hxxps://sc[.]link/wsPwN

Analysis

max time kernel
1569s
max time network
1539s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sc.link/wsPwN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5052	vlc.exe
384	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
2268	msedge.exe
2268	msedge.exe
3024	identity_helper.exe
3024	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5052	vlc.exe
384	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe
384	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5052	vlc.exe
384	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3388	2268	msedge.exe	83
PID 2268 wrote to memory of 3388	2268	msedge.exe	83
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4708	2268	msedge.exe	84
PID 2268 wrote to memory of 4612	2268	msedge.exe	85
PID 2268 wrote to memory of 4612	2268	msedge.exe	85
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86
PID 2268 wrote to memory of 3240	2268	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/wsPwN
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdea6446f8,0x7ffdea644708,0x7ffdea644718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4719952907399246102,16537104395589168844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointGet.3gp"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5052

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PopSubmit.wma"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:384

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PopSubmit.wma"
1⤵
PID:1168

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushOut.mov"
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\43954053-1b70-43e8-ba8d-8bd63cffee2a.tmp

Filesize
12KB

MD5
3bc2211059d482f2a7c53d40844e67bd

SHA1
f13a638093f82abf204721fa3977ff4e15ffc672

SHA256
fb930ab025e508ad5c03b1b85205f5841bcff5971ed37cffe936e7c5555da9fb

SHA512
c23f69535cb23133ba4a4e4a76308aed50ba4ff77d6cb1441b11e53ae1aed4e0d60d6533ba282da9ef7c6180da239840cbb1397e7459438a62ba6df07b1c8573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
5a17bf9431ef27423c392eb5837c1925

SHA1
24aef6eebb2d5ef8fad2702cd8c6f4f925744dcc

SHA256
aa24f0bee5d51365950ddb794c3191d1fec39e4f05d57e48bd6a1df3b96a55ed

SHA512
8b3804a9a280e3702bc696b17caf27573b52b06da254ce5e263f6e501ff19012ab45d9aa9629a93ea1229bbdfc2e16a939ca8c1583be1abd370913f0ed285543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea37000359a20e0f0ab18532c1336e26

SHA1
579ac38c99affc65c6bd45224dc2d3aad9fc9a40

SHA256
4da68a847c054845cd3b5fd6cf9e57f5aeb92ac3372a717a80806297860d2a39

SHA512
da763806f9131305b62e3b2d3841793270e07235f809da80ebc635091fa76e5ae970879607e240093da57e65ea6f787f88d2b1ea26bce7f6e84b2a5b547420ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9aa58904514129707c3722cf8d64f226

SHA1
b9b4ef14e55a54fa2ef689bee00905bd96606623

SHA256
96335eafc41f569cc8624f4cd330e46f6c87dfce14006859453bdd6ccb8c4d12

SHA512
81d242f54cd70b078a58aa5a3b98d4aaeea0b874f373a38f1774dda38c094c1bb7c8a91a6e95b7c4aa6d5c5be3b943c6e3f735ac66af9b02c88578d841855a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
03eb4be44f826f866a20ca2cf0d6b270

SHA1
e4cc9eb36d4ab7b81413cb460e79cd0fde3b46c0

SHA256
70ee8d577bddd2ae9aa91a24b8ce58c1b0fce813692b98cf8a90d94829a1fe0f

SHA512
94de2496f8f7270c1d53a421833b631d74a3d6ab678f33db96eb848dd4494d91f55ccf085b6a22ac23b1614526f0990d3de30ab4a8d6b7af0dd5c2347c2610f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e0c8fda12b84cc4721930c5808824eb

SHA1
1b4ec73604de0ccc1b392ced1515da41e4060b3c

SHA256
f565a3be81ffe9c5a286edf93e8409855832b719508aa75797ecfa3edcbc38f0

SHA512
364a7eed371bea9a58f89185ce9ee7e7e05c2a9ca5f61d2b36a66d65c37036d6e7ae80cd4d5e3ba392e79f3aa99d97442baeed048f330a2576b7fde6750998f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f806f6cfa2605deb5ed0dcda3cd2150

SHA1
5a9debd62b48d0a341757455cac8b92147c69558

SHA256
4318f83d3c64d7bc50d99fab5f336c03ed58b56e3904a6efbf8af32035332c04

SHA512
040df660218c2e47fe6f6424d9029640fc157a6643c8a0aaaf5c9334583a859a86c7def6a8746d769aa5873b6ce7ccb6f1d8a0608742b8455e3d4358ce401d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c0dde55f002343a0776786d6f682f882

