hxxps://chromewebstore[.]google[.]com/detail/free-robux-generator-unli/

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://chromewebstore.google.com/detail/free-robux-generator-unli/

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4944	vlc-3.0.20-win64.exe

Loads dropped DLL 5 IoCs

pid	Process
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico	vlc-3.0.20-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	vlc-3.0.20-win64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc-3.0.20-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.caf\ = "CAF Audio File (VLC)"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2ts\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\Open\command	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u8\shell\PlayWithVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4p\ = "M4P Audio File (VLC)"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.iso\shell\Open	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.oma\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.pls\ = "PLS Other File (VLC)"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.gxf\shell\PlayWithVLC\ = "Play with VLC media player"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asf\shell\AddToPlaylistVLC\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpc\shell\Open	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u\DefaultIcon	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx\ = "VLC.asx"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\AddToPlaylistVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpga\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.gvi\shell\PlayWithVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogv\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.thp\shell\Open\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xspf\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tts\shell\PlayWithVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ifo\shell\Open\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.pls\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpc\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp4	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3ga\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\.3gpp\ = "VLC.3gpp"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogm\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aifc\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cda\shell	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2v\shell\Open\command	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.evo\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.it\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg2\shell\AddToPlaylistVLC\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3gpp\shell	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.gvi\shell\Open\ = "Play"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\ = "REC Video File (VLC)"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rm\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2ts	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cue\shell\ = "Open"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nsv\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xa\shell\Open\ = "Play"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rpl\shell\AddToPlaylistVLC\command	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.drc\shell\Open\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wvx\ = "VLC.wvx"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dts\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asx\shell	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\.3g2\ = "VLC.3g2"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4a\shell\AddToPlaylistVLC\command	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wvx\shell\AddToPlaylistVLC\MultiSelectModel = "Player"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogv\shell\Open	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cda\shell\PlayWithVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AAEDF0B-D333-4B27-A0C6-BBF31413A42E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3ga	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.au\shell\AddToPlaylistVLC	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aifc\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogm\shell\AddToPlaylistVLC\command	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogv\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.20-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vro\shell\PlayWithVLC\ = "Play with VLC media player"	vlc-3.0.20-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wmv\shell\PlayWithVLC	vlc-3.0.20-win64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 149644.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4464	vlc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
1656	msedge.exe
1656	msedge.exe
4632	msedge.exe
4632	msedge.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
4944	vlc-3.0.20-win64.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4464	vlc.exe
2504	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
4464	vlc.exe
4464	vlc.exe
4464	vlc.exe
4464	vlc.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
4464	vlc.exe
4464	vlc.exe
4464	vlc.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4944	vlc-3.0.20-win64.exe
4412	vlc-cache-gen.exe
4464	vlc.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe
2504	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4068	1128	msedge.exe	83
PID 1128 wrote to memory of 4068	1128	msedge.exe	83
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 332	1128	msedge.exe	84
PID 1128 wrote to memory of 3640	1128	msedge.exe	85
PID 1128 wrote to memory of 3640	1128	msedge.exe	85
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86
PID 1128 wrote to memory of 2196	1128	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chromewebstore.google.com/detail/free-robux-generator-unli/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb57d46f8,0x7ffcb57d4708,0x7ffcb57d4718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=1856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1856 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Users\Admin\Downloads\vlc-3.0.20-win64.exe
  "C:\Users\Admin\Downloads\vlc-3.0.20-win64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4944
- - C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
    "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4412
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
      4⤵
      Modifies registry class
      PID:1632
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\VideoLAN\VLC\vlc.exe"
    3⤵
    PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,1950028964838663434,2360992119230041479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2364
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\plugins\plugins.dat

