hxxps://drive[.]google[.]com/file/d/1x9Ad40gWMm2Q3IcwJtnvWarnuImljfv_/view

Analysis

max time kernel
809s
max time network
778s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1x9Ad40gWMm2Q3IcwJtnvWarnuImljfv_/view

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
452	winrar-x64-710b1.exe
5188	winrar-x64-710b1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	7zFM.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 970797.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
3924	msedge.exe
3924	msedge.exe
3620	identity_helper.exe
3620	identity_helper.exe
5456	msedge.exe
5456	msedge.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5720	msedge.exe
5720	msedge.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5852	OpenWith.exe
5180	taskmgr.exe
3460	7zFM.exe
2640	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5180	taskmgr.exe
Token: SeSystemProfilePrivilege	5180	taskmgr.exe
Token: SeCreateGlobalPrivilege	5180	taskmgr.exe
Token: SeRestorePrivilege	3460	7zFM.exe
Token: 35	3460	7zFM.exe
Token: SeRestorePrivilege	2640	7zFM.exe
Token: 35	2640	7zFM.exe
Token: SeSecurityPrivilege	2640	7zFM.exe
Token: SeRestorePrivilege	3792	7zFM.exe
Token: 35	3792	7zFM.exe
Token: SeSecurityPrivilege	3792	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
5180	taskmgr.exe
3924	msedge.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe
5180	taskmgr.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
5852	OpenWith.exe
452	winrar-x64-710b1.exe
452	winrar-x64-710b1.exe
452	winrar-x64-710b1.exe
5188	winrar-x64-710b1.exe
5188	winrar-x64-710b1.exe
5188	winrar-x64-710b1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3020	3924	msedge.exe	83
PID 3924 wrote to memory of 3020	3924	msedge.exe	83
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 4216	3924	msedge.exe	84
PID 3924 wrote to memory of 2072	3924	msedge.exe	85
PID 3924 wrote to memory of 2072	3924	msedge.exe	85
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86
PID 3924 wrote to memory of 1448	3924	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1x9Ad40gWMm2Q3IcwJtnvWarnuImljfv_/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6dfa46f8,0x7ffa6dfa4708,0x7ffa6dfa4718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1784 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Users\Admin\Downloads\winrar-x64-710b1.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1997152140089926792,11806502489205708612,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5464 /prefetch:2
  2⤵
  PID:1992
- C:\Users\Admin\Downloads\winrar-x64-710b1.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5852

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5180

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\09225f04d24347e7816fecadfc467787 /t 1844 /p 452
1⤵
PID:5256

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Triggered QuantV preset v3.1 (premium).zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Triggered QuantV preset v3.1 (premium).zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO05ADA71C\Triggered QuantV reshade preset v3.1 (premium).ini
  2⤵
  PID:4496

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Triggered QuantV preset v3.1 (premium).zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Triggered QuantV preset v3.1 (premium)\Brightness settings.txt
1⤵
PID:5388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
350b5a2e5a1bd2ba4069212c28dc7eed

SHA1
1f991320cdafa232002ca81b83c5a16bc8877013

SHA256
9c927e5889ea47222c9a312b25436049263e27768f39e2976337d61669686631

SHA512
46b6bbe21ba65311fe8c8d26bff03685e7bd7e03e19915dc355c0f3cd4b7e13b69f2e3e2001f89ec880b0cec6eed72275890e9ef42e96d2fd3b797330e608827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
8a05287be4cb985105070fd4d5ceb7db

SHA1
7479318300a2d26f8c451f02d21f8de029bfd556

SHA256
ce3c9fd753e8333b4df41d88846ea1e375d74766a949bc48a90df96ca1551f47

SHA512
96e821aaabf724838e91daa5c592dafaedebaa36972d221d62a733bfd0924feb57797c2aa4d0bbc11dbec0e193a0012b5217c50a9e2fa453043f3946cc130b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
408aa83b024ef99fd28ff401a8d519ee

SHA1
999509e5bd008f819878589b2975b107f2c13386

SHA256
9c374d0a42a37cc1e686d9642cb70794a747982d6245abf5bde6f925955131de

SHA512
fc4a21ecf2de421835778068233f803be5d2a9cf6b3d757aa9360aafc3867ddabe210ae346a6551c8288dc7bc88894b43cc3962403736c8ff5d8cb4ad96ba44b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
93fd32823bb5fe7305a1bd9e984f8aa9

SHA1
83645435d65362a1ed492f4ae95adb100feb7f8f

SHA256
bec49d2877d290427c62fa40d489013ab614756479f1f8d38c4b1b91f0cadd42

SHA512
1bd9bc42515a4beba5e1519aa1285967b387d9248f2ea869b55c7a61e9292c5339cbc48fb188e8173d17f003644659d8ca0dcbd1583f63060900ae799ebf45d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bceffd9d0628eeccaca94d056ed32193

