3f3c36086fb80897ce5eb14373188c0f200721581bb11db35f38d3e251f2a689

Analysis

user interaction
yes
max time kernel
599s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 990KB
Sample261006-ycdmgsty5j
SHA256 3f3c36086fb80897ce5eb14373188c0f200721581bb11db35f38d3e251f2a689
MD5 bdf7fbd490315491007207008b245d98
SHA1 27c473d032ec2161cf559f71d568ada5ad4b0c0a
SHA512 8e9a339f6e0ef0bcf92ed9c22eac37d6b0b0efed7f7b412f7f2221535152a143cac04397afbf3735a80242450d1494648f044ee74be51038659e6cc1ed06a071
SSDEEP 12288:3JnJCTl2KqtbF/u85E43tA+gJj1y6j/Jf8Q4fiInnfoMiz:5nJpcctAlJj1tjxf8ViInnAMiz
TLSH
T153252A5E1B895CB7F1D4AE314D99B0386B3398A04BD968E610CC3E57EF23ED615F1A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	Setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3280 set thread context of 3312	3280	Explorer.EXE	88
PID 3280 set thread context of 3312	3280	Explorer.EXE	88

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\tending\uoftordoeh.pdf	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies registry class 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe1100000009a0ea36ff41dd01e4d25c160b42dd010bbb165eca55dd0114000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Explorer.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3280	Explorer.EXE
4216	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3312	chrome.exe
3312	chrome.exe
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3280	Explorer.EXE
2708	taskmgr.exe
4216	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3312	chrome.exe
Token: SeCreatePagefilePrivilege	3312	chrome.exe
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE
Token: SeShutdownPrivilege	3280	Explorer.EXE
Token: SeCreatePagefilePrivilege	3280	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4004	Setup.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3312	chrome.exe
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
3280	Explorer.EXE
3280	Explorer.EXE
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
3280	Explorer.EXE
4216	vlc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3280	4004	Setup.exe	56
PID 3312 wrote to memory of 4760	3312	chrome.exe	89
PID 3312 wrote to memory of 1560	3312	chrome.exe	90
PID 3312 wrote to memory of 1560	3312	chrome.exe	90
PID 3312 wrote to memory of 2904	3312	chrome.exe	91
PID 3312 wrote to memory of 3172	3312	chrome.exe	92
PID 3312 wrote to memory of 3172	3312	chrome.exe	92
PID 3312 wrote to memory of 508	3312	chrome.exe	94
PID 3312 wrote to memory of 508	3312	chrome.exe	94
PID 3312 wrote to memory of 2788	3312	chrome.exe	95
PID 3312 wrote to memory of 2788	3312	chrome.exe	95
PID 3312 wrote to memory of 4120	3312	chrome.exe	96
PID 3312 wrote to memory of 4120	3312	chrome.exe	96
PID 3280 wrote to memory of 2708	3280	Explorer.EXE	130
PID 3280 wrote to memory of 4216	3280	Explorer.EXE	138

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffac526c728,0x7ffac526c734,0x7ffac526c740
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,17986935840272813342,5884405232762546549,262144 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,4687647995357822451,371495031570172729,524288 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,4139175583710253938,10995819962722823849,524288 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:8
    3⤵
    PID:3172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,3321322393940767949,9797257766732949674,2097152 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,17045683402481190618,18254135576886053138,2097152 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,17310343568665116606,5734625908795329926,2097152 --field-trial-handle=1996,i,17610525851974800929,13631849643911702889,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:4120
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2708
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConnectUnprotect.AAC"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84a745b0-23e1-461e-bf6b-45f769095d7b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\84a745b0-23e1-461e-bf6b-45f769095d7b.tmp
Size 130KB
SHA256 a26409039b06337dcf309b2fb00ef686acdad19691906655fd14ac26ba3abc64
MD5 69ebdbd65c715d7f4969ded39576e480
SHA1 2e7e2ccc05a9226958f661e8765c1631c81c66e0
SHA512 dfe951b6ca257dce32a5795bee1e865f565afb389393e9184958526fea193ab0ffd16c9d1348caa3e57c7b6441c17a2c490cc3720eeb0fd862c534e5aa251cc6
SSDEEP 3072:u+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:u+hFD+7t56OD9ZfSApprr
TLSH
T198D31232AA95D9BBC9BC6541B157A300DE76ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 26b6534ec05547dd49da28dd60cdb6d342afd692ba651edc99c0023096908c9b
MD5 bb469c081e30d56302cef979290e82cb
SHA1 5d2490aabc27fd00ba604eb3987465328f9ca002
SHA512 3968cb233694f8d9305a2923883351fa190b3e0a28205c8954db431a98d0e67aabe16003409092df49c30c06d599220cfb20a4e059b89875cbd3834b28eb0de6
TLSH
T1C9E020A35B9DC31D6518C2171229B34DDFF03504D6CA69490B44F54179C851857C02B1
MD5 SHA1 SHA512 TLSH

Submit Download

7b7c01d1-6394-4f18-88f1-7164317bddf9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7b7c01d1-6394-4f18-88f1-7164317bddf9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

{19C5E366-B3AA-49CB-89E3-A3DA87D78FD9}.png

Path C:\Users\Admin\AppData\Local\Temp\{19C5E366-B3AA-49CB-89E3-A3DA87D78FD9}.png
Size 1KB
SHA256 f7733ae6b8c472f6178bf08846c25e2a44912d95d2acb4da5ac61b885a6b9f2f
MD5 66354397c8358f320234d179f04f13a3
SHA1 3060c2c150d393372d3afced353b553ebff12f42
SHA512 2849005a36110ba636f07eb2d46b2da05ef9fd1c4a1330e6d5fb0bc41eca67c4a86f60d50e147f714d3419fb66472142ade7f241c969a9a049e7d71d047cf006
TLSH
T1A7313AC7A1A488E7B831E8738D798D46B3AABE014CBD313A409F8D928C83F130C0D103
MD5 SHA1 SHA512 TLSH