Filesize
307KB

MD5
d3f405c7b76b740c1ae369c9b8e878fd

SHA1
d04d842e7929d67b202cfa8afd4faf3a3c4d75f5

SHA256
54acaff2932473ad3f1da095e885349598c37777989c9cabea2d9a8733172954

SHA512
e5af1392a8a2c68f00a1eea6bd652950d7b6be485978263bcf0e00de10a69a227f06881af855e482978d0d4a65a22193fee5f8b0c8fe4a1dab70474ef4c33948

Download Submit
C:\Program Files\VideoLAN\VLC\uninstall.log

Filesize
43KB

MD5
446aeab4d4d305de67976af0a1b0b2ba

SHA1
bfee64b6bc34c47b87ef1c1bf6e5957571055947

SHA256
e3a113019592ba069a90ca7e28dba8c6ae9a646e785fbae7dc2d29765b7ff5c7

SHA512
b20b8873d2684c7106f77d9d11d9a1b156efb16bb6e9651c650c109733e4dfe5edb92d3b851dafa985eb4e9820cce1b0ecc4f11b67867e43746bfec9150691bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
41KB

MD5
ed3c7f5755bf251bd20441f4dc65f5bf

SHA1
3919a57831d103837e0cc158182ac10b903942c5

SHA256
55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d

SHA512
c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
dbafb0cb413105f5a09638f91700a3dc

SHA1
b6f83472d24400a8edaa189954060075f42c0b22

SHA256
d25e5e370a4eac6d67fef9039a715b0da3989d91f6f72c257bd70e1d64c586a4

SHA512
e8d6b091ce2b2f9c26ff928b66fdb644d2c1b23d6a71bba81b0554385f7e48aa91071ea3821f00f761a59de267b1c045f8451851e26aaa39701f770560ebfea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
255a40c132a0616ee165bf6415f326a0

SHA1
5cea743097b4670633dc6c22663a319d6a26a448

SHA256
743dd32f8b1f4ffb80797aa919efa59a46f3dfb42cddb31969c60096145ed86b

SHA512
823cb4586593f468d181c5f9ff28b548e7dedfaa59449d2687bd3868eae75e82893011a9f62840907150f518d630b144a9222ede6edd3e1417f2f03fe59b244f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c230b302d9fcca39b15bd2585781223b

SHA1
5a946dc343e6c3861e6fc760eeec3c474518d6a6

SHA256
988551832cef7b8e713e560dde6647f0723df77f3b66f744c107b23c96262d70

SHA512
e351b7437b57ea3dd8a535a939b63ecbf164e8650250d6c4be2040f4fcd779bc054dbdb723f06a193601ad8f33d34424a28ffb530d260f21f850cfb57954788a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
61fe30cf627986fc91a41e24477f2285

SHA1
0144d4d9f840ce1f1b8fa59335ee3544b08b31c7

SHA256
ee1a2ea0878a0eba7d84d6415a19c79818d639571f07354bfeea8c7989d76ae3

SHA512
8436dd20261aa1a37e3b21a7538cc916058514c63482cb79b324617a27d1364dde6906d99691284c4109a4dc9faff05dea2b6c4950a7926bb8eee692c82ebb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
48410ba1f2db81c6c9410bc057078dd4

SHA1
5a360c11dcb817ccd4024b6c337fb4ddd6abc297

SHA256
042d66005821ef1bfad362968e2586a06dd1f3a9fcac5cd9ec01ae8c519df62f

SHA512
006efd23ff936ec16dc1a89b0c4c189986a5e5a0f71d826b61227045af8d45adb966f37d3abd24dd90311a3d78c45b423d6c410a7e28bce0d06ec19c52966400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c05fb859ed8a73cda4062fd88f52f23e

SHA1
c1348d1bebfa0de4281a2bb2cfab168b87ee74e7

SHA256
3bad5356a11116e339a4329ed29f13ca486df965fb084e009861663a817419fa

SHA512
ca58a5443c0b89df1fa098d27c8572c2e6ead4577a4bdaebcb37ab3c576d109120b1bb6dba7ed41f60b64800a118a7e1d9d6cb4666539578c56735b8231afdec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a43e6ed2da54b1a0f27e7e1d8a06c2b6

