hxxps://drive[.]google[.]com/file/d/13pqDe1Ahb1Agz1aP697pOuqAIj4ahKs3/view?pli=1

Analysis

max time kernel
206s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/13pqDe1Ahb1Agz1aP697pOuqAIj4ahKs3/view?pli=1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com
93	discord.com
98	discord.com
100	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{C7908914-CEA4-4499-AF8D-D5A2790D941E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5100	vlc.exe
5936	vlc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
3592	msedge.exe
3592	msedge.exe
5648	msedge.exe
5648	msedge.exe
5972	msedge.exe
5972	msedge.exe
5268	msedge.exe
5268	msedge.exe
6048	msedge.exe
6048	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2308	OpenWith.exe
5100	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5188	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5100	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe
5936	vlc.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
2308	OpenWith.exe
5100	vlc.exe
5936	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1868	3592	msedge.exe	82
PID 3592 wrote to memory of 1868	3592	msedge.exe	82
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4184	3592	msedge.exe	83
PID 3592 wrote to memory of 4692	3592	msedge.exe	84
PID 3592 wrote to memory of 4692	3592	msedge.exe	84
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85
PID 3592 wrote to memory of 940	3592	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/13pqDe1Ahb1Agz1aP697pOuqAIj4ahKs3/view?pli=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7d46f8,0x7ffd8d7d4708,0x7ffd8d7d4718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,8684789256061231704,10835908066784053265,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:5968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\EVERYTHING ABOUT VXB.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5100

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\EVERYTHING ABOUT VXB.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
184KB

MD5
35dd6fe9df5c2adfa8a59a2425d30945

SHA1
7e3969bc8cca4e3a1d313778f5daf20b2d4de1f9

SHA256
75c2c245a50234b6ad7d44addbae115bb2f670ed5a1a1f520669b1127b2525ce

SHA512
e24d799bb18cd5279a883f72a0e18ba59e949762b137326f9b76fb453002f83bd4ae8c804dda62920cad0af9a23eb3d20c0c8ecb6582d009f322bcbd7e06042b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
179KB

MD5
df9ce0c342545290292264cdb25b1307

SHA1
48e83504a54d779e28996ab2a64ad103b57af2f3

SHA256
8fc71bb996017252cfdebe47a76ba579b53390a0b2198997851ad5771c0335e9

SHA512
9c3ec9efbcb801819a63fb6058fec9abd1f02806537bcb626730599911e23dfd8314f96bf67f3d946dde8e9187651640998e3c147b5fd88566ee7318feef5762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c5952bd0390c03a8f8d390124853de0a

SHA1
2e898807407ab76034a4e634fa8847c3a77f0a2d

SHA256
95db56d4e6890e67a757fdada9dafdc704772129f401b9fd773ce28277ad5ee0

SHA512
e380c5613c64bb1bed17877fb909cfb877fedb03fdbdee33bf0a0c793e857f5c3c72ca14f077caa5eb3db883ea981eee3d87301f9ab0c5ec75d0bbad20803438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
154667cd09615af6a65bba3f64906da2

SHA1
2e5f0a8f1289aba16634b03372273e07ec941588

SHA256
97c1cb4b2e53d76dfc0f7943ff419cd91e77c3db6b44491b4da9c800dd018140

SHA512
fa5b2d9760443b5ab76932c1e9064ea941ff8304127a79ba137f9c320e59ca8648354dcc3c567e6551aedf9bd041ecd26b0d5678e5dba4e00a302f381111f3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9c0cd396ee05e5de00abe63fdd290e3c

SHA1
0b9916ac6609919a3bb13a7f23554fda769e21b3

SHA256
026d6af589f67fa01a7ec9ec9777bd719c88255f9a545bcd6dd7e98ab920f91b

SHA512
fe87c20f890ee4df7231ca48b088e807777ace37bbbad94379c08643641cdf1510d72a11409a4791d7f5bb6d519bea57dfb2ca630822592c54b88ac2ded7e917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4d63ae9c0076bf4dc5b60777ac4397c9

