hxxps://direct-links[.]org/s?vwCO

Analysis

max time kernel
1190s
max time network
1194s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://direct-links.org/s?vwCO

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4600	vlc.exe
4856	vlc.exe
1708	vlc.exe
1212	vlc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
3584	identity_helper.exe
3584	identity_helper.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4600	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: 33	2468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2468	AUDIODG.EXE
Token: 33	4600	vlc.exe
Token: SeIncBasePriorityPrivilege	4600	vlc.exe
Token: SeTcbPrivilege	112	svchost.exe
Token: SeRestorePrivilege	112	svchost.exe
Token: 33	4856	vlc.exe
Token: SeIncBasePriorityPrivilege	4856	vlc.exe
Token: 33	1708	vlc.exe
Token: SeIncBasePriorityPrivilege	1708	vlc.exe
Token: 33	1212	vlc.exe
Token: SeIncBasePriorityPrivilege	1212	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4600	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
4856	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1708	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe
1212	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2020	4800	msedge.exe	83
PID 4800 wrote to memory of 2020	4800	msedge.exe	83
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4740	4800	msedge.exe	84
PID 4800 wrote to memory of 4216	4800	msedge.exe	85
PID 4800 wrote to memory of 4216	4800	msedge.exe	85
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86
PID 4800 wrote to memory of 2808	4800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://direct-links.org/s?vwCO
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e33346f8,0x7ff9e3334708,0x7ff9e3334718
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,16768394207326985742,8337573956270970252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:408

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "C:\Users\Admin\Downloads\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\Vids\JoinUs @RisqueMega 0.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
- C:\Windows\system32\dashost.exe
  dashost.exe {8edaa8a3-7e78-4dfe-b88781f731695610}
  2⤵
  PID:3792

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "C:\Users\Admin\Downloads\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\Vids\JoinUs @RisqueMega 1.mov"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "C:\Users\Admin\Downloads\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\Vids\JoinUs @RisqueMega 10.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "C:\Users\Admin\Downloads\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\🖤 Ｂｒｅｃｋｉｅ　Ｈｉｌｌ 🖤 Only fans Telegram @SEKSFANSE\Vids\JoinUs @RisqueMega 41.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
19KB

MD5
39b7e0d992290c41da06068bfbfc7c77

SHA1
f6a4d0d93047d6cadf48b2bb752f89bc9bbf6806

SHA256
92d3d1073c33cb7ee8711bde6ac3c519b2b5f0044e5a2582aba96b14ccfef01d

SHA512
c67131ea3093c9863d3c7dffc37cf54d4b17bee7abae3fda9195535bb8a736ab19115fdd14591c7fd1966014891f9b140b8763695a80207756bf01c534388a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
136ca582c56cd68e49bf08130e63f928

SHA1
8035798bb5b700be74edd270e3ec671c7bdedfeb

SHA256
2c7398c2f18bdbfe71c410fc02b29613c6a2e6775dbf289fef9aff81fdc1409c

SHA512
c2dedf5505862cb476eb38ea4fbf084b305d95e7008c21ca37c4db6f8b9d3eab85a6bed6f88c9b262a146531e9e73c5c381aeba5aad84caf3cdf567113138920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a1f19815742da882237efaa22d963aec

SHA1
7aa57928c231a537925b4fd63ef991b914181b91

SHA256
07b2ac48c3fd5c203074501ac08bbd7794df4ccf33bf6f6e29c1ad94cb2b105f

SHA512
42f04d043b1ee992610fc6c2e641c81d36fa2dae3dcb22b776d024e8fb60e2ef3a0a3e279d23dd6a4dce194e8c3750dddf5c8d89441f020c561eeb21888e01a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
d1764d47af3a4bf9594755ce565b9cf3

SHA1
6d8e324af7383e370f9387ca3d01467561eb058b

SHA256
576ca9f28aa5976d2972c2810c86141b841094f186e7b658c6359f401872e601

SHA512
158b3b3243c65c4036de55452c557c7a3a6bce93f0792e88d565adcf68e06ad7719fb7ddd89e1900ffbf5d40abc876c73987d170e66703ead9566ebfb7acb3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6cfcfa8595bb7a52a54049c206243f5b