SHA1
0dab5be1fddec951b262cfd8832e47c6ae049d3e

SHA256
0f73d5620fab9b200e77fa420670ee61110f5e4af895da1096dd1e5cfbc7809a

SHA512
2dbd67d8a5e9c5cb98a2c125041e07d5c1780e1d0f4c7880cae9d77f7e69b7e041cdf546436f16849dedcd6e021d13505b2285b354b838536e5921299bbb5cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
658e58e26583e2dcb1dbf4071eab0679

SHA1
fe9bc12135e7503025ce109ed47ad05ab107980a

SHA256
0aa4ef497e0fb1e8b998dd6b8ae7407a185090b5f8c933073d00d50015a2c93e

SHA512
ccbc2357bb6cbfc2f1265a9438d0a21017c9e2084cf30c4b0ffd81fcf19cdf039633ed715d17d0862f4e2723532e7c58cf66dd43f310bcd5e7d90f2fc256a199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
011aefaab108b06b7da0e9bc68440dcd

SHA1
6dc00c0edcbbc1ed54b492c5cec14b22bad24eeb

SHA256
97b10ad2020bb9e7d281c717c4194017b0274aa1f590531cb1f4ea2546a70a3e

SHA512
c4d12e5d3672cf860e2e0f18ae113cbae3b6994659faab4cf9220da340bbf785122c4ae94a8230a202dd93d5c5a7ae224dddeee076ad594b45af0d0ddbc12b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d0e7ad2a306f3d1545a9844efc1308ce

SHA1
88658ac38332b73d0f079c4210ca32eb6d4ad2f9

SHA256
8d649dc9f58fea5a243d2918dd8b1b8e2179b2544619bf928db3451bc3ba4fca

SHA512
1b564513ebd2325bf59b0467eeac0508b7a2aa1fc7a0c9f70df1d9bbbec48b3f5f837aba914fffd9575a7a37199e683d8428c4c4781dec37ccef2daf55a6668a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
576f521e728e618a193a9c3edd8d20b4

SHA1
4673e64409928ac7775ccc902a82c489bf500d9f

SHA256
5a0e950b447c269688916bcd87a28f012af75db38bd4ba3926a11185bf8d8b6e

SHA512
8617984e8044589b5e2a5d79d0f20b4c41b711b0ba1a552abfa65375de5f3ee33062c195389b51211f331f4d2159b4ea2e7376885fd83bea2699b628f15dd492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d88248ec6970c590fe7d42412384c3a

SHA1
c7999ab75c32a040730cd740ff2b7bd2f76187d5

SHA256
a38c3e7c0a5b9a627af09132f009e43e75d15a022f51fb11c66b239580d682c7

SHA512
bd7681f9897b7387f3fc44e441ee52a0e08b047c65070f63e136adecfa29c9ec0c1c2299216b9b3f4a0e25ce8ff65278cdee03b5279b280c941de680f05f5694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d55fcdf3df4065ee038c9d7fec748ec0

SHA1
60e1c5ebf16d8caa61ea0ee6d29f7d0721854737

SHA256
0fb05756cf2894244ba4bc46dbc86a985218f67b19fa0b409a0f85610b19c192

SHA512
7baeefd7385de1a034a4184a87911da604d14505b5319db757dd4708bb87e55b28f56c759b1f7c8bf97775c2dfc6d81a349f4759ba8d616d7f3cadd380515f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f30f3e3d8a8df61c7eaf1c11624d1864

SHA1
3dad12825c498c4ddda5bd2808b217e3a45e2a6a

SHA256
5db40b2ba8f3f7700c1cca1eed4d10054fa2a102bca7396b6dac59f3b21cf8aa

SHA512
9a35e396381976ab1b13b21382753c92081fbc6655092ab41e581b557e29435590bc4bb9e4ef45cd635ada75c929360727c3462522e2a3ace403d32d3aed9593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
00f89fd6eb998b29d0babf9b306c362b