SHA1
3062cee2f8c26759522afc48e9a3423816535415

SHA256
5918dc03bd60bbeee23015f2f6c6686623f3929dc95974165c1b521f449cae5b

SHA512
7aefdeb5039a143e6f5ef0dd0de7addc5fb48c8aeb42d647f63dfd7d551d2798a8c88d0de32c7dd823bb586b64b7b3b65c761a31ac8918418863cf60a321b076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7bf977c1a12dc8da46d5418cbd9b50dc

SHA1
79378d749fc99e27c7a7b9eef7f0d92a222553fe

SHA256
ce8321bd94e6ac7377c51bfb0b7734714b5d55fa2090d160bde3a82807015172

SHA512
d83c9030ff7d1495b3f3fb783cc6a59d072362c36e067205e09603222f26be814a2b7fb76988d33514e14167884adafdb0d52c1f93b302576ef4f700c5d3699a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f7f4538feb48578dfff4543fa896e54

SHA1
52c2d8438cc55807656e7ee763e81716427afdd8

SHA256
928f8f1e8605d07c1d9e9d435a849b224a9d223bfe4d479689f352a4d3cb7b11

SHA512
942d7062694988410e1cb1d9fc1fe25360e79cbc05f460fd281a477892086e1a4a9ef5b50695c920546d267aedb6ca66eb4200f4bd766aa6d4515c58c5684c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
344e2d1c2ac2639a29b65aaaeccc9161

SHA1
93f9f21269c70fe69323988ea809d2413f932f7e

SHA256
b4399643706fda54e3eb0e1eea6e77419f95ee5c28a09da60746ececa42a1b75

SHA512
e717b4b2e635bfd8509c53e6b842732fb348232bf35b1f71ac00db739bc1af30144d253ca6202cb7ddae99fabb31a2ba9b16d97899a9235015ee07f85e96f3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a1ee718844b2fd4a2ce367ba008defe

SHA1
4a0fb3053691d6d4f36f65a6c8196d3203936a4f

SHA256
a7b30e34e954626bd4f7ce114484e602f24c80051f76219e046f1af994fc4afc

SHA512
b39f9ac3002a75d35aa6387b0a8e40252a549f6aaa2487387efa4526ce2ee22d7fd8d2ff0bf4e9e2b67f799ae5985d1682537c9f14b78d482b853a167b920820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc694b0e40145920da71d5ee6a9d4f82

SHA1
c96eb92546cb7719abfe74dcafa542c8ee658361

SHA256
d1b0fe3166357d2b312332134b0027b4df20a34270b6379b8321518c54b8731b

SHA512
9e0f504ddb1f40fb2151da35468dd4355f6696226e59fade603f13f62d2e7a01df099261521d1c2844a589f5503f036b8dac81ccb28de1c32d7839c069d9a0df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68c5d741db6aa007e7dcf0a89e29e324

SHA1
bef7fbecb121b1849cc85d6e770a0f73d8ab1b21

SHA256
4ace8bafedef1a42cb76f8620af30482ad4edfb0ea139edbee8227cabee9bab4

SHA512
5f9f56908f8015b0cbf80041ee8615eb3c4b410439797278c9e72e9f45f0fb9c1e1358eedd789bae8f1c7f46aa4c8b45566a56c6241488f7441001dc327ea873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4dfeefa17d4bf3d49f72ad8e21606295

SHA1
9299d60c39ce1f80ed369ca6cb9e4e4945e061b6

SHA256
c953d12c6645faefa738e138ec3ddb78c1462e0418f468395055a0cc6a0e5b51

SHA512
4f3f495686a883c174ff03a156d9794d372a1f42a0c6a8b29912a420a39c406fa4ed9c8b5de4faca92ab89596e095a19e882ebb33906c77af83e0c2638eee303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4cbcd9bfbb19e86e613375797a1a6d09

SHA1
4ad053b26a21ed98f675cafc06b77aa4472422fb

SHA256
1e3cd3f2cb44accce9a15e532f0303f12d85e1d77edf806c86468e7a9230a98b

SHA512
56597e6c611dfc3ef9e16f4e4e4c0db1a01b370f311e063ea5fc804cc8a815643d24e9b4ec9b7b27e7827a2eebdaad1e374a592933635d0954eb3f29e7e16cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
de4bf9fe3fd028f1d7754fb3b751c7ff

