa
SHA1

ce693673a6f207be639fc07d21f90833dc386072
SHA256

f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264
SHA512

63706b168aa11c6370a36fce9d73b585486f2a9e396c183eb725430f70a67d5c301701823b1e566b70a601443b748ad428de2c91e507b4a8f8d14e344571a18f
SSDEEP

393216:Xx4SBEeiv1+mx9BQNCX3fjSfy05s+EwWAa4ND046BsZdCu17QCnqXd:X3BE9l1XLSf9ZE5iD04RZD2d

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	HandBrake.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\HandBrake\HandBrake.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\hb.dll	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\portable.ini.template	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\doc\COPYING	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\uninst.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\HandBrake.Worker.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe

Executes dropped EXE 1 IoCs

pid	Process
4628	HandBrake.exe

Loads dropped DLL 4 IoCs

pid	Process
3476	HandBrake-1.7.3-x86_64-Win_GUI.exe
3476	HandBrake-1.7.3-x86_64-Win_GUI.exe
3476	HandBrake-1.7.3-x86_64-Win_GUI.exe
4628	HandBrake.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HandBrake.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HandBrake.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	HandBrake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	HandBrake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	HandBrake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000a4584415110050524f4752417e310000740009000400efbe874fdb49a45845152e0000003f0000000000010000000000000000004a000000000008007900500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5c00310000000000a4584515100048414e4442527e310000440009000400efbea4584415a45847152e000000426901000000030000000000000000000000000000007d766f00480061006e0064004200720061006b006500000018000000	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4a00310000000000a45845151000646f6300380009000400efbea4584515a45845152e000000b13b020000000f0000000000000000000000000000007a4e870064006f006300000012000000	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	HandBrake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	HandBrake.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-877519540-908060166-1852957295-1000\{002A3D39-DF03-40EA-88EC-9E04EB8B709E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	HandBrake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	HandBrake.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	HandBrake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	HandBrake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	HandBrake.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	HandBrake.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1200	vlc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
1184	msedge.exe
1184	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2400	AUDIODG.EXE
Token: SeDebugPrivilege	4628	HandBrake.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1200	vlc.exe
1200	vlc.exe
1200	vlc.exe
1200	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4628	HandBrake.exe
1200	vlc.exe
1200	vlc.exe
1200	vlc.exe
1200	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1380	1184	msedge.exe	121
PID 1184 wrote to memory of 1380	1184	msedge.exe	121
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 5080	1184	msedge.exe	122
PID 1184 wrote to memory of 3108	1184	msedge.exe	123
PID 1184 wrote to memory of 3108	1184	msedge.exe	123
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124
PID 1184 wrote to memory of 400	1184	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe
"C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdead246f8,0x7ffdead24708,0x7ffdead24718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16662055071607781765,10584005205853132100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Program Files\HandBrake\HandBrake.exe
"C:\Program Files\HandBrake\HandBrake.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2728

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\Spider-Man Vs Rhino Final Scene The Amazing Spider-Man 2 Clip 🔥 4K Ssstiwtch.Com.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\HandBrake\HandBrake.exe

Filesize
35.6MB

MD5
ee3cbf592c24b1bf04d906ded5c7d1a9

SHA1
1931bdd5d120635c357b3000dff08ec9110ce1e3

SHA256
ee818fe194c29f1f31d6edffeb8256405618dab251f3765bbbacfb91ea666336

SHA512
97b52abf6cab8540bb7e6467eddaf02199c34fb40eb561ee022e626f9976e9a6d5b1006d053f2f1234c4a8760d686a6dfece1c5fd25483ff2d67bae43e38d8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
37KB

MD5
e04acc0cbe67d37a8413fda23b96ad71

SHA1
173f206abbfde0e02dd59ae341fd6cd5334bdfc8

SHA256
ba343cea66b8daa6c0abbe13a3b752c1e5a4d61a340dadf10d4fd9696860b011

SHA512
a9a3ba711d5c7656ec97a8df39958b00c5227bc67e8d5dcf873b5490dcb987112fc3592fb635664a4febcccac3d76295dc991ea0799b58c6a2aa962c0127d6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
bc31b3e68f12ca2e104f1cfb6b99d0fe