SHA1
542f95d69fc902b4e2fc76aa6c9904c5d46ebee2

SHA256
e8a183087b5446ef1a7e58916729be1981718a389875406b15301d70e5930c55

SHA512
8c344f0c59a2b8b37a166004d7498f982f69d03b16fb31a69da035d1a4a3b2f7c08ef13a882806abcfcd2b25e1c1408176f70915e7f35ad9af20ba809dc12acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d841bd1b884790836a54cfb42a0a2376

SHA1
d9a8e9870fb566974169b1eb3461f22886fa743d

SHA256
452653ab10debaf2bd6499138240d62b795a1226e2cdd729c1a41740892d8ec4

SHA512
1fd438b7c549e270f76da7baa0bc0cea947c7131c678617ed246d81f68a0068acda62c982a8268e3a6035a83019a2c6497766c07407e01ed3128bcb1e0d17aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb4524eec816a690f90f460311f1b935

SHA1
8dbbf8966f1aceee7e516761aa84af8774066a6b

SHA256
171e98af390ebba1f737893a0ff1610533506497bc4aba4b1ce6f1346818e151

SHA512
735060f0a78536ba905ea994ac235628a42f4ad732ca93f113692da58c9ee6168ac6aac545e516f301e89c7573e2cee1388a51fffb4264af398d7071fc945c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67870566e4450b369b8f225e4bcf76c2

SHA1
150d2282f0de74105f48ca48a6f7459426c7f192

SHA256
c6d204ad4f5e40de9c93a0c4cb6880d2c3c97cbc8ee76509a2e6b4cc680e7d33

SHA512
88ca66d10ad6c1997ca6f0c873d480dc0349baea825ed67a070a5cc86bc9e101eee9da5724da4493db991ecd332e7a4518e155ed567242fdc7c85b3d503d1ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c6b6.TMP

Filesize
1KB

MD5
de094e726dbbdfcdf42da4d8bb792655

SHA1
e74a3039c67048b5b8db065fbdd95727943d8726

SHA256
17d41e6c66aa1c0039a863dd9a0e4ac56bdc0a65fe375d598acb579ac060cc70

SHA512
16a998158e98d53eb4a91dc80849591a00cd9763997788070512e1c2fd9d619b6af01aad0de8148dac67d59908cdcbe3d4b9ca155dbbc81855b64a2a3879ead5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fff1c0ee89b80a4f57902245355c0b71

SHA1
c55117c16048496533ad0e1112e4a89aad41a615

SHA256
cba80d8f2a3d3c855c7019a6013a59362c4c6219eb922c70cae7c28b5ad5bbba

SHA512
bd467051e212de560f11f944b474d60e7da49c7d0eeb2b1be9c5dcae738ef0224df70e6ef888941550f48e3d3c1005f824d5d78c39d6c6609fe440b0a86b7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ed0ce3b0c9da395c5115fbf8054ca28

SHA1
431ae91a9d98d3f4791904c1f4b374f7192628f4

SHA256
4c94030fd4f6cf56e171bff90839dcbb0a686e30e7e3127361fba78df9fbd3c7

SHA512
e80473fad0b532239d43829681c84fe11303a138f54d15ebb648705488af7456472a4c270ffd3086bd6d200481d5fd9f6fe383c28b68b6a9e39b54817f24446c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a45601b39ae4188d289725ee678065fc

SHA1
0e0cf13fec87dd85629036a5f827df50ac71acc2

SHA256
47abfdccda5bd49361308545799299437252c12c30f29a31e7fb5460d9972191

SHA512
1653227ec3b79f6726862a2a30e4f8bba3c239af6d2a78bb08f425135f313b15b639f71dcb5247df3eee4047da782c136b23697f29cbcb9138e2a2843eb5b568

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0DE01FBC\Triggered QuantV preset v3.1 (premium)\reshade-shaders\Textures\NeoBloom_LensDirt.png

Filesize
716KB

MD5
5607908b9404e26ef2cab1064a650f83

SHA1
b1c43afb9d144463358854743ae90e93352a59cf

SHA256
97a1ea1d13d328fbed460391fe7f5b5a7b06215be0e301d0864de6b361b4288e

SHA512
c1dcec8b3f420bc5809554675dd49c0297efc348215894fc92cbfdbd8d9d2e08ed09b823e1b4e4e8874ce832d83b2054473bd236c4981a8aa405915e36b9fe60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0DE01FBC\Triggered QuantV preset v3.1 (premium)\reshade-shaders\Textures\O-NVE-prem_V2.5.png

