hxxps://drive[.]google[.]com/file/d/1AHIHOopROTZPm08llkFZjJdHIa6GRKuG/view

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1AHIHOopROTZPm08llkFZjJdHIa6GRKuG/view

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com
1	drive.google.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	744	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\FPSAnimator_Playable.rar:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3076	vlc.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
1052	msedge.exe
1052	msedge.exe
2468	msedge.exe
2468	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3632	OpenWith.exe
3076	vlc.exe
2108	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	744	wmplayer.exe
Token: SeCreatePagefilePrivilege	744	wmplayer.exe
Token: SeShutdownPrivilege	404	unregmp2.exe
Token: SeCreatePagefilePrivilege	404	unregmp2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe
3076	vlc.exe

Suspicious use of SetWindowsHookEx 57 IoCs

pid	Process
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
3632	OpenWith.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
136	OpenWith.exe
1444	AcroRd32.exe
3076	vlc.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe
2108	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2480	1052	msedge.exe	80
PID 1052 wrote to memory of 2480	1052	msedge.exe	80
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 3604	1052	msedge.exe	81
PID 1052 wrote to memory of 4524	1052	msedge.exe	82
PID 1052 wrote to memory of 4524	1052	msedge.exe	82
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83
PID 1052 wrote to memory of 4652	1052	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1AHIHOopROTZPm08llkFZjJdHIa6GRKuG/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb37df3cb8,0x7ffb37df3cc8,0x7ffb37df3cd8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8272965220839042766,3135320458003746756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3632
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\FPSAnimator_Playable.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D597D1E750DFFDD65408EFEB55F4ECB --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:992
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7D8FDFD89E77CE0E5C970E8035E2D0C7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7D8FDFD89E77CE0E5C970E8035E2D0C7 --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A01C314CE6E19726CA73044835728A7 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9079911708C789C300E70EEA45E3657D --mojo-platform-channel-handle=1924 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=90ED356AB47586B8EF29BCED57ED2CA6 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:136
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FPSAnimator_Playable.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2108
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\Downloads\FPSAnimator_Playable.rar"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:744
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 1196
    3⤵
    - Program crash
    PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 744 -ip 744
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
cc64bef63991cf90d8ac0c15659742eb

SHA1
c958ef3335af13fc9c355600f596e8e89d79ac94

SHA256
70ab1a508899b3d98024cd356e7b059e7de094e81be9de23fd64d0b9ed661fce

SHA512
b42ece877d70279a86d4e4f10e614ad353bdce3fcbf47cf9da8c0f6b57897d1b7f2dc2469ec8d81056fcf496973dcee2fc96387451ae0a285b9d7b49935af971

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
593339bf3733c764cb68618cea2cee6e

SHA1
38be5935390b4aceeb3dc98c3c17db3ee30fb574

SHA256
a683c862c6404a91889b4fade8d76097989558e6a5623954021f5eff1ede00b1

SHA512
128736805ada83bc772911d5cef2ab4ab65070dea02e18181b92cf681356891186407c64eb7a6527de2b839b31b91a9c322c234690845ab2ea93ca61b3d13cca

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
107673e8b0ff4c2766066f980a481236

SHA1
ce7e5ca8041923fe6d9678bf0e1732756c54d580

SHA256
d2ca4569b8cc187b09f8c060f583d310a8f8944586aa28c83f1499900ec6512a

SHA512
54e9b71362de1b0ba56845a5a9e948876ab96d4117d91d46fb12727c2596fb700277a057b6394705317075c30aecb534afc0563a7426176e7e1cd3846aa097bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d8cff2b77fd5bdc6cb3eb238e8f11dc2

SHA1
e99ac7e953943b03a30dba4df6f1f39411d38fe1

SHA256
40882f8198c76c2c3478127b6074664c9d61c06659001e77893f41ad5924a45b

SHA512
f6bc06f0d19dfce0b27950e43e78bfe463c93536275ab20966bb73eda4bb9b7bc0c6d21ccca81f7f338d4b7c427404c1f9b8166a4d289e191016622cffdcaa06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0401d8bc545e2fa2fed771ec40f63cea

SHA1
04417be2f549800ca4340d2763d76f83c46e7f5e

SHA256
cdbac977f96571a9bbc614f9f8898cf50c25b3b8dc7070a985171686a3baaba3

SHA512
79fd371c354c6a01cca66c9ff6d64926536b7efec434f4313e1040ef721e812ebaa97b673457f8eebe2e371548ef709003d75d16850ef3601c75d0559fda105a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6cac406e6d049c71ebf7600b29c95e3f