SHA1
a263b2502fc1e3984a8ea96f5a76cdfb0afd1739

SHA256
07e16629a1b1ad0a44035cee2279590d0a6eb71355489af75a287e808a3f9e87

SHA512
d8bd6d2b8a4789aa88e8c032933d4d2f48465fe17d7889a259b9f1759a6f693c2953595425684dc0a0bda2292c37b6d78644ab7269b436dc3e78dd2518286f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
82e4cd660742f9c6169e535f03afd8fa

SHA1
326672c45aac3e87a111fe1eec7b4690cdfac03f

SHA256
0b0ba713839deb82530a5d2b1c945db70e17856a153c436b5eab4d8c1a50e1df

SHA512
5b84c5d0d6ec37a0b68115c941587c1f3586c81149f5b3c5f16b277390373bed8daf599bc712eaff1a526c783035134e58c711903e5d5de1d924881248932abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4db14967c6401df7f0c1d46f3c30335e

SHA1
6e70afad68f923437c68727dfe0480014f423f37

SHA256
84027e191b7a1bba2b6839bc761c8107fed5e9861f127d6ad84ead5f2b2dafea

SHA512
83d701b15cdc84029ebfdd37ced9c7d87a93bfaa4cfbf6283f1b88340f22812e87d39c2c21513254439f89a71474068251308372357e6b429cda4540c17566fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
588bd4197eab872f31bc005641551b07

SHA1
b2fbfd9344e3ee5827caa7277fb5ae944ce51d3e

SHA256
53c7f006b38f31392222ff91c6a2c0c07d273b8f33b5bbfbdc42aaa3e9942223

SHA512
64a9e39f01049df69f158c4b4153ebb72d4e5219b7ae41f42c07df6adabd85132213ba155267f5abb4cdd56b4645c073bd1afea516606741ff1accaeb2394df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
47ecfdb26fb2859a832a718f01ba3e13

SHA1
be882b7aaf606b1db4367ecd6f6347c35dea9eb5

SHA256
eb62784d68e20fbc8edda0c35cb7cfdff8f4f8d625127ff186c9527997014853

SHA512
91f7cb6d49f2f2bf0109cec1e4174abea1dc1500d525f5ed32d34a04da3a0cae96a2b82be5f6ac82c5522b0654c766ab67ac3e1908af3fc1a5cee69043983331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8b8ae04a312f2df68c6eaa189cd89249

SHA1
186a7cf4e5085582735fa158689afea6ebdc0baa

SHA256
84c01344eeaf012364ca7fa7810f2459288872655ccaf1e9b0fdbf0179d48ad0

SHA512
10d426c6de6cc700b3d9db933dd18faf7c7f96cd5066827a46daccdb70fc230fce7621a299c1eb9b272900c70054234bf0eb13de5cde466ff514d01dde1e25a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
44e54250112a7de8cde4d8e379338beb

SHA1
c1b9f8691214044cf22ee4a07a365243b0c23dc0

SHA256
56c609ab2bfdb3dc84c2901366a8635e60bf1d159dd04394d20409acbcc58c2a

SHA512
9e34bfd648ef981b94cb87cd9ed1cc0d06720faa2950e72f6e17e532df9747ef7995213752c2efb6f4a931ac4057cc2bf7498d3448cd696a9e8be0306a12eea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
f11d1c1d05c22ed30605b2c5241fdb4b

SHA1
5df5c471bccd10e822d893316c0c8fbbb744be5c

SHA256
96332772d75d38ea9a6eb71c08e5cf131a3c25ee1fb14f71d34c228d92dc0879

SHA512
af61af788b3be619ec074d3a852e29c8eca048ad5547d7c273d778c7cc451a2efb4a1de480a1bd8e844298361f81ffdc83c54fe156016d2ca2c7eb0e509db2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
0667925801a1a37070c8c4bd34f5e2e9

SHA1
0aacf43ec7cb3a6ce370ff00f10b2c8816499a4d

SHA256
5b3a447927994e12d50c6dff6f9546a0ff8801b1bc9483d1f250f21626b54b1a

SHA512
e499798c9f8d759ead24af3b2cc1fd50eb8f98a4282d2747e4178c28b7f45918e01998391f0a68783d6aac7f2aca44dc8fe7aae6203fba9640f8d602f4d6ad07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b45322370c2ef682c67806294863365