SHA1
63fbca56192547654b58baea53494224432bc39d

SHA256
9e210a620cfa9806c4b640033419902c63f3a5812803934e92a7827cee342669

SHA512
b1f9bf0c84e3f513c6e3670d381b796e12179cd4762978328360cc173bcfe094003226125404b21e13b5352dd20fcfcb9277fc792f5082666b925d15565cad5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0f027b25fab8bb9c924fb95bb94d55ce

SHA1
2bdd924d0ca3d680fb664d1e2615b7972d5a2e3e

SHA256
7819e3fd743ed4a2434cc920099393ca169550fe80d96206c13515c54ede7775

SHA512
af00aa52540cdf2297e425bbe8e04fa9ea0960194bf5712496a05a74d35dd25650c80551bd127f4f17452a27aeff373550d586fec28eb5b53f8f84c6a7062468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3e6c98e398672222a1895a34e6d74cc3

SHA1
12832b01115ff9f57d8d81496ef367ff27003c5c

SHA256
14cb441d34232c4db35e31cfa2547ceccde1ae6c1d7861fdbe482b77c2c432e6

SHA512
31c374a19a8a64e81e9df85b9df0522d2dbccf1edc201f5f19deaa19740cf34e06eb8ddb7f7c3e36076a0b4931c60c9f88fa89596e8924c1b391066ed6ec35bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e796df566143364a53d6534ea781a7d5

SHA1
9d50dc20479356485ee89caef579ddbaa16acabc

SHA256
fc0f90e5b4b6b639260796357a1fde6de7d9f3767ad5b58d45bc48b4a75caa04

SHA512
b7e860f3a09c7b28728f8f217abf97440abbb9378589ee6d7373b87da82919c4838f948a30279b2639d2901a223eb5fde1f3650b5053456cdf0e777a336fd670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea4a3819bba371d89fde3518b1829a10

SHA1
22e52cdbb67c88abf7f80f034eff3f1c4ecc888a

SHA256
b2515072239649b369e7d5ad38239fad3dd5fbe23b62a192f8d46e26ed98dfc6

SHA512
3ef25d82f532e18f46b1906f251add802381e370ec5e05797adaa21071b9a18a3f81ee54a256c89247578ed995decf4745a58669657d72953c53ff9af0993d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
140d9d284deab9d454eea123c64480ca

SHA1
5fd0e86b9639af511d87b618d36597d071caa402

SHA256
60ef5784fe1382ad6c4f6e8bbbc81c019877c5d6ec53f02c1631a39544ee1d6b

SHA512
67b5857667ba86067b96e4f7a5255c3b3be678ae58061a9218b2e0c021512090d414610d960dcc6be037959d775befe3d07e0223f7aaa035b5944f259b957487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7e25c2b3feb442ee947dce40c3dc861c

SHA1
b8017abc0a7b0840e570bff652d824a33d988512

SHA256
9e07503d0e7c49e8463fadb989df0afd48eeb7158db2b3893315eddaddefa8c1

SHA512
229af37047b763e73e259a43451669f1eb7a65e9d09d0842e75640b6ad6784a7eaa5b0fe82b5e5d7e650bd04ec66fe5195b3b4555d7008807c58674991f4d81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55024c8bde290d580a5fa0af9a7671e8

SHA1
a887538c1fffd945086da6f447a48e51e076c794

SHA256
891b03217460d68e17d95e8343c1cbf5aa56aa74e3071a9e4956376405a11f77

SHA512
cc492c06fdbaa6d7b4b53ff389a2964a060ded06c7eafbee0634e04faf74876f58773abe6e0b446ac2473e3f0fbd9d61f273550fa81c094afc83346203d67967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
567bd07b5f6ca67f9a18eaaa6952f48d

SHA1
3755d0a11bb5f6d1f37405fc4841b83a05c13d90

SHA256
54fa2296c5340ce04af3bc108d7572da4c6656c0d6f0b263e612920af5e25e31

SHA512
729613e294db035f2b2d214fa43ca58efac0e04f205ea0b6d1b01741b5d0f9e1aee6efe910d63ec270c247c1a64e9ad6c99d7bda9d90f9141b8c340ecaab654f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b2ab1f6f24da660d8e7142045383402