SHA1
84f60435ce335fd4f63a9fcebfa77eccc51b8df6

SHA256
f7b417fdc513622704065b8bd2436b02431f19f7495ccc1aac73b7f3dc72c989

SHA512
1ac6b615192aa5ef7539640d36716049854a34eb42ec66e0cbb88c98beeedd508ea5a2b5508203b6c2f44e91ced23d0c44fd9171bb6ef8f72a69033cb97323cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9c4d81fe7ef1b34f05b4216e3198604a

SHA1
3dca194c628fc579e3e6a14485488e17cf5d2844

SHA256
9aba28601ce5bcf3b89d359143512fa37b252ba9bad7baa67c40703e5e56efd3

SHA512
f647c3bd090c7cae05631af3241e60e352b1d97fbdde9c1659fcb27d86ba4ac00f91265ed9ca4c07ecf0009f6ba494bacdd641b8540ee3ea0eb958a51685a11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7aa50a86b1ef3969dace38f46fa3e161

SHA1
ccd3c48030aa0b42fe3b5e4a84f3b1401d4036f1

SHA256
b0a29ec5eed05b480b4918b124d86127e6577b2579f456dd52dd586a6a4d5dbf

SHA512
64ec18a786b97bd05c5a0052b128c8c31c3c0d8297c6ac9092186f4c5b3423ff212f4eca79b74675665cafc3a7e8c9061d27edb434b2ebee85f3faca15097626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43a864c00d62bc056762304d1d24c87b

SHA1
fa99ceb62bbd4b674a29043876d37b22c953c64e

SHA256
663c4ace31a4623779b3c5f73cbf8130910abf99f6a6a9571174975f3eeb8d6c

SHA512
ba3daa1e8c5bc6a3f0536a72b4364fa30c110c4383610f543d3ad199841ff31e26c7fcd1090861f0a8e5f4ee1572b68fc158149201cde10d9c945f2dae42448d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bad7b0d539a3170969c1ba35670a31d4

SHA1
79b318367605077f086c5623d0f85f243e57b100

SHA256
e9c225bcb5a5e3b4c59d68e977a003fccfafbbd96069649925c5f679849eb067

SHA512
4824a4413de2f788049c8ad687800486d029d818534ab9c5187fefdcb975070bed1a65a78c3ef6e0138ec7c5f7e076bb76685abd0eb8af525c6bf042d0fc469e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2132661966bfe9adfbedb3dfa82a2f8d

SHA1
c876a986d2d03ab49594eca44f503efb38f1b591

SHA256
2bd3918f295fa30c85d6a539751b52076532944d3662eb648802b1c79fe39021

SHA512
61e9e859978e44998a1b5dbb9986ebe01d26ee62a60b0cdc7bfe4269b60ff5413131872f46393659abc36aab719bd846d4ee9ccf94075d011720cefb777b1d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
78079365014f15dfde76de7cebdde1d0

SHA1
acbca2645fdd9ab30b4ce6d49d3a4cfd39270224

SHA256
f21c3720d278ffe7f97a794a0e437337ffb6749b5857f2953367abfcf44e1a62

SHA512
ac1e67402704f813b795173960d4a3ad047aafbcbb07b9a1c7449e78c0f84f6965c83b40330152b708187bb21396175fc06c725af4e0ef7fcb1f239cec1e628a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5998db.TMP

Filesize
1KB

MD5
aa37d9bed7227b5419586b7502dd8e57

SHA1
154aae5746d7c8150385dd19a6edd5480be914d0

SHA256
0c9110fc0dd0ecca3ffd581d251688fd923cb3e895a5b97e63fe36999210c6bd

SHA512
fc8bea29fed96417e57141878af12169412a1ea98e51a2959e716b58408321a3cde47282658259862f4067cbd1b6e099cce11c727280d92c9ae44c32122fc5a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbe6578e13154c56b5657bf471eb8ebe

SHA1
001c1531fe57357a15f6ee9724ef66115f5ec9e7

SHA256
aff5d2b65612a9d3fc272507bb141c952cce1f3e297e39815a3180592969e166

SHA512
07157014e9ca10989bca1c057d51c98c29ab8252e5a3cdb08412605fc64cdfa22ba8a3d4a729c1857f3d8daa6bdf2416e5e8d8977d87b612ea403346bb34328a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf7922c1e074f841c5c7b05b8bf3774b

SHA1
4ff851f2296b8ba88659264af13a644858b89dfa

SHA256
717000a9a61f9bd62cfe19e50df5c2cc0b12e4a8299b48a5eccf1c243882224e

SHA512
1660d51a1a09dbb270ca0179bb31daed09360d8b38efcb951eded7d3a60c2c1c508b5c009d62e83899a3e75d3d7ef624a99873151ff462551c6cd93a63840d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
093d2f7a3b35e0c7c71f43e4b794203c