SHA1
ef8b524e792e3af407ca2c134dbfd3f233fd2a0e

SHA256
a7d0da0f3d7997096d5671079e155bbe265e7aae04227b8e40521568d42e1e66

SHA512
338c1bb297be05abf45c9b7ece548718d87ec0b2b7b2a9b4f736f86d5caf9524e1f87dbdb52fdd8cbbb24bf5bc0046bfb2c8ca53cc1793bf15097120744723ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3d45fdd9e82c5d923db7938dad83d5e3

SHA1
37f459bf4d5efb4caab8ef5409732a6ab7eab661

SHA256
45b9b276e4e7cc9307748d4c45fab68922b717c7f1abb1c33337ced8ce2b7bc6

SHA512
3bfbde926abbd7acf9ea444a0cfffbc810039a4f3c1b76a53601878504ce054fb6b36edba9b03cb22530d0f797a9f361a493d2e20ffa2e25b29b651d584d43c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9ec20781ad432f6e9e11e361c432474d

SHA1
cbc8336c06ca78f375587a29ad0e3645385737cb

SHA256
f35f34a2eb32877a9d241b43393b5861d41c58212f0596ab8bf8e5614c84f45b

SHA512
a0b4ecf19526ab7882c05983a9db95708fd11972858e685becd63384cd0613a2405be9258e0f29b2394546793c0061418d8b417bbe0f51ca4b406aac66ab4efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da7d91bda6650998d4a031feb0751f21

SHA1
5e2672011ed0d32469a51376a85603f47b60c305

SHA256
62df215ffb0deacf1c0542fc65c99edd07e8156915e8f9305f4c52c4538ea5a6

SHA512
c79e5842478336665a2d2b575e2d3d167e5e800e6f6c780871d9e425aff655ce8c388a6071e70d9c1525cfe263e002f59328c95638b38cae9a2f91e96e12ebd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5d2d7fe10874291090a7aa240c673f74

SHA1
759cee6815c07f5b8a5199c6c8c28ab4482e6201

SHA256
1aca78c89529eadbb5b7590a6f4d805b16f9e10cdb754d44d1da7b86745e1bcb

SHA512
7136a1fa7b1be0a3a2323d89ad489b70555381bfe0fa4cdc887687add602debab9e1072f711bf4ec5f4d2650321a1a29b90bec4cf20c11fa7692d64dd0be2bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9344ce68fcda86cfda9ba5990d7c689e

SHA1
7bcda328b21cc64545f903f9f173b5a8b836c9dc

SHA256
c8159a29bb1f43d1018986eb5d2a646aa48f18c63e3ad6ad981ba5fef264903b

SHA512
17095f94895d13ef5ff8042970d346a2de9a69549388936f428fadf583673f8aef708fd6e0f2d202e717bfb41b6fde7bc7c7b27d5b5c3af4e5cb9ba1a2984afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12dda117c7ef5c91fdc8ab8dc8444ea6

SHA1
a9895c557192868e9fa64410fa0ca2551ff55223

SHA256
9d4feedab123a123970f74e1c259bcf42605a91ea4a9f73c65b3c56d615b57d1

SHA512
0512125deec936f9a07e5bee677dc067660e20e36e424267a7052d623df1aa61bed0c6454870a8c74f42f6780c0e6437e49e650ab062b42406824a451b90d4f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a34004a69df73905c045622b56a4898

SHA1
1ceab743ac429a2e0bc6399cb347a18292ef8509

SHA256
d295552ddc2eca486c156df054e397e979bcfb817168b21ebe27a092c891be7f

SHA512
fdd2c48eb0dec20f0a9ede44b38aaad62fd1856340726e9125d7cc6b4f092375d67532cd9587bed4be1d7043421be921e4dbaaaaf1ea265d762ca68dd59286a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c50713f-50ee-4320-babc-ca1a345800db\index-dir\the-real-index

Filesize
2KB

MD5
3ee836cbcac927e8e0258ea939f3c7e9

SHA1
adf365bf6909e892875fb4970eec35952b3acd41

SHA256
c16d20b82b5fcb086d7a360eeca595549898270e7ab0662f0e50e96a402bc4c3

SHA512
bc4213b8a79857c6106c454347cf0fe11677bad6f827ca0f611e9825a016775da165f3daba3d1561de438f727d35ab0cd2ded4d50611f15ca3291b774a4519a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c50713f-50ee-4320-babc-ca1a345800db\index-dir\the-real-index