SHA1
e39277b31d25e0fbf9fa072a29403b031e279059

SHA256
b2e40803caadaee58573fbb8e130e0a1045001e1019dcf86d3e967876ede56bb

SHA512
1bcdeafa2b188e23b2d16eed9cd7196de5d1a356c6aead6b2ece9156058aaa641c4bb5e08d863e6e4d4766e33de72f6f5d79412c723095b28e5f88c3f85732f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a0c46bf94b47f0b79db60b673eb10d7

SHA1
59ed9c9724bb79f3a8ae84bb757b4ddd93685159

SHA256
097c45d44a51df5db8e9f0663bb80644a7c5ff87ade949ab4566ee666b28e952

SHA512
d0130169d2ddeac432f920571c3e83e558fe2755a1da6898e19eb15b389abd4dbb31cc72df982051170e8076eb5b54f160854c6f4c4e1327fb393faa71c5da2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f60730dc3c46104240b8ceecc35dee39

SHA1
8003341a10050e14c4bf54a59912983bd7b4cb81

SHA256
e211e09e1ad6077c45f9a322ff878714cda7f1ac62baabbcd2e535bcb95a05d7

SHA512
7e2a6ebfe88bc1b75cce5bb282f2f42e8df38d3a009bc3553bd8bf6eaafc3fc9ed7b721cf547648ae5967f7389ece8e6d69f436d0bcad4f2f164b8d073d704c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bbbf9.TMP

Filesize
48B

MD5
f086e1e4a582e5a8e46bb31cf7780af4

SHA1
0696aa0c35f4be8dd785158dd1b4c53bd58cd734

SHA256
0ee3c6ec06d233626ed18bb11ab72b002edf98e267d87c5ed0b0363b0e3b9c72

SHA512
0bf5332f17dc5f615a55c7a02fd3bbe8e317734414ff9a061757217f5f757a8d4e0d8f31c3bc0c8492de5f99835eb76731a81881c896675e6ec582a0bddfb888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
c252a06b9f0aea1f62b9355e3157db78

SHA1
9b07486841f9f62e87ef8b1c2d4085163a00d57d

SHA256
c95673e7f1706ccac5e6807c2d1418da0e5171aa8a796240477a5b5c81b58b9c

SHA512
5c6d346d6fa4b554accacff9baa337380688c90ddae4495e51f72ed86b2afbf494b3d4fd18459739ba0e1bca6a3084095f3a97f7f6c86b2937687f2baddb51d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
bbe2a95fef301a3c319a3c04836e65a2

SHA1
0523c64989e2f0a22a719f058dcf6f1701cab185

SHA256
7fb22e2710219a733c05aa379578fdc6294f6bc42b01a29bbca2807e5af86d88

SHA512
33a3ac6aebe6db6a8eaf576aae4d714e1f61be7f231a8501ad1d39862c62ce315719ea4db4244866ff40e2c333e5723288ea0f91cce7c93207a97dadcc5c0a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
e69784830b19128045a12fc81e3622b5

SHA1
6427b0aa86a038bc8a24198ce3b58dc768479e84

SHA256
aa4818f1dfb05be15bd7339e44a4553e55de0b63102ca317d281b71771fa1660

SHA512
aaa37184a499506f4a0a147c62e1f7923cfacb765b25c3c3986c947bd07aedf0d933f5990b6bd3ac2980f453fab1d32167135130d6a4727604339d30264b7687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dbd9.TMP

Filesize
204B

MD5
5349b19b0d93c669fea365e8ad2d4af5

SHA1
08f82f797510a74fb54f2242a7f080f446270f39

SHA256
60d131529fe78721be41278f3598f1298dbefadded81f11c25e6ea65fa3cb0a8

SHA512
5d6f921b0da5a1bea61cd837e5e9ecd85441d26ff98769b8ee6a47c388ab9a5627959d33684c2193d758fbaf28abbd7ca7c7a6c53fc5f53fddb34fb153f34630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cb6d92b20f3bea13b1d4b19cf2976958

SHA1
38c6712307dcb688c219e91532de7e0cd94b316e

SHA256
7649a64b77fdf87a498cddbdaea0276470d82a964da1d04b032879fd0f3bf17a

SHA512
e2979782c9b315cd5ef1406b10e4ef07299a5824b43dbf6938e1a1780645af87cb96d49e3b79514a0e53ae2c742ef5a0129607a2271e3b617dfb7edc247b6c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a5271f8b83fa97009215912f2d60f015