SHA1
fc0edd82472b31c975f4be1da36c32f9305e92e4

SHA256
ca3b873244c5ac35be59dd6f1cf9261cde463d7294a064dfec02b5881efba6d7

SHA512
9d3c2f315e1ccade0eed462dbba58e0aa83e17b6311c2788e7c8cf6ce025ebb6a0e5b732f64049ef26fa4bd834ed6b2a4732021d5d2215c588fc95707c9570cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f383a9c287dc83daa4cbbaa818b297ba

SHA1
21459f6559cc57c0cc57c79defb68b6b304e5e2d

SHA256
2e0fda476f2c8c2982371d10412e6df3ce0e29eaf95f1fcb7e4f3911f695271b

SHA512
5da5110c8076184c9e7154380389a1ddf6fc6f0b3a6b6d123e71443f50cc4046b6a27912518578a6840216193fcf4bf373d83adeec14787a3e9aab5d8e902431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
663183b0482334ae11ea15fea71ed5a9

SHA1
c922af33e2c40d8fdd0ea01151ecf79635e6ef94

SHA256
fa63fbea682bc83e147e190133ac626aa1ace710bad40898321aff35c722ff74

SHA512
df5a9c6a0f00a44fb2432e28c9c8b73271f77ca3f47bc1afd607cf5a8f2724fc40d8e423d3dc58d736943cf123f6b146ff01920e7e353b5b14a8aa517f46759d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c18455b4ef2bb09c4188699bc0acb67

SHA1
d010f2c35a78e29bb03fb04f9c1ba91a1a073a6c

SHA256
b76c2b208fd08fb804d05e8e6c607167a2f49e09f91589e303b9f2cbb5daa61c

SHA512
877b62c5f34a9d4d38a3fd08acb151cbd753e70e5490328d47c5fe33a4c7dd0aab4993685e6a8652165d10de9af4ea83c17349b98b6a498177778a388d7260c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d012d8398b14dfe9cfc72685ff53115

SHA1
958d5405a47c1cfff78a0008f99ec320ab5c89cf

SHA256
94fd38436d21f45d9fbeb6c395768f5f24c63d339a14d9513be484fa534c5d8a

SHA512
13fb063d5e9b13f94b18dc35c5acd455ec7bacba450cb25c9207dec4eacd21376f479d13f113374961a9126211474932e854bb5866cf5fab2414ccfb2b998f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6db3c37206730cb7c789b685939ad1fd

SHA1
39786bf3920e58c36d68e794390f19c17ea53049

SHA256
dd46aa83f8d82303a410c9d365763c1a9530712890e95f6f163f096615335683

SHA512
6813c0620c77167bc2d84ae65b88fb8a0d43d16dbc259f3310ae151543ac407e1ee3e19868a7baafc08ad0ab66c840a5332e5ecc4a3a53a9541c77e544da0b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c1ba.TMP

Filesize
1KB

MD5
60b6d04df09a66d6b96f2d89d18e11a3

SHA1
f367dad8b93ccbec2e23dcb74296080a4b75a103

SHA256
e8efd0c96fe8e1ab23853f5c4fd4187d3e35a1796eb36ead5561d9017baed0ae

SHA512
2a988d702a37476ae07b19e2b18da5802722cbf9996a4c2b37439126c24223ba8148224684093e5b54c9e32c1b70fd2bda0710227499f3384dc0386514918fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6393ecdceb31b21e6a3b5a92c83bf3e2

SHA1
dfe1dea74429632e231c9bf95fd292fddabd86ac

SHA256
e6a237672ae03072058ba10b21c21274b522203df4878c69701b2b9b381c6c55

SHA512
cecfe1f99822c46f4bf06fdc25688c8b18ad5456d6203949d147d2630449d8dd0926df12c509501d2cf89ebaeb19439167d0c8f3c5e46b52341a9c70ad648b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
506a2a0d3fac418fabc85a35c14847fe