Filesize
2KB

MD5
cd62d40f399b59fb7b1b573bcf6db6fb

SHA1
92c273f83fed49c112838cc437ce258784812ea1

SHA256
7e1d904aedd2f93564ebdbe3801bcd3fffa976caaf05830154aca2d4cfb562b2

SHA512
b1e0eb7fa1c79099fee81edd99ab66c5311c5eabe6a083e3ef0e030a6b456323ab28c7e93fbd82b82f6e3d214d2203c8bae61d378e0d1231a054b1a6640c2ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c50713f-50ee-4320-babc-ca1a345800db\index-dir\the-real-index

Filesize
2KB

MD5
367b6bc7aa775644e01b1224cd537ae1

SHA1
1f41feca505f85346d924674d133e091f3d8d6e4

SHA256
55c15e1714f48d77c2d09a5fe8621940efc2a11e10e24e920f3e8ce699064bcc

SHA512
57fdf83ee8e3bd5e625b88e620ca9db2c0214883e9bdddb88c67b664d439e19f9c8b4e2a28549925883757e9a72562e65ee5f450e662f6dea1f966cb622862ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c50713f-50ee-4320-babc-ca1a345800db\index-dir\the-real-index

Filesize
3KB

MD5
0ebcd7899416a40fc20c75da2775648b

SHA1
6ef3ffebfc2770e0e4eb7656982599c5d6322398

SHA256
631a0c4abe58217fd0b6c7958d7fcfb9a60b847d1002f9a518239d1b18cb52f1

SHA512
37114fe45ee21fc2c2a03fc31c7e567b432787e7372a14ffa09557c401847e49d1d4ee0af83b31ce386f0184fdf43f26a8a6c2a62890578b141f08fd07ae96e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2c50713f-50ee-4320-babc-ca1a345800db\index-dir\the-real-index~RFe5b9bdf.TMP

Filesize
48B

MD5
0af17ffb9cca9c95898acb2e702a0b14

SHA1
ad13eb1575daaa41ef495b04a9dbc61c33bb7fd9

SHA256
3d134ace619d139eeab2d4c67560c50691a1e2161c8148f81d287b29fb7b0140

SHA512
c3d8f86095b1f9df2126157af90dfef2470cc5678a2beda2ffa8953effc37a2f5d71a5f8f53b67fdc442f7ef189f13b8451e70fb1585cda040d55f7828b4e6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
dc75337862ef05274a5e1770f088de65

SHA1
0a22af0269f1b6d37adab22ca745d47fae7ae5bb

SHA256
e4e9fa4835dd9bb8a3cc5510187bc8127f9b76c84380ac4e09d7b338fde880ba

SHA512
e1e66c7b9f3b366d3416b71caefbe6c2f4a002d147bf17667c1ac437e50f39f3ea30bb8915a862fb44b6235478481a2ce4e889945718f973833fca8c117ed7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
5864f6c9b825894ded11d723abbd029b

SHA1
066830d36f7b9e97182f1fd9defac037c552d675

SHA256
2c9945ccb822734b5635d701bc260074eab91869707eae1f3d46cc13b337da22

SHA512
c5e89c18f320f006f336db87419b76dad82cfb65e6806b77347bd8cd6be4d89c68c89262289d9079d978aeea4c87d3dce55df68abc37d7b5c7310235346c0119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
d269f85242904550f097c14a92d770a4

SHA1
b99ab769804f77becec457c20e742fcc5b40ba7b

SHA256
5870fdc8ba9c225626d803b5a41795c45443230658beebe2eff47ec12af69637

SHA512
a89b1dcacc6f930cad35b1879582aa2a6552e354dce05072b6c3ac769bd5d6fe965163a263916d3f4dfa3cc6fc1a754b5b4f878c84400e6e2b15ce1fb599a095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
d9862b5c806b6fdc03bab13276ef0bb0

SHA1
841df8cbdd02de69436e1f03c1bdf8c3341e83b1

SHA256
00c75bfc3cbefab2b5d061272768cd0d6f71d346c5327bb56b330b9fe99b53c6

SHA512
28e7c9026091229c1ebee51c2f1ee7e761a94bd559cb221a89d1aba0773a92788a56f85ff52a65467bb49d3cb034f6436fb49ded75d3b95d09bae5c4d8266334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
89bef8d4462ad87a6e142c5fdf7ba86b

