1a6079a61e8541ef2174ad2cfa922a9dea4a95c24e7b3d27b6ba7e5eec7ae240

Resubmissions

27-09-2024 20:53

240927-zpsgva1flc 3

27-09-2024 20:37

240927-zemtlsyckk 10

Analysis

max time kernel
88s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
27-09-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_0049.png
Size

1.2MB
MD5

a4554a4172b37eca67ecab41333f047e
SHA1

eb5aca5fad3d7bee7df85d0f1afebecf3f43c252
SHA256

1a6079a61e8541ef2174ad2cfa922a9dea4a95c24e7b3d27b6ba7e5eec7ae240
SHA512

9d2ab8ab974ac90bab4bd002380294c708d0143412a55ea8ff5518afb35d3e6fdff9b2635e33cc71626368a20d8a3323101b4ed9a0a2e7e330e6c9dabdbe1086
SSDEEP

24576:Fk6Cf8B6PJ5fbTDhBbgbXBT7ysPhLwf6EWuFSRUSVJ4wjL6ezJuJ7kMCz3VFkbfj:Akgx9PN1W9ysad/FOZVJ4ML6l9Cr3kJR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1152	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4272	msedge.exe
4272	msedge.exe
1676	identity_helper.exe
1676	identity_helper.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1152	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe
1152	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 672	4272	msedge.exe	83
PID 4272 wrote to memory of 672	4272	msedge.exe	83
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4192	4272	msedge.exe	84
PID 4272 wrote to memory of 4600	4272	msedge.exe	85
PID 4272 wrote to memory of 4600	4272	msedge.exe	85
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86
PID 4272 wrote to memory of 4452	4272	msedge.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_0049.png
1⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff836eb3cb8,0x7ff836eb3cc8,0x7ff836eb3cd8
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1728,4889923442920361661,2004775202876667968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:980

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:4060

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:2652

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:3752

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:2812

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:2188

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:2596

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:3140

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportSend.3gp"
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ee3777b623a3c87d1b81d441635bf455

SHA1
58cf9f6bc77fe78f5eda3f00f48c5ba7abf8a005

SHA256
f99648010846bf4603168d10354e5b00a736ece0d21c7947e1272606b3729fe6

SHA512
53af1e067db110edd17c49c4d6f32768f0d381ccef417588a49f5a632c1e77bc9944a5235806b5c0af3a0d061294009d102ee79ec986515bcf30f99cf98d89ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
768d53f666508151af24522e4b17fa27

SHA1
522834a68c3c1153d8dc7191aa671752db91c736

SHA256
75207412738e1f9b4b9edc193ade7aff76d77ad33fbd85bd24fdc60a52b51fdd

SHA512
4eac7284c6b6a2919eae79565c6f68c294d206085ee60ed9d9dc3812a34b89232a81e99ea782612c223896c23acfdeab8f0bfcde26fd39d26d885d1e0b7743f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
718329f3df0cf03fac086597a980e6e7

SHA1
fc0bdb0997499667ec590209d9e571f389a59cac

SHA256
b304d5b62aead7243181a5b032caf1fce4b56dc43ac6c03541469eb960c67df3

SHA512
93a6a2d2230b8a51680106f78ceaa1a726306e98cf6c379a9addef09dabcd04912e2040fd36124ae26c9124f17a7dd450799233d3100e24abe01e21d4a26aee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81bbac5fa22fb6c7ad5872480267c22e

SHA1
0171762898ae15579432082af38277097ff5589e

SHA256
16873e2e046138c3f37e49dfa4fdb87ce237b70ed0a0f2285a1f8ba5ae3bf83a

SHA512
1431b0dc48a459db403598462996bdc913ac82e9734ed07f311d82af44e8b8fe7776929d4c4fe0a8b5672ec955718832c9c0a31d08ad2714b2e2f3099ec65ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
77a24c5ccd89d99d5d29fc96f491b4a8

SHA1
fa60bf18321aae1e869f2bb09fa8ce0983bd58d0

SHA256
f2f70c2003a460b48494ec97bdf0976fbde8506ee9a8b9f507a646fd38b41702

SHA512
a5c7f72df3a7644f070cd7d5336433c2cad32668c6ff0a52143c42bbcbc95834e98e0c9e2b42219828f6037be927b94ff9166d1d79190b7c38ca5bc29c24f947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acbf8895627ddac126a32df614cd27a1

SHA1
8f30448e32d6797fe580b45651c3b92f303b634a

SHA256
c73df66a8b787bf932e12fc1f1d2ab175c9efdb615fdb0c693d9bbd897cb5822

SHA512
c7dcd99f3cbdf6246754714ef0c6c3ff16db0668e1d590ed08dd21d7dcda9e74ce3cc3662369acca7982737e1c2e735dde69bd0ec99f45a4a34de4234782388b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0edd7ead148e0a5dfce7aec1259bb093

SHA1
e40a56359a8803e4eff93bb6aa8297493d7e383a

SHA256
ae4be3f4574766dec7a5dd02d7ab49d063e7c6c5f86cc778cc9b78d8eeac28b5

SHA512
da3af2dfd2c01b0946ff35e79299f965168581d8cb4499193b440ef1c78dcba5cdb4e01fe962166845b9202457535b1e317b13d85296acda7e80a6ef251a2717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f7867affb6f0a0c53671fe48d12b1f35