SHA1
822d8e0f9efc23db2dab80996b83c3c036179c01

SHA256
cbe434dbb43b3a675fda17e28263d383366f664c5d2c58be675201b098aad710

SHA512
3f408d88f988f96db2d75792441c83a8b3d67c9871b98e834eb3bc5ef5581986933f90e8260e709e9097ab71a09d2e51e8f082ab24b8907de41538da53139769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
64709349fde7bc0aaec08d80227e57ff

SHA1
77114dfc5149b4949c7778b203ab919b47855204

SHA256
2977ec2e55730390335c371d1bbc2c80c54b227ca8c9ee48973f4c63aa8a6d09

SHA512
81482e954caac54624106fb47c5f1c036051b208d91752c083e0aa82676fc5cec7cf5abbca986d388685dba0cbdf45da069a7ddc4568c7eb1e5c4474d762f70d

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
927B

MD5
d9f8474def8e31395ee86440206e1e5d

SHA1
e54a45f0f5c4378012223d898c778ea0a2079715

SHA256
b2e32cac4170bd81461cf71c99d233dcf6b379d9641b4fae4127d49b074f1387

SHA512
6bc333162cdca8c90242f6c742c617d9aed88ba55441b6db2e05494bc58b21f3fb96d3f3bc0b1ca762b4ea225118e69611d60dd44ab2d2b4e08a461f92239e79

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
1KB

MD5
478ee99ac8dc17470246359ac5d3b2ba

SHA1
da31d34bcdd94ac57b0d459aaee9e7f814b7c36f

SHA256
76c38078b7de047d2e96f6176a354fc9e56feced590d5d93e46c45512bb57454

SHA512
d11f9757e0241276e66408b150ea5262dc5f5fdc9c2b71b2aa4eb012a4b414caf7c3f263e4a3701c050a87aa4a4239142176466656cead44bf410a1efbfaf1c1

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
1KB

MD5
01f49290e388caacd4ae3774d60a67b3

SHA1
c5970ca8108a535be882b06376027461ab1c5e60

SHA256
fafde31941e399b59a884b3a33407cd9bd2d2d48254d0780e6ca359fd574d10c

SHA512
72d07c4795bb355c8a5e6cb99802d5e794760c63c783bea67e92ee006126257546abd48923d33df75c814b4f502ac5dab211c21ac955a13a36e489beaef70f8a

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
memory/4600-4573-0x00007FF9E3FB0000-0x00007FF9E3FC7000-memory.dmp