SHA1
807cfd1fdcae4c264237057cc58d866ca481db5f

SHA256
c26c967db0b60703c5d707a9e27f3d65e88f35bcbb94d8823fc832a35f39ecc0

SHA512
a9328eed61eb5826cb3edf880e6e7b577023148ec2af6dca0834a0abc748ba46edcbdf23ceb08405b4a7f9526e96ce52b36869033c1ffe3823fe2e84c98a1ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
9b02764372d3071ac68beff740503bbc

SHA1
37210d748d09b41c8d3a27240bfa4ee187b5773a

SHA256
9f423d38feb6f95bc3e88ca48e9b393bf882805cdf4c4ea5a4fb490842fce14a

SHA512
36b891e5f5a64d710efcba597e80d155d83cb494ab48d12fe28fc4e85841673fc426c7d37bd3d542207014b98bd2e2cde6f65e4a8d243b81dd00a41862de8b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
6f26a63f0d43e4e324c3ec75a75a77be

SHA1
a7e55474f1fbf5cf24d65116712b7c7e142f05b5

SHA256
d1d5512b3ea95771ce8c248ffb928ef91c1a56f6870181e39cd955469dd5944f

SHA512
80fe76d235a40622966e26ad4b37c88e82cb9a91fea91d731965ee5fe1ba620ec0c8e0fb7889be5d6af0496b643bc4bdc5fe37cc043eaf89d1687cfc0333b784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b3272e384d963a3bbf0d6b88f258cb14

SHA1
adeddba7313e29225c32a9062210677982013d1a

SHA256
400e152c88d292940872c61cfb878ef97f8255a183d32e154d412d6d6392cb3e

SHA512
c688fd908172b51ceef587183396f2ae49747183f3ba6982d5609566792e66795331cfe547141d9ccbd553cd0d522415121b3e2e5fee491ecb39b5755db1b604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b5d11.TMP

Filesize
48B

MD5
954b1d55aeeb7eedfe41b102c6807fc6

SHA1
be3489eb8242345a6a0652392261ddd90f2df320

SHA256
4e001876f13fb55daec6b1eae549256eaa77e6a222300d4951eab43ab762d6ba

SHA512
64a25dde121e17ddb5e0bf3173b9c16348be01a59741f61b51a1b5542c61ab6222e90d9a2fc0d48b464a7ad701b7ec32b0f5d56e79729e62f6dd9b6373976758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46a2050b8b4f53074a0d51a6ab7d7068

SHA1
2a4709b344f597413c599d322cd482070c31ca23

SHA256
c181c010cfdb2d2067257be842ad0047044c08c7cff2a2403779e87363c3ad89

SHA512
8084e95afa842abd11a7a579025bc57b654fbfb45a7c69ff43e45a02305729f49d85e006ecc0d965e3225032135ba7e789c7a69197331d260f5ef056ac0ee1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0bc6b5eed31bd97b644d2c083727f830

SHA1
7302f0fd07ccc4420215b4c7ca95d713c3b05f15

SHA256
3431dd34d1ebdecc65f32a48ef9ba214078f95d13462cea6aad93d874cac1f71

SHA512
247f954936d400e278fea068991076658609eaa4c3cd0c4ee73c486600db82dc08b2851b20e2b2f2b421af7f64dca1e0cebd66a3db4b13261e0361fa347d9544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c7b24eece7456f6525a8135cadf49c46

SHA1
bfbc01081970287ab409de29523d6f4c27ec58cd

SHA256
df2ccc282b96313e0577ff0071b50b450c6f5aa766dc9a43e78655c335745c34

SHA512
00e803489552aaf5d57afcb83769c6e46275382fbee0229605e5ac6f5e5c33bf50bb7c3b8a49ae97878a0d65b28cacf26f39e7db1fb3f5bc5b7e8c787d1bff10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad1a9b10b2d3c8278c8faefe5cdd44aa

SHA1
00484e50b7aaca8dd6fd6a87ce8a1588b602d104

SHA256
e33041c9d3e73d2cdb7d94b61f822e0d381e7bd5cc7a36504f86f8cfe4aecc11

SHA512
5489ad4418b877c4cf4e9f2617490c268d67073de36e4c8371ce8445844278834ddf3ca0d88bb93215cba27bac19297c777b3d9f437dbe7599d3b6c30b79571b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ef1607f175e33b3385b0f27329e4b39b