SHA1
53627f3df1d91c394b042d1a8ade82805ee96a15

SHA256
9d93f8a4ca987402f603e12c5c0bf0294192f3439a3dd13aa43ddb27a518a5cf

SHA512
6f1e2a510200772b5b312b2a763c0764eb9c9edaab86c23dfaa19c56cca389e833932562d21d8f876a3f62b724db3cd9853763bd522fb4f09686a76caaa0e20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2936daf907bd375b01fad3a5e5cfa670

SHA1
3e742d9e50476d0120838f6a30582061964f660d

SHA256
92b08535086b772910f897e52ce0ef80a215874fecfe52bf7e67aff4575e8df3

SHA512
63b94d2b5649e1ff32210eb4b84d02b1ce4f8b4df4d36e5aafd1657dbc441cdfd60ea8bafc2e9b67fdb6328a517ae89bb53b02d7c72d3c4556ae6d904ad81826

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
7KB

MD5
b516abef02d12ebcc814146494842147

SHA1
7b5d42f70f82381f2a69a831a4f1d97d9cb837f1

SHA256
95d7d8004f59904069d2ffd85bd0d802cfd1df6898be51a9a55f99514ffcb856

SHA512
75b1b4046766beeead17e503979a6ce296ee5adabfca09d756c12abedf01788feaae57e8cfd0ff72df90880b7be9e7dd68ba9c905d24be55a4b47530e3faedee

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
546B

MD5
77fda53f227eb3b04ad162a7bc90f4e7

SHA1
dbbbdb0f6b2e108a4a17f41f2b8f2522db2be5e6

SHA256
fc6633bef4d32a3f9f42a5762812ed51bfaa8232bc2da74e2831572be24458f2

SHA512
ccd0cac2fc26b36e38d59e18689851f071b1d7e9e632a6396802b7d4511e67e56b43f5658063488c68d37b521b07b465f6d6c96301b3aef66ccc8b741c2bfb12

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.cX5936

Filesize
589B

MD5
99b82afdf502ad08297373230e587649

SHA1
24b83a974a550e86999980eb6c13b54ff3cca729

SHA256
ec8f4cda0b177398dfd1d4cabd628d9d0efbd9aa9d6e4581b5cf1d03a6c114cd

SHA512
a4e7b48acb11a69183c09949990ed2d6c8bac7b72f22aea96b2aba21182edaaa64e36887545d8de76af3ad89ef87ad159e9359bcbcd93a5e4030589ff0e777a5

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
C:\Users\Admin\Downloads\fd255fd1-1469-47b8-89fa-f6481cb8dc42.tmp

Filesize
17KB

MD5
0acfd790fba4b482540ee2e33521531e

SHA1
686098d69c113d2d909a92c46059720aadc6b60b

SHA256
e524e5db87b0aba5a23715835120e5c9413eaa9013e6a435fc6c768a649c382f

SHA512
4b8f27adce040b3de32b8c5cd0eb40b1d64f0a4d48389468eaf30b5c73b721155bebcb3f4dde7ccecf134e3cedf0db6584a930eb17214567c765c8ef507767ad

Download Submit
memory/5100-679-0x00007FFD8D340000-0x00007FFD8D374000-memory.dmp

Filesize
208KB

Download
memory/5100-678-0x00007FF719BD0000-0x00007FF719CC8000-memory.dmp

Filesize
992KB

Download
memory/5100-681-0x00007FFD77DE0000-0x00007FFD78E90000-memory.dmp

Filesize
16.7MB

Download
memory/5100-680-0x00007FFD7CAA0000-0x00007FFD7CD56000-memory.dmp

Filesize
2.7MB

Download
memory/5936-705-0x00007FFD8D340000-0x00007FFD8D374000-memory.dmp

Filesize
208KB

Download
memory/5936-704-0x00007FF719BD0000-0x00007FF719CC8000-memory.dmp

Filesize
992KB

Download
memory/5936-707-0x00007FFD78C00000-0x00007FFD78D0E000-memory.dmp

Filesize
1.1MB

Download
memory/5936-706-0x00007FFD7CAA0000-0x00007FFD7CD56000-memory.dmp

Filesize
2.7MB

Download