SHA1
0852244493bff0340c17bd8ee3af7451df48e916

SHA256
286c5a237294a519ae0aa6d9b586754d7979dc3ce491f47d0ac57144f1c7f91b

SHA512
d3cd586a52f06508f890464e8a369940933a774f637e78635a904fc6c3c4b50b611cc1783e02253b085b018331a148b241ddd31622585b7401cdcffed20e308b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
abf4e49a861d7bc113aab8d4b09761c0

SHA1
c3ea24ea74d2e174f976d450892011b67a32c3e1

SHA256
9976850f114231f9215a9aa6b95cc73354d47680fa38318a8da4a2ec9177c8fa

SHA512
01bdd1517b7f56cb408a57c94dccf79f3f878f7d41c9965c80042bee9cc8b1fd26b126a83918522ca9e381b3e9a548a1a255bb50023f7daba7db579d17bf0c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829f9.TMP

Filesize
701B

MD5
4d827fe886a63a8721786de75fcec8f1

SHA1
cfc656ecc441180938522b15ece6b854cb46950a

SHA256
7304fd2e02ace9e01a54605ec499794d792525897f71c852b803a48ad67d1ba3

SHA512
0576c0d9d6aa5cf7f605055835db29019ad066bfb7edccfae4a8d043c530270e3e2063a8726d1ae02e451007c3a0d29014e6f0743443a90b9e05131cfdb7b991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f9979a74f4ae08299fbe3c72933185e

SHA1
61700e9ca32a24b8cda7213c4b38c5707af8f3d8

SHA256
593ca75022d3df347c54798dfaea04ccf161eb7706b3d3604728e908507c1884

SHA512
5cffe9ba7214fce2fc982628896850e2c1fd0d20d88fd137fda130425fb34606d5e156f8b09fd51072e61e7c9f87164bbe986cfaa613753b4bba01444aa7e328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5559a61f67687d3fdb55dddda1b10b1f

SHA1
dee801fdd2820190b7b9d71dafd7397da3ddd963

SHA256
c0ecec7be0f8c1556d341da3f586e31c3f0642f17dd21c6c8ea6572c84106988

SHA512
fcf588b29f585a60da20155001b627479464307cfbdcd5b4cf05ce64168efba52b32f02a0d0b1ebb10951895a12cec4768ed6c25a2a902dc87a6d8ffa99cc1a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7630a21ffc21a453092e8a6a208bb840

SHA1
d6279911fd2279a7c35f8f9ec6bf7268acea45e2

SHA256
b1381b0401db4eacbed3794c7bf4e4a9826227dd44e5e75a581178f31b05e32a

SHA512
1eb861e8a68b2c72a18a8bb451459c0402814dfa2e4760d002d940e5a3264852d16d9bd20e29a367d0ed01709862d11cba051c3c72ac3546e8fda76368c7f056

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqAB22.tmp\LangDLL.dll

Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqAB22.tmp\System.dll

Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqAB22.tmp\nsDialogs.dll

Filesize
12KB

MD5
2029c44871670eec937d1a8c1e9faa21

SHA1
e8d53b9e8bc475cc274d80d3836b526d8dd2747a

SHA256
a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2

SHA512
6f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqAB22.tmp\nsExec.dll

Filesize
10KB

MD5
dcaaa39e47a9144ae10ee67b3183f4e1

SHA1
2af87fcebff57411e929dd2fce767e9a1e4d98e1

SHA256
da30c0f57a8a412bdc0fca182702f568bd91007475d1823464658fa523a4af9f

SHA512
d56997d74d841d01c62b7db4150729f395b57d065a1182249483640f80720fb6dc7a457cc3a23367982f92f85e9274507d6157f698a2e22ea11266866fb1bc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqAB22.tmp\nsProcess.dll