SHA1
d34a6b45cb45eb3a9208fdc0cf659db8f15a1cc1

SHA256
eb630af768d8db7ec19e8c2c194760da32ba70825d807a0a41c87689d7c2af3d

SHA512
7a76a6bee999885ddaacd0d255a2c41aabd02a6da634b3a7389239298b6c6784143cd9420d22ae3d5d0d492882190460db9a28a7a77c9d863871e4f5de296eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b30d0.TMP

Filesize
538B

MD5
d210fb8cd8d49c3369c29c130b8e9ada

SHA1
f494f7c7149f12bd57a107147993fcdc8167fb15

SHA256
85f15d672d098e32b0ecab3054fa6390363795e29b86e0fdb9ef0ef6632a0a76

SHA512
745cbbb7d9cae8cec6a85b1c41205543358ee7fd1def88ee9067a8eeb09383d5314e51d3951ebb87903c0a05a3ed812e6e9b94a38b4ca6efcf5fb504b2834186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b9a1488bc5e0da1354570a3bd3cd207

SHA1
706ee25f1088491eaf86858220ff80c8dc2c9c9f

SHA256
d2d8575dbd93faf0ac283e332fa6880c285b7cb2e452bf2e97a165ac2bef8ba8

SHA512
1d3f2dba0a5e63d8255b93962701846e779aa62f05bb3f5157f7457d8a2b373750c5e83466efb8699a1fc69b69b58d8ee8b8f943569814fd15ee1ed234075acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4be0b0fdc01ad0ac069eda9339e069ac

SHA1
2203630acc931fc50c67bcc84047f96cda10195b

SHA256
5fe95b153a16eb48ccf64ee44236a3dfd6f8b2e2d79c7833e8c53305159c43be

SHA512
2e5df4968b45aecc7ed007b5b6b782b90fc8909b3b06a2c7f6e90c893f5d3681c543b90ad34f49c6fa6c2e977bd98651719229e3f00256909b3d28e11debb0f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hb.4628\0_1_4.jpg

Filesize
403KB

MD5
c4e5b2b8d6a5684da2ebb0a725ae56b8

SHA1
6f706ec5aee279841e335cc90d60e4d8f566add3

SHA256
5351dfc0ff7482e45d8d55af52849b1c5a3ab4e445df6b201fffd0806e27d461

SHA512
7e982c5df78532a0fa1b33bc38bd588706d0893024b95dff077a87e0bf729ab86ac90309d79ee2e44b29ebbc1699d6e24c61f955f30fc5bbd3863f909f7e4a6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3375.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3375.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3375.tmp\ioSpecial.ini

Filesize
1KB

MD5
ea8e8a98a3df7d49254dde4b6cdfd0a2

SHA1
45f37bac77cbc581dce0191916b851bf8dee7adc

SHA256
fb47ea1333735849039d4900c9db2542fea2de94f330c5132426af014c86ab86

SHA512
956945487b76898f57dd04efda3e45321ff2c2da0d58d02e4d84b122dc576de2afb210a153fdb51927529a3b5b6d723dbdba1ce9bc70376cfc2c8f6d75d5ae99

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3375.tmp\ioSpecial.ini

Filesize
1KB

MD5
741bb3b360036d22da7cf7eec65bc5d0

SHA1
b82f538360873f6ff74f6ef557c2618fec8b6846

SHA256
ff2730c6fa11df51f4633f6fc6c831d29559e9de33004521441f82c213b931af

SHA512
53a634d339c936461501c60de1e2291cd155b9bca06e220cb9b6d794e7c6b6c491cc861be8abd9baa550317357310812950e38be3ffb116e290aceec69878f10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3375.tmp\ioSpecial.ini

Filesize
1KB

MD5
59fd1e1ec69f8d2c5bab660bc0456703

SHA1
859e016b4f9886e86df9227d396ee9f928461e72

SHA256
7ffa6c858d72f515f6c2879e005dfcaf4a7cf813b713aa92322483613480c098

SHA512
35b51ce2728d30a6c385e62f9a11ef95ae7db639b35ce8996a3b7599a593335756792beebe7f95ab16e04c1bed46e0c2a981e96b4c010cc59378ee7320fb64df