SHA1
6ce141b4a3fa4a6d9217bb098a056447dada407c

SHA256
a2c72e4db41d5e199bb293e15c695faeb410a8328fd0084f4f80308fc70bfd9e

SHA512
ed8c2aeab9542d49f20a433a9864a2281f0d5e0d95fbb4f241b86d80e429d8180208176daf52a3267a8fc65e98ffc741960f17fb0e9841456155bf391e8601cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c222.TMP

Filesize
48B

MD5
4b0b15a12342e3ce8e3bfb0659af71d5

SHA1
daef56e14f98cf6d6ef8862af6c15bf67a1e7759

SHA256
1d122a88841e8c60b1c36e9f276937f9ab3f443de87813f9cc4cda0282de85dc

SHA512
dbb962115f51e7f818dae58be3681356d44d938be34c84f318a3a933dbdfddc43186920766e783b70d715bfebce57929b122ac9c961817f2b2acb653cb336f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d117aa79f0046d1f54b7855cb0e27ec6

SHA1
1c6bc02df40edf0993543d4aaa574f9412151cb2

SHA256
48c97f485f84ae693770c38a2c90036a2bba67778fbaa78b478074d2fe387f98

SHA512
9e159ab691e60fa7c35a356b05f946fe3337d772909946186d6f5efb1346ab0a015dc192b1dae0a13630c89558af51bb7a03b4e396354a95beb4b4d94b4ef286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1d7a89fb7837d393952c3c26fd7bb01

SHA1
fb3a98b91bf6d8ddf77ff606a560ee3aa2263881

SHA256
38516f6192ce17eafc1a5a59d20127f848400abb199dcec823e2501000cad8ce

SHA512
427995e183e4a7abf223719488bebd6c2b32fc1b53ff565e2b4e7f8dfe89927099d3ac7c4861eddfa0d7c7e0c7ff8e1d9449350fd19b694449dc7723af22092c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58505d.TMP

Filesize
538B

MD5
4c6ead986d3e04aed3193120ae1c36e1

SHA1
9cc1dd61111792e0bb8580e0af2fc7890c149afb

SHA256
cb2a8e63c9efc457cb2750fabca94cd60a463ae79798df3f8c6e7c9f193ced7a

SHA512
9beb78459480b40d18695361f450ad71d225927df662ae69636e27af862e0f3308d59389b8c7482f30a999429daf7fed355a262750fd503ca90f6ac2442715c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
521ac6a8284a7e3b5fc1dfbc1e0e9684

SHA1
322247f5df850861352c2c044dbcfbbdbb95580c

SHA256
41f036f0c6ad64c7fdfe7ef3746cf220c7cdd22acba6bedbba69002d1034d4fe

SHA512
552c6c40a41a5b459546449f15b39afc818f4a879be6ef7e837f7f0ff58b8202d9025dbaa42a8b93dd07597139a98bbcfa4fdee59548eddb48ec58302320ac2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d141be2f42b08519c23063710e12c322

SHA1
b922941576aead505d1ad3f3c68026681cab6c71

SHA256
ec22e42341c5f944d50441ea049b892690fc596d63d105ba68fab36e29f38e6a

SHA512
0d128cf4aa717328c03ef107e2943103a61a669f2a09c001b8b0dd649ea9e1cbb5d7cdc5b6ff0762966fa3660bad25cdfd4a12744258041f6700622b1af8c155

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
fabea100c78bb2aa0e39b0426522f5f5

SHA1
ac53c2a191a454b82183f8bfd97d32b5919ebc40

SHA256
768dc56296df2c96fbd10cd9e758b3b10845731c227aff4adb4c702d333b7546

SHA512
e1c4eea0d2d12fcd35906149ed84432bfc0c960290a648a2a91d33d466eb2fb48d72bd8a341a0ec3da9807d5bbed927f0af049013564cdc2cb3725ccb505075c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
0163b2383a2f5e64de82c0bd48616b54

SHA1
b5ead20dc199c1aef162d4cc1671a3844be28413

SHA256
4944f5b2b01218bf8325ed1e3b34d62d8ee03e178c3c0b965e23093cccd43c1e

SHA512
0c8abff00858fa8582c50ebef2fcebd783888ea67eeec12ef96e22334f99eb9e9d167382b1379a9519de53a0e9a7126322cb1720ba620cfdcd2fd084c9f272b8

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
76B

MD5
4c4ce48dbbd6d9679a2ae6dc8f7b3105

SHA1
94121161953425af8afbfea8e3fb36581d6618f3

SHA256
b3dd0dba117461b0185cc550cd12a572db81431876f68b7a58eee6ee836344f1

SHA512
39486da8fb183a2b355e10e7a803db09ad83220f5b3ff65c6c5bbd6f3f8ce1fc7417c0a11bbd0a3dbc65dca552309740fa6d606b4791c4ba6a57f49c6c84c133

