hxxps://www[.]cambodiabirdguide[.]info/video/top-x-2025/

Analysis

max time kernel
203s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.cambodiabirdguide.info/video/top-x-2025/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
468	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
4536	msedge.exe
4536	msedge.exe
1824	identity_helper.exe
1824	identity_helper.exe
2528	msedge.exe
2528	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
468	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1452	AUDIODG.EXE
Token: 33	468	vlc.exe
Token: SeIncBasePriorityPrivilege	468	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
468	vlc.exe
468	vlc.exe
468	vlc.exe
468	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1496	4536	msedge.exe	83
PID 4536 wrote to memory of 1496	4536	msedge.exe	83
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 1896	4536	msedge.exe	84
PID 4536 wrote to memory of 2568	4536	msedge.exe	85
PID 4536 wrote to memory of 2568	4536	msedge.exe	85
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86
PID 4536 wrote to memory of 872	4536	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cambodiabirdguide.info/video/top-x-2025/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe59d46f8,0x7fffe59d4708,0x7fffe59d4718
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VID_20240803_145858_389.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1267146544519695208,15949364217355257387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ea9da2d4ea8160128b678ddefce1ece5

SHA1
f83e440193208e9bb745523c6c7d3a3b11bd0070

SHA256
46e72f671f7aa5e774aa4a44be00a11bbe5b853f447dad6a5fb4e51d78d02fcb

SHA512
d27260e91b4bcad84f018ee95fe956e944eae45ba8ab0ffde17d98a05d8b6042e263c7d76149cb6aa9646cd72cc3a98c8c4004a628a27f217b7fb6bcaba11587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
746B

MD5
887eb26618405ceae66b7c874f8d3e86

SHA1
2d33c30d5a88a095dfda9ad724b2152896dfe1d3

SHA256
2f6243c7a8ff5d86dd4c49efa45d2776065e45ea49bf39ce78182b37d0e2ab53

SHA512
2910a09d2b6db260991e9821600b916dd90c95cb9108bca7532f8d00557b02732ca12526cde1ffb9f9e57d0e36ce117fb87d0d1204b211cb2bde3ff32cc881b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6362945f038237811848779b789b69aa

SHA1
6fd6aa386cc6fb63350c5b40f538ba68f5e05ee7

SHA256
3f6c37891b02c6c42dac4f1b069b80906e21dcc0803ace4e36278fedf612ee50

SHA512
c0ce3d9b61fc919bc2ec3f807cbe5eee3d2b6783bbbe44caa4c09d1cb1f4178156a6596549646a93c0937948080eb5071a68ca3be1f25778ca1c717cfe1a9cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09d2aaca516a4477ff78e04dbea1412e

SHA1
7a09709cde740814535534ae936568a953a07014

SHA256
fc3ca25b11fd6ce5137079cd2f8f5d76faecdc4eca9dedaf47c2474a52c53027

SHA512
8e37982ab08c959a3768777587f102491064764aac654497a22e50c53a2b3bfe16aa5be9046b637949e3c8e8edac9c0e7dd209dccda054acc02221c9e7675b8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11eb9e3e6f5055c4f526a073656d0aba

SHA1
f5d56f247056659e9b849adff2c67fb4bf6d9e55

SHA256
1a6c098092620b97c13a702017354cc07d829629ca73c774714bd7407f0ea2e5

SHA512
57933e89834054c05bc14911cd6c7ce29eba21364e79f46a121553df256ede32d7eba449814a588cc6e1e68d8a376d56b09c1d176ea34f1489f65fb004b7ad65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
919e874fdfb145df6554760f1e809eb6

SHA1
35598700a4a9f6e5229ac1695c52f5f2f6169db9

SHA256
90c855da6635e38f38a21ec2a78980c7e77de62d2f2e0a9fb28c1fd688601187

SHA512
2c68c6db76ac2747ede87f3c14fe77c917e1b5dffdf0f73316b7c1b250fe80cc1982aa252cd7f9d2fbbd8386dcbfd50d4aa8f3e61df2f8e7b22a1ab730585829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d17a7e793d7040bddcc15d3d0a53ccc