Filesize
1.1MB

MD5
fda6e83c256c6dbe4ac11c9fc539d44f

SHA1
0fa7f8281560d3a2dafccd0f1d040ea96be53d4f

SHA256
64499c60d04ac08f3f327f7bb91ff23e83ec42221fdc272a215394068a0f5696

SHA512
d32ae360ab18134cc7585569c6a0cdaad3d47c91a479ab634d2db0ea9d04a595e4c80a605e5b3ab3fa08f4998cb01b3a9f0d2cc95dbd956f9ea9ecc6d8b25094

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0DE01FBC\Triggered QuantV preset v3.1 (premium)\reshade-shaders\Textures\QuantV\LUT\interior_sunset.png

Filesize
258B

MD5
3c0bbf9e93ca40aef363580ef18d2a9d

SHA1
a9091baeb981d6702548d8ee0c359a6fa6a8f352

SHA256
c4fa7b513a952480aee39e65dabc69033b8def39b71480fd3fdb353d69c9113e

SHA512
028b0932990281348d074a08d09d879d0609a37627958cc618269d59055937a9d052d869e5d2ba45dc7c8eac5a04ea74d4982600595c4b32f849911ab8abd92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0DE01FBC\Triggered QuantV preset v3.1 (premium)\reshade-shaders\Textures\vort_BlueNoise.png

Filesize
3KB

MD5
54b5f513c302134368dcb8f85c6f4a14

SHA1
1273a6f13a7442b8c9b48fa5d846ac57405be5b6

SHA256
05a83f40415e7c717fc6bdfa245e88d7ff3ad4313bd8133ae616c391d9b36c7d

SHA512
68b50c49ffe1055eaa804a8f71ba0c7f967d0a941ba170c6b5cde12e8ef53e74bab7d83d1e6a0369a6bde9180a935ae778c79a12859343d597154cffad0781ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0DE01FBC\Triggered QuantV preset v3.1 (premium)\reshade-shaders\Textures\vort_GaussianNoise.png

Filesize
650KB

MD5
d50953e437b8ac33d8555865063af8e0

SHA1
04e1e616da554f045d999c18f1c1a3c22495a78d

SHA256
70f200a55be9f83829b26a1420470c53c595c959bdfff6e501dcdf433e4f6ebd

SHA512
61e49053eb0f9ddaed2b786a2796557d7aa37f610ed25d7b96ef7d1bca359b7af208c739923c3e133cfec3e47e12cfb0f9641bd094127a494bf3a39ade09ef69

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO05ADA71C\Triggered QuantV reshade preset v3.1 (premium).ini

Filesize
75KB

MD5
5bfb4432d490b98c934d80aa9776913f

SHA1
7c85a645734be65f07a3a25f1e14ee4c18291d07

SHA256
a499d089754260aaea13f48a7b90deeef96f1f0156f9d3f83c393af7e15ca7b6

SHA512
b332382ec55ba9be0dde7e3936eecb93c6027ad17a14ea3b6eadd5ae08f5357bd344f5ba869c076515f8eb440aacfca67c5143633529acacf8a345167398bb25

Download Submit
C:\Users\Admin\Downloads\Triggered QuantV preset v3.1 (premium)\Brightness settings.txt

Filesize
20B

MD5
3d67aa6e5f641a7f55193591a618a8d4

SHA1
5bec77d8a2aad3d516a2adef3377c2de1c7e21da

SHA256
93814da05493a0b11ca8707cb5847e808759fff7117bf0974e8eb47e47d8a7fb

SHA512
729fee83fc077a21d4a4c39009c230dee9576784828c9f2d70ae82f28d08eba515e58cae8a617150a3750a3db3a107392167dabef14d5cb47e19008d32e85cca

Download Submit
C:\Users\Admin\Downloads\winrar-x64-710b1.exe

Filesize
3.6MB

MD5
1c250be05d4404f63f5e1915979b1ef8

SHA1
cdfd358b6efc7d6710a686966eaa36ee62190210

SHA256
f810d133eb8dcc890af2f966a1f6aeb4ccdd72ffdc7908bb9c2f3e84f22de248

SHA512
e71564820233553a09e85ab858fe9dabb7b339384a9bb705376ce57b5a1bc764708b22f83d49a9d8b66df9f82bd5ccbbb44a19ce9b44ea6239b49ae07ff87d75

Download Submit
memory/5180-329-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-320-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-322-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-321-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-326-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-328-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-327-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-330-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-331-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download
memory/5180-332-0x0000029DEF520000-0x0000029DEF521000-memory.dmp

Filesize
4KB

Download