Filesize
92KB

Download
memory/4600-4578-0x00007FF9E0AC0000-0x00007FF9E0AD1000-memory.dmp

Filesize
68KB

Download
memory/4600-4575-0x00007FF9E2AD0000-0x00007FF9E2AE7000-memory.dmp

Filesize
92KB

Download
memory/4600-4574-0x00007FF9E3090000-0x00007FF9E30A1000-memory.dmp

Filesize
68KB

Download
memory/4600-4576-0x00007FF9E2930000-0x00007FF9E2941000-memory.dmp

Filesize
68KB

Download
memory/4600-4572-0x00007FF9E7870000-0x00007FF9E7888000-memory.dmp

Filesize
96KB

Download
memory/4600-4587-0x0000025B775B0000-0x0000025B77607000-memory.dmp

Filesize
348KB

Download
memory/4600-4588-0x0000025B78490000-0x0000025B78610000-memory.dmp

Filesize
1.5MB

Download
memory/4600-4586-0x00007FF9D4650000-0x00007FF9D4661000-memory.dmp

Filesize
68KB

Download
memory/4600-4580-0x00007FF9CF480000-0x00007FF9D0530000-memory.dmp

Filesize
16.7MB

Download
memory/4600-4585-0x00007FF9DAB20000-0x00007FF9DAB31000-memory.dmp

Filesize
68KB

Download
memory/4600-4584-0x00007FF9DC300000-0x00007FF9DC311000-memory.dmp

Filesize
68KB

Download
memory/4600-4583-0x00007FF9DF500000-0x00007FF9DF518000-memory.dmp

Filesize
96KB

Download
memory/4600-4582-0x00007FF9D52D0000-0x00007FF9D52F1000-memory.dmp

Filesize
132KB

Download
memory/4600-4581-0x00007FF9D1750000-0x00007FF9D1791000-memory.dmp

Filesize
260KB

Download
memory/4600-4591-0x00007FF9D0EA0000-0x00007FF9D1156000-memory.dmp

Filesize
2.7MB

Download
memory/4600-4600-0x00007FF9CF480000-0x00007FF9D0530000-memory.dmp

Filesize
16.7MB

Download
memory/4600-4619-0x00007FF618A60000-0x00007FF618B58000-memory.dmp

Filesize
992KB

Download
memory/4600-4621-0x00007FF9D0EA0000-0x00007FF9D1156000-memory.dmp

Filesize
2.7MB

Download
memory/4600-4620-0x00007FF9E31C0000-0x00007FF9E31F4000-memory.dmp

Filesize
208KB

Download
memory/4600-4622-0x00007FF9CF480000-0x00007FF9D0530000-memory.dmp

Filesize
16.7MB

Download
memory/4600-4579-0x00007FF9D0530000-0x00007FF9D073B000-memory.dmp

Filesize
2.0MB

Download
memory/4600-4577-0x00007FF9E2870000-0x00007FF9E288D000-memory.dmp

Filesize
116KB

Download
memory/4600-4571-0x00007FF9D0EA0000-0x00007FF9D1156000-memory.dmp

Filesize
2.7MB

Download
memory/4600-4570-0x00007FF9E31C0000-0x00007FF9E31F4000-memory.dmp

Filesize
208KB

Download
memory/4600-4569-0x00007FF618A60000-0x00007FF618B58000-memory.dmp

Filesize
992KB

Download
memory/4856-4642-0x00007FF9D0F50000-0x00007FF9D115B000-memory.dmp

Filesize
2.0MB

Download
memory/4856-4653-0x00007FF9D06D0000-0x00007FF9D0737000-memory.dmp

Filesize
412KB

Download
memory/4856-4652-0x00007FF9D0EA0000-0x00007FF9D0ED0000-memory.dmp

Filesize
192KB

Download
memory/4856-4651-0x00007FF9D0ED0000-0x00007FF9D0EE8000-memory.dmp

Filesize
96KB

Download
memory/4856-4649-0x00007FF9D0F10000-0x00007FF9D0F2B000-memory.dmp

Filesize
108KB

Download
memory/4856-4650-0x00007FF9D0EF0000-0x00007FF9D0F01000-memory.dmp

Filesize
68KB

Download
memory/4856-4648-0x00007FF9D0F30000-0x00007FF9D0F41000-memory.dmp

Filesize
68KB

Download
memory/4856-4647-0x00007FF9D1690000-0x00007FF9D16A1000-memory.dmp

Filesize
68KB

Download
memory/4856-4645-0x00007FF9D16D0000-0x00007FF9D16E8000-memory.dmp

Filesize
96KB

Download
memory/4856-4646-0x00007FF9D16B0000-0x00007FF9D16C1000-memory.dmp

Filesize
68KB

Download
memory/4856-4643-0x00007FF9D1720000-0x00007FF9D1761000-memory.dmp

Filesize
260KB

Download
memory/4856-4644-0x00007FF9D16F0000-0x00007FF9D1711000-memory.dmp

Filesize
132KB

Download
memory/4856-4655-0x00007FF9D0630000-0x00007FF9D0641000-memory.dmp

Filesize
68KB

Download
memory/4856-4638-0x00007FF9D1C60000-0x00007FF9D1F16000-memory.dmp

Filesize
2.7MB

Download
memory/4856-4640-0x00007FF9DC300000-0x00007FF9DC317000-memory.dmp

Filesize
92KB

Download
memory/4856-4639-0x00007FF9DF500000-0x00007FF9DF518000-memory.dmp

Filesize
96KB

Download
memory/4856-4637-0x00007FF9D1F20000-0x00007FF9D1F54000-memory.dmp

Filesize
208KB

Download
memory/4856-4636-0x00007FF618A60000-0x00007FF618B58000-memory.dmp

Filesize
992KB

Download
memory/4856-4654-0x00007FF9D0650000-0x00007FF9D06CC000-memory.dmp

Filesize
496KB

Download
memory/4856-4641-0x00007FF9DAB20000-0x00007FF9DAB31000-memory.dmp

Filesize
68KB

Download