SHA1
a424873161bc9da0f873e242a6107a20d3311ab0

SHA256
cfa636b2d28387375935d4fc8d095bdf1d4c4201e9a84a7de5024f78e5f64f4a

SHA512
bf9288cf87a482b8571d97a2c73b9647b6756cb5c52c6b44035c838013e835d18c3f5290c6180455a05a2e3bc25ab78dc0b5c6e1ee2d6901ab68980cdb71c004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
2d09bd6f7d1c89d08ee4ddc1fc428861

SHA1
646cc057f822b6d91409cb3894fa11247c6de8c4

SHA256
cc63703539edd07d57f1d2ed3b7965bcd994eb7d9e557440be24218f08cc6115

SHA512
2a1f831761539f43d7699607f0e1b45894911f7c38c828be5091f0cca033f4a923384a00a1fa57996ed7a935201bac46c7d3308e3063277f559a2f246aa58295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
3544807fa9dd6fdd7b1bac0d94c0de2e

SHA1
ff37847837323782df9d6c8a882081c0840a4146

SHA256
92b8d532fae95f911f74fac9ea1b90feec23d3e8b9669edce06d7155cc1260d5

SHA512
3f252f0019fc34479ebbba036de8895d581b7989f651ce30274a4b3e204dc0a7d20aa2d13b57fcda5ad1225849ad67f00cecda4077e7978b2a0f753f54322428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585196.TMP

Filesize
202B

MD5
1acb3f15fc33f73ad9e32077040c560d

SHA1
d6547d8e72781c62da030469c29cbaf3087914b7

SHA256
644fb66042ec986e81e4548088ee465684f7d57cd15790efb49f0892ff6c8f2d

SHA512
3c7ffeb2dac37e5020c7d98da7dee172671a97bebeffafc825bc271bd527900280fec55aabcca0f50d51a904a28884ebbe246bf1c3c9fde5f18397876d65c5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3dd80dfc247b798ff4bc686356b5fd5

SHA1
05fb940f9becb128b2277c35ffa79040237ff437

SHA256
7ccf989797202a279d5aa360ffc7d126cf79f05e96794957bf517b318d17bd7a

SHA512
942392b906bc7de4fc030215de450d85da91a77b1731db9d856fe18ce6da3ccbd261ca9a9f9dab24a4093ef4e30f4ebfd9c565afa42d2b8a729f04864e64e5fb

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
582B

MD5
44d32d291ff5c90816edd9edcdc65b4f

SHA1
c5c8de3af1ba68ae7c75d3453b6b8d23cba6694b

SHA256
6fae20021a778042b12f961390624e8db6281e424ceb141c27a8abd4ce72b3f4

SHA512
bff5b04cae7c9ccd82648211d43eef28473f1a2d2fa17aceac9f170bf15414740367723d2f4d760a8b816e4e5fa711bd3bae8b2df9a0626aee504d13c9715f53

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
533B

MD5
4995f42698cc5ba9256bfd15411db564

SHA1
5079dc3a7f464eb7f6f909daeb22856d1738fdd7

SHA256
52407f97a6a9d5dd11b5c314f4d5c956adf85546e289f30f17d402a726842b48

SHA512
ec819003c959f23f68414e42b693dda36b61fa53faaca205ae2057b5704bc6369bba4252ad3a281f011c96a23ed1938589d2ebc22ac1fd350ef31ac07199fb5d

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
17B

MD5
2d555c2a9bb033bcce537b6c03758cae

SHA1
1c20492085f7d5dc4d23a87aeb83117522098de8

SHA256
b9bc561d609f9f68caf4a9a4278a52b2e9940a9ad89e6225b5e8b92c06a186b2

SHA512
0130a1f7277dee607d8a659438cef2a1c036e2c73e4b55c02056798acfc9032eb863084ba26764bedb879bc6a6ba503ab8eae74497d9877ed13a2440022c6d72

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
memory/384-456-0x00007FFDD9200000-0x00007FFDD9211000-memory.dmp