SHA1
6960fb66611ffa6e02b05d282d853c97b94ecbdf

SHA256
682ece2ed52944a3bc7674864f50a9dd0a2171f24adaa7a77def72e6f1b8cec2

SHA512
56e41c64762f48a7b69e4c2f9c9a67c0d8bedf5c0de61bad576a70d85f66f022f97b464f59ea03bd768fd71245e5809206df7a43451804fdc64e90d6ccaaad1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
a90e66b429c083fff1601e745e6d28a9

SHA1
e8cff5d18831b9a878902072de69f6d40955cd76

SHA256
94ad6f79cf2ab5230b25a6df555fa411c74f245d692852fdf7ba7b6b7dd56a15

SHA512
7abc4bf71b3875e1825ef1c95ec42d9cfe99a773da3b917f929cb8aa0b310df5af4853beb3b800c9e9a07b3fd008214bc5552890c55360aeacd3ea6a69b30350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
f57f2a3d28af1be361ae0a4ff5ff739d

SHA1
45faaaba1677c3c0d7dbceccfbbf299e1b6c22c5

SHA256
d83a3e502dbd8dab86cc919e39dc2682e9d11152b5756e8b19c1a7b21ffc208f

SHA512
82f7a2c11afc500372eb0c0ba5585b05d97d26e7dc67e5c232fab89d33e2f250f1f223cd1ff6687625502ec79e7b49eb458a8400475651316bd91ba09ac6c42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
fe640100138409d7165ecfb526d9d94b

SHA1
ee298e57c6de374f8a945e38034b4be994f9f15f

SHA256
cf798cc96e5e390582e6070161ec519282797a48d9baf6f22e8b17142e78e242

SHA512
5a3581aa5e4e0fd216332e3f340408d0684151e1b517e2fdfba2b666c3595b386cc47871dc02b4e260fe0e70872ed79efec23da20944317e6b3f7ff409cb754e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.em3076

Filesize
87B

MD5
c7399842fc1c9263bc2e78bf40c8b533

SHA1
83f37bc6a334c5025bd2dfda8b1c6c6e0a36e5ea

SHA256
78991c92e9f2058648c670acc7d140a78d0bbb8f1d123e98955d519fee4b1f5a

SHA512
e3c5d5f74fd04e51f606e7d7b97808f2a6c30e8d354321d3ce0f28c1a88250024b951de7b79665a298e1783c225f3fdc1dc34e748b1f7c7c3a75d8e9bb4f6c26

Download Submit
C:\Users\Admin\Downloads\FPSAnimator_Playable.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/744-388-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-387-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/744-395-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-394-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-389-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-390-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-391-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-392-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/744-393-0x0000000009C80000-0x0000000009C90000-memory.dmp

Filesize
64KB

Download
memory/3076-339-0x00007FFB32250000-0x00007FFB32261000-memory.dmp

Filesize
68KB

Download
memory/3076-353-0x00007FFB36FD0000-0x00007FFB37004000-memory.dmp

Filesize
208KB

Download
memory/3076-340-0x00007FFB2C030000-0x00007FFB2C047000-memory.dmp

Filesize
92KB

Download
memory/3076-331-0x00007FFB23120000-0x00007FFB233D6000-memory.dmp

Filesize
2.7MB

Download
memory/3076-338-0x00007FFB36130000-0x00007FFB36147000-memory.dmp

Filesize
92KB

Download
memory/3076-355-0x00007FFB21E10000-0x00007FFB22EC0000-memory.dmp

Filesize
16.7MB

Download
memory/3076-352-0x00007FF74E300000-0x00007FF74E3F8000-memory.dmp

Filesize
992KB

Download
memory/3076-341-0x00007FFB2C010000-0x00007FFB2C021000-memory.dmp

Filesize
68KB

Download
memory/3076-354-0x00007FFB23120000-0x00007FFB233D6000-memory.dmp

Filesize
2.7MB

Download
memory/3076-342-0x00007FFB2BEF0000-0x00007FFB2BF0D000-memory.dmp

Filesize
116KB

Download
memory/3076-347-0x00007FFB22EC0000-0x00007FFB22F01000-memory.dmp

Filesize
260KB

Download
memory/3076-344-0x00007FFB22F10000-0x00007FFB2311B000-memory.dmp

Filesize
2.0MB

Download
memory/3076-343-0x00007FFB2BED0000-0x00007FFB2BEE1000-memory.dmp

Filesize
68KB

Download
memory/3076-337-0x00007FFB37180000-0x00007FFB37198000-memory.dmp

Filesize
96KB

Download
memory/3076-330-0x00007FFB36FD0000-0x00007FFB37004000-memory.dmp

Filesize
208KB

Download
memory/3076-329-0x00007FF74E300000-0x00007FF74E3F8000-memory.dmp

Filesize
992KB

Download