SHA1
05ea06c7a0ceb44102bd48436ec1634d7a79f0ba

SHA256
a92259404b3c73dea8dcb661bc9bf1cddb2ed8c1c8b4857e7f6e5f7b70fea16c

SHA512
d9c49385295a0ae87cdf57eec69a13e14d41adab6a69c0382c11020670987dc55bdc3b2c5212dce8c9e0a3e843d55497dad8ee5cb6fdb3b04f085c65d0302c87

Download Submit
C:\Users\Admin\Downloads\VID_20240803_145858_389.mp4

Filesize
11.5MB

MD5
a3ea67a54b234e0c5235e136594bece0

SHA1
3f48d5e787499cb197fa2eebf18ce869c6485807

SHA256
f9188d965543242208c0a8878ad9b061aa3efa1bc4ecad138534887df084713e

SHA512
8e76c81d5ffb70df6c6d622821b992f25eda54a07fb16fac16bce944e4a2c6600b5a091e2f2f0e0e7f23ca3eaaee66752c7cb32216ec1c70163a3cb0b895346b

Download Submit
memory/468-137-0x00007FFFD4390000-0x00007FFFD43AD000-memory.dmp

Filesize
116KB

Download
memory/468-145-0x00007FFFD4290000-0x00007FFFD42A1000-memory.dmp

Filesize
68KB

Download
memory/468-131-0x00007FFFD2E60000-0x00007FFFD3116000-memory.dmp

Filesize
2.7MB

Download
memory/468-129-0x00007FF651F70000-0x00007FF652068000-memory.dmp

Filesize
992KB

Download
memory/468-139-0x00007FFFD2C50000-0x00007FFFD2E5B000-memory.dmp

Filesize
2.0MB

Download
memory/468-136-0x00007FFFD43B0000-0x00007FFFD43C1000-memory.dmp

Filesize
68KB

Download
memory/468-135-0x00007FFFD43D0000-0x00007FFFD43E7000-memory.dmp

Filesize
92KB

Download
memory/468-134-0x00007FFFD71D0000-0x00007FFFD71E1000-memory.dmp

Filesize
68KB

Download
memory/468-133-0x00007FFFDCF90000-0x00007FFFDCFA7000-memory.dmp

Filesize
92KB

Download
memory/468-132-0x00007FFFE9700000-0x00007FFFE9718000-memory.dmp

Filesize
96KB

Download
memory/468-146-0x00007FFFD4270000-0x00007FFFD4281000-memory.dmp

Filesize
68KB

Download
memory/468-138-0x00007FFFD4370000-0x00007FFFD4381000-memory.dmp

Filesize
68KB

Download
memory/468-144-0x00007FFFD42B0000-0x00007FFFD42C1000-memory.dmp

Filesize
68KB

Download
memory/468-143-0x00007FFFD42D0000-0x00007FFFD42E8000-memory.dmp

Filesize
96KB

Download
memory/468-142-0x00007FFFD42F0000-0x00007FFFD4311000-memory.dmp

Filesize
132KB

Download
memory/468-140-0x00000160B1DE0000-0x00000160B2E90000-memory.dmp

Filesize
16.7MB

Download
memory/468-141-0x00007FFFD4320000-0x00007FFFD4361000-memory.dmp

Filesize
260KB

Download
memory/468-167-0x00000160B1DE0000-0x00000160B2E90000-memory.dmp

Filesize
16.7MB

Download
memory/468-187-0x00000160B1DE0000-0x00000160B2E90000-memory.dmp

Filesize
16.7MB

Download
memory/468-200-0x00007FFFD2E60000-0x00007FFFD3116000-memory.dmp

Filesize
2.7MB

Download
memory/468-130-0x00007FFFD43F0000-0x00007FFFD4424000-memory.dmp

Filesize
208KB

Download