Filesize
68KB

Download
memory/384-446-0x00007FFDEA6F0000-0x00007FFDEA701000-memory.dmp

Filesize
68KB

Download
memory/384-432-0x00007FF71A4D0000-0x00007FF71A5C8000-memory.dmp

Filesize
992KB

Download
memory/384-434-0x00007FFDDA980000-0x00007FFDDAC36000-memory.dmp

Filesize
2.7MB

Download
memory/384-435-0x00007FFDF0570000-0x00007FFDF0588000-memory.dmp

Filesize
96KB

Download
memory/384-439-0x00007FFDEA9B0000-0x00007FFDEA9F1000-memory.dmp

Filesize
260KB

Download
memory/384-440-0x00007FFDEA930000-0x00007FFDEA951000-memory.dmp

Filesize
132KB

Download
memory/384-441-0x00007FFDEA910000-0x00007FFDEA928000-memory.dmp

Filesize
96KB

Download
memory/384-442-0x00007FFDEA8A0000-0x00007FFDEA8B1000-memory.dmp

Filesize
68KB

Download
memory/384-443-0x00007FFDEA830000-0x00007FFDEA841000-memory.dmp

Filesize
68KB

Download
memory/384-444-0x00007FFDEA810000-0x00007FFDEA821000-memory.dmp

Filesize
68KB

Download
memory/384-445-0x00007FFDEA710000-0x00007FFDEA72B000-memory.dmp

Filesize
108KB

Download
memory/384-447-0x00007FFDEA2D0000-0x00007FFDEA2E8000-memory.dmp

Filesize
96KB

Download
memory/384-448-0x00007FFDE9C10000-0x00007FFDE9C40000-memory.dmp

Filesize
192KB

Download
memory/384-449-0x00007FFDE9BA0000-0x00007FFDE9C07000-memory.dmp

Filesize
412KB

Download
memory/384-433-0x00007FFDECD70000-0x00007FFDECDA4000-memory.dmp

Filesize
208KB

Download
memory/384-437-0x00007FFDEAA00000-0x00007FFDEAA11000-memory.dmp

Filesize
68KB

Download
memory/384-436-0x00007FFDEF870000-0x00007FFDEF887000-memory.dmp

Filesize
92KB

Download
memory/384-438-0x00007FFDDA580000-0x00007FFDDA78B000-memory.dmp

Filesize
2.0MB

Download
memory/384-452-0x00007FFDE9B60000-0x00007FFDE9B71000-memory.dmp

Filesize
68KB

Download
memory/384-451-0x00007FFDE9B80000-0x00007FFDE9B91000-memory.dmp

Filesize
68KB

Download
memory/384-450-0x00007FFDE67F0000-0x00007FFDE686C000-memory.dmp

Filesize
496KB

Download
memory/384-473-0x00007FFDDA470000-0x00007FFDDA57E000-memory.dmp

Filesize
1.1MB

Download
memory/384-472-0x00007FFDDA980000-0x00007FFDDAC36000-memory.dmp

Filesize
2.7MB

Download
memory/384-471-0x00007FFDECD70000-0x00007FFDECDA4000-memory.dmp

Filesize
208KB

Download
memory/384-470-0x00007FF71A4D0000-0x00007FF71A5C8000-memory.dmp

Filesize
992KB

Download
memory/384-453-0x00007FFDDB5C0000-0x00007FFDDB740000-memory.dmp

Filesize
1.5MB

Download
memory/384-455-0x00007FFDE9AE0000-0x00007FFDE9AF7000-memory.dmp

Filesize
92KB

Download
memory/384-454-0x00007FFDDA470000-0x00007FFDDA57E000-memory.dmp

Filesize
1.1MB

Download
memory/1072-422-0x00007FFDECD70000-0x00007FFDECDA4000-memory.dmp

Filesize
208KB

Download
memory/1072-425-0x00007FFDEF870000-0x00007FFDEF887000-memory.dmp

Filesize
92KB

Download
memory/1072-421-0x00007FF71A4D0000-0x00007FF71A5C8000-memory.dmp

Filesize
992KB

Download
memory/1072-423-0x00007FFDDA980000-0x00007FFDDAC36000-memory.dmp

Filesize
2.7MB

Download
memory/1072-424-0x00007FFDF0570000-0x00007FFDF0588000-memory.dmp

Filesize
96KB

Download
memory/1072-426-0x00007FFDEAA00000-0x00007FFDEAA11000-memory.dmp

Filesize
68KB

Download
memory/1168-413-0x00007FFDF0570000-0x00007FFDF0588000-memory.dmp

Filesize
96KB

Download
memory/1168-411-0x00007FFDECD70000-0x00007FFDECDA4000-memory.dmp

Filesize
208KB

Download
memory/1168-410-0x00007FF71A4D0000-0x00007FF71A5C8000-memory.dmp

Filesize
992KB

Download
memory/1168-412-0x00007FFDDA980000-0x00007FFDDAC36000-memory.dmp

Filesize
2.7MB

Download
memory/1168-415-0x00007FFDEAA00000-0x00007FFDEAA11000-memory.dmp

Filesize
68KB

Download
memory/1168-414-0x00007FFDEF870000-0x00007FFDEF887000-memory.dmp

Filesize
92KB

Download
memory/5052-392-0x00007FF71A4D0000-0x00007FF71A5C8000-memory.dmp

Filesize
992KB

Download
memory/5052-393-0x00007FFDECD70000-0x00007FFDECDA4000-memory.dmp

Filesize
208KB

Download
memory/5052-395-0x00007FFDD7350000-0x00007FFDD8400000-memory.dmp

Filesize
16.7MB

Download
memory/5052-394-0x00007FFDDB580000-0x00007FFDDB836000-memory.dmp

Filesize
2.7MB

Download