Download Submit
C:\Users\Admin\AppData\Roaming\HandBrake\hb_queue4628.json

Filesize
10KB

MD5
0d47c7160ebaa3c9cec0c5ff1a43c4cb

SHA1
1c796adfcec5d9c5247d99e6d607d5a01f887921

SHA256
55329c7897c2c714d04fb522f643703cb292deca0155a6661695c91298816ed5

SHA512
4200c981f612f503e2d3c1e3c02391943b96781eba1ff34eaa9f369e265b2ea028fb6b42e0e96b3d01c37d17f7dd3ec581dc24e603dff0dc5970a11a94300b03

Download Submit
C:\Users\Admin\AppData\Roaming\HandBrake\hb_queue4628.json.last

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Roaming\HandBrake\settings.json

Filesize
2KB

MD5
dea9e3e7b739c25f90c7dd851997b186

SHA1
91b82aee95272ab629cc16a52d98dab25c24adfc

SHA256
9956f8055c6253733ae85dd09d66ae2df7cca06d6ada4f0487e03ac50784b490

SHA512
04e4032536d38d4874b0be17a5bbff667902f888128055574275c0acacc70263bbca9180228c6ec441f5b7023c17deccd1a2c9b228acf30e7b28202e9bfd0d73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
2674465064e93ed967f5f3568d3eec82

SHA1
f0bdd86edfaee02579dbb07dd038726052352248

SHA256
ebce72ab3d5f761524236956d7c9a87d154d5cfb971db70ef4676ed0824fe89c

SHA512
c08984b745ce6d5dc2e42e403afcbcf47929c870d0337a382d514858dae80247b89d7d398dbd97028290a1debb86fd64c7f7647275a49f9cd1376be8ff03f847

Download Submit
C:\Users\Admin\Videos\Spider-Man Vs Rhino Final Scene The Amazing Spider-Man 2 Clip 🔥 4K Ssstiwtch.Com.mp4

Filesize
40.7MB

MD5
d0e2e7f0a8fd5fb31d4f5bcdfd8c9325

SHA1
4a9f8cce70a8372544049a7e7018e36820ff21dd

SHA256
3f416b182599c2296368ea1c14bf6801c8f4daeb59f471c38182a76d070c2f39

SHA512
95b48f876d4517eea2b7526c06aa55b1abfad53bde5abfb00b42ac72a74e6e1e7fb23bb73fca7c5dcdae76a3200f491ff236ede1c3a40283331587c63e642a74

Download Submit
memory/1200-1666-0x00007FFDE4E70000-0x00007FFDE4EA4000-memory.dmp

Filesize
208KB

Download
memory/1200-1665-0x00007FF61E390000-0x00007FF61E488000-memory.dmp

Filesize
992KB

Download
memory/4628-1437-0x000001E359E10000-0x000001E359E6A000-memory.dmp

Filesize
360KB

Download
memory/4628-1534-0x000001E35B4E0000-0x000001E35B568000-memory.dmp

Filesize
544KB

Download
memory/4628-1553-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1531-0x000001E357EE0000-0x000001E357F33000-memory.dmp

Filesize
332KB

Download
memory/4628-1518-0x000001E35AD00000-0x000001E35AD53000-memory.dmp

Filesize
332KB

Download
memory/4628-1578-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1580-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1515-0x000001E35AD80000-0x000001E35AE4E000-memory.dmp

Filesize
824KB

Download
memory/4628-1429-0x000001E35A020000-0x000001E35A460000-memory.dmp

Filesize
4.2MB

Download
memory/4628-1608-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1609-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1610-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1611-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1612-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1613-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1614-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1624-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1625-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1626-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1627-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1628-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1440-0x000001E359CB0000-0x000001E359CBD000-memory.dmp

Filesize
52KB

Download
memory/4628-1641-0x00007FFDCCE00000-0x00007FFDD27C9000-memory.dmp

Filesize
89.8MB

Download
memory/4628-1431-0x000001E359CC0000-0x000001E359D92000-memory.dmp

Filesize
840KB

Download
memory/4628-1434-0x000001E359C30000-0x000001E359C73000-memory.dmp

Filesize
268KB

Download
memory/4628-1425-0x0000000180000000-0x00000001802B4000-memory.dmp

Filesize
2.7MB

Download