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya1152

Filesize
75B

MD5
7bd3ef8bbfe907a2f588101412ea3cd1

SHA1
4851e573fbd5365eaf9530cd2cef548db63acec7

SHA256
28b686d178ce027af31dc33ee8b32fedaa1ca50fed290e629119012149fd0df2

SHA512
589c0bb33f8448b33fabd5a95737b0228f66deb479f55d86035a89dd460994a3c4d804cb569cf224994d845997047c5ef37fbf71ddeff1da8121f337b447431f

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
1729e344e9788f66914f9ee9365148f6

SHA1
f500e742a15bc62cab3baddef74606b4a6c222cd

SHA256
dc5e93440168c5d1854a2e5aeee6e3c6e8c8c3f31287d72b0e8686aa18abac42

SHA512
8117410bc74c236167320733e33fecaf128364d76e562211dd1b67de185476c3c82f947bd9faac60420027ebb379fa974b281a6047d685419cdb08e20a97be5c

Download Submit
memory/980-759-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/980-760-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/980-761-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/980-762-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/980-763-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/980-758-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/1152-747-0x00007FF82B900000-0x00007FF82B97C000-memory.dmp

Filesize
496KB

Download
memory/1152-726-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/1152-738-0x00007FF839F60000-0x00007FF839F78000-memory.dmp

Filesize
96KB

Download
memory/1152-744-0x00007FF836F00000-0x00007FF836F18000-memory.dmp

Filesize
96KB

Download
memory/1152-746-0x00007FF836830000-0x00007FF836897000-memory.dmp

Filesize
412KB

Download
memory/1152-750-0x00007FF825C50000-0x00007FF825CAC000-memory.dmp

Filesize
368KB

Download
memory/1152-749-0x00007FF825CE0000-0x00007FF825D37000-memory.dmp

Filesize
348KB

Download
memory/1152-736-0x00007FF823370000-0x00007FF824420000-memory.dmp

Filesize
16.7MB

Download
memory/1152-748-0x00007FF836810000-0x00007FF836821000-memory.dmp

Filesize
68KB

Download
memory/1152-745-0x00007FF836ED0000-0x00007FF836F00000-memory.dmp

Filesize
192KB

Download
memory/1152-727-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/1152-743-0x00007FF836F20000-0x00007FF836F31000-memory.dmp

Filesize
68KB

Download
memory/1152-742-0x00007FF836F40000-0x00007FF836F5B000-memory.dmp

Filesize
108KB

Download
memory/1152-741-0x00007FF836F60000-0x00007FF836F71000-memory.dmp

Filesize
68KB

Download
memory/1152-740-0x00007FF836F80000-0x00007FF836F91000-memory.dmp

Filesize
68KB

Download
memory/1152-739-0x00007FF8374A0000-0x00007FF8374B1000-memory.dmp

Filesize
68KB

Download
memory/1152-737-0x00007FF8375C0000-0x00007FF8375E1000-memory.dmp

Filesize
132KB

Download
memory/1152-732-0x00007FF83A350000-0x00007FF83A36D000-memory.dmp

Filesize
116KB

Download
memory/1152-751-0x0000022E94FB0000-0x0000022E9681F000-memory.dmp

Filesize
24.4MB

Download
memory/1152-728-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/1152-735-0x00007FF836FA0000-0x00007FF836FE1000-memory.dmp

Filesize
260KB

Download
memory/1152-734-0x00007FF825060000-0x00007FF82526B000-memory.dmp

Filesize
2.0MB

Download
memory/1152-729-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/1152-730-0x00007FF83C8C0000-0x00007FF83C8D7000-memory.dmp

Filesize
92KB

Download
memory/1152-731-0x00007FF83B3E0000-0x00007FF83B3F1000-memory.dmp

Filesize
68KB

Download
memory/1152-724-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/1152-733-0x00007FF83A030000-0x00007FF83A041000-memory.dmp

Filesize
68KB

Download
memory/1152-725-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/2188-799-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/2188-803-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/2188-800-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/2188-801-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/2188-804-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/2188-802-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/2652-773-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/2652-770-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/2652-774-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/2652-771-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/2652-772-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/2652-769-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/2812-792-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/2812-791-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/2812-788-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/2812-790-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/2812-787-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/2812-789-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/3752-777-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download
memory/3752-776-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/3752-779-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/3752-778-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/3752-780-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/3752-775-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/4060-752-0x00007FF6FD020000-0x00007FF6FD118000-memory.dmp

Filesize
992KB

Download
memory/4060-753-0x00007FF8375F0000-0x00007FF837624000-memory.dmp

Filesize
208KB

Download
memory/4060-755-0x00007FF8408F0000-0x00007FF840908000-memory.dmp

Filesize
96KB

Download
memory/4060-756-0x00007FF8408B0000-0x00007FF8408C7000-memory.dmp

Filesize
92KB

Download
memory/4060-757-0x00007FF840740000-0x00007FF840751000-memory.dmp

Filesize
68KB

Download
memory/4060-754-0x00007FF836AD0000-0x00007FF836D86000-memory.dmp

Filesize
2.7MB

Download