Filesize
35KB

MD5
764371d831841fe57172aa830d22149d

SHA1
680e20e9b98077dea32b083b5c746d8de35e0584

SHA256
93df9e969053ca77c982c6e52b7f2898d22777a8c50274b54303eaa0ef5ccded

SHA512
19076205eba08df978ad17f8176d3a5a17c4ea684460894b6a80cae7e48fcae5e9493ff745d88d62fd44fc17bcda838570add6c38bebe4962d575f060f1584f9

Download Submit
C:\Users\Admin\Downloads\vlc-3.0.20-win64.exe

Filesize
42.4MB

MD5
3d63e3a94c39a18f4da866b896b41e80

SHA1
c9520268936bfa6d060c8603cdee753db214d0ce

SHA256
d8055b6643651ca5b9ad58c438692a481483657f3f31624cdfa68b92e8394a57

SHA512
9dfcdeca8fbfb655d3a4a8d0297fdc7f4c34a46c1b4238436d6e51e8621cbcd866ebfbd2a738a50dccdcf18d162b213b086a5e2a720205751ae07147e800838a

Download Submit
memory/4412-797-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/4412-798-0x00007FFCBAFA0000-0x00007FFCBAFD4000-memory.dmp

Filesize
208KB

Download
memory/4412-799-0x00007FFCA6440000-0x00007FFCA66F6000-memory.dmp

Filesize
2.7MB

Download
memory/4464-845-0x00007FFCBADC0000-0x00007FFCBADD8000-memory.dmp

Filesize
96KB

Download
memory/4464-865-0x00007FFCA6360000-0x00007FFCA6616000-memory.dmp

Filesize
2.7MB

Download
memory/4464-846-0x00007FFCB9EC0000-0x00007FFCB9ED7000-memory.dmp

Filesize
92KB

Download
memory/4464-850-0x00007FFCB4FB0000-0x00007FFCB4FC1000-memory.dmp

Filesize
68KB

Download
memory/4464-849-0x00007FFCB4FD0000-0x00007FFCB4FED000-memory.dmp

Filesize
116KB

Download
memory/4464-866-0x00007FFCA3E50000-0x00007FFCA4F00000-memory.dmp

Filesize
16.7MB

Download
memory/4464-844-0x00007FFCA6360000-0x00007FFCA6616000-memory.dmp

Filesize
2.7MB

Download
memory/4464-843-0x00007FFCBAFA0000-0x00007FFCBAFD4000-memory.dmp

Filesize
208KB

Download
memory/4464-842-0x00007FF73FA70000-0x00007FF73FB68000-memory.dmp

Filesize
992KB

Download
memory/4464-848-0x00007FFCB57F0000-0x00007FFCB5807000-memory.dmp

Filesize
92KB

Download
memory/4464-857-0x00007FFCA62F0000-0x00007FFCA6357000-memory.dmp

Filesize
412KB

Download
memory/4464-847-0x00007FFCB5810000-0x00007FFCB5821000-memory.dmp

Filesize
68KB

Download
memory/4464-864-0x00007FFCBAFA0000-0x00007FFCBAFD4000-memory.dmp

Filesize
208KB

Download
memory/4464-851-0x00007FFCA3E50000-0x00007FFCA4F00000-memory.dmp

Filesize
16.7MB

Download
memory/4464-863-0x00007FF73FA70000-0x00007FF73FB68000-memory.dmp

Filesize
992KB

Download
memory/4944-838-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4944-824-0x0000000075160000-0x000000007516B000-memory.dmp

Filesize
44KB

Download
memory/4944-822-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4944-784-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4944-785-0x0000000075170000-0x000000007517E000-memory.dmp

Filesize
56KB

Download
memory/4944-786-0x0000000075160000-0x000000007516B000-memory.dmp

Filesize
44KB

Download