Submit Download

faef7def55a1d4b.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\faef7def55a1d4b.automaticDestinations-ms
Size 6KB
SHA256 6a394c46b2b359f1160e057a5a905e3113555d9db111ff5bf220a2455c44fb80
MD5 9ad6500a1e0db992e35575dc1a58ea39
SHA1 12354b307419706a3655de911025750252f06067
SHA512 2d185f42543eef4f379aa4386b9be5bdabac6ef92828521bb541dd480d333398fc5eb8946ff7bb7acc9eb1f930c53760d57851315bb8cbe925b7a8fa3866061a
SSDEEP 96:zdksbdxwkNUUH0hfy5GZvTHRdhfWv/NU:OodxBH0hfyuFdhfWv
TLSH
T144C1F1113AADD73AE1B14B760E6FD246CB347C159E49676E6540730D1E70B8084BF72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 76B
SHA256 baa6d5cb6038dbefe1c79fff0e9a0bfbe9a9d2448a73976c1d4135332e822af3
MD5 5047f8e6c517fef8101d5a0c802e5b8f
SHA1 2dc95450b65ef3566349f49a7dc981f1ae6d195b
SHA512 88748a290bfd5e483679c21e76209d752155a37c033d7d7c9d1d6f9dc411632493f3fde4bab11eea09e49e3b7e4f8f7e971b9dc22b9829d931e6afa55960cbda
TLSH
T1EAA01182A00880AAC28020C3A208200A0A32F820A80CB0A0AB82A8020880CE302C28B0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 1KB
SHA256 d80d295badc7eb423dea249feea7d28d48db4c7c133b866e8cdfe7da196bc08f
MD5 ee4bf1af9d4ee08292cf6441ccbfd976
SHA1 a66dfa837f4bbebd3b3dd88b213757e56bd58037
SHA512 1853a16a65fbacbba95f831e4f91884e22c28ba43978915eeffc150177d058ad28922aa795da75d9741e780985cc4bc9475d9baa69443ed54a823c501c83d39b
TLSH
T1FF21118883B9AD479953E00FA211610FD9A0BE24FC4CB4C6F2C1FC852588E7329C3CE9
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 4KB
SHA256 167ff21f75d4cbb7ff95f934a4494f5b04adafe729b1b774b881a2db2ab493e3
MD5 b7d10c5f527b884d0cdbabd17c4af68d
SHA1 42bedd00f2c213980456fc6f3e73a23530e179d1
SHA512 5195271377d16286aac72f9649e0e17715e1b6db03a8c61fb513b4fecf4426f2fb1279dbb671194b7fd25ea808cfca830a1bcb1ef22da5a6c8dc5a3a0710977d
SSDEEP 96:rFx57cOWVBU2guWy8gbcAajkmCrawA4fpOd3pE6ohBmBx:h52guqgbcAajkm2ASoEhB+
TLSH
T1C191018987B57D4B8812B11FB311760F95A16E28BCBCA4CAB1C0B80515CCE775AC6CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 3KB
SHA256 6e3321c9782403d1de94ae977cbc991a1cb30667c17afb723f11c095e695f9eb
MD5 6051bd88ae534c3f9414814be3179800
SHA1 971abdc8e3894e410838dbe539dd25924da6d347
SHA512 b033896272e5ebd15658fe15d3c5446ce15391a5a4ed0f93cf3027648de71af85e06c4774b480134adc5a73ea28b99b5c1f5f07c56e8d907f99aef9b148e1314
TLSH
T1B671F08993B47D4B8912F11FB311720F95A1AE29FCACA5CAB1C0F80515DCE7259C6CEE
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.Xy4216

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Xy4216
Size 1KB
SHA256 635220a7f4ee2ed0065fc0c50371cd6e574f815e21cedfb7d183b626434f4adb
MD5 e4985f7ac7048a8b44b8580a84cf05af
SHA1 497662640d4088790bb0f1baad4d69c760e00ab3
SHA512 932fe1fa95bd9271513cf9a44a53e5e9b61164f65c43ab1b861d15ce41504a813e52a64e03ddb20a560098cf5ea718d64a0955f0b103c6056c6746d312337468
TLSH
T1A121D28883B9AD479552E01FA215610F9AA1BE24FC4CB4D6F2C1FC852589E7329C3CF9
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.lock

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
Size 18B
SHA256 93da0bad03d56fa61fa2642e771cec36f8c524022827f298a6fc73bf0e8f2350
MD5 e38034a3ca26aaf993a5aa48b7582ca3
SHA1 669d99cb1c44307a339261843ea0db9230d10ac6
SHA512 102ca3adc9bc29f64a666285c47e382f76047525f087e564674c323ea457174702bac4d8a93dca602286b68d047428052fe65981b6f6768a820c4d1ad5466157
MD5 SHA1 SHA512

Submit Download

memory/2708-81-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-82-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-83-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-80-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-79-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-84-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-72-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-74-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-73-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/2708-78-0x000001ED8DFC0000-0x000001ED8DFC1000-memory.dmp

Download

memory/3280-21-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-23-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-11-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-14-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-10-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-9-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-8-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-20-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-46-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-48-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-47-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-15-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-16-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-69-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-70-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-17-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-4-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-12-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-22-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-24-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-28-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-25-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-26-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-27-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-18-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-0-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-7-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-13-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-5-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-6-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-3-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-2-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/3280-1-0x00000000033F0000-0x000000000347C000-memory.dmp

Download

memory/4216-98-0x00007FFAD71B0000-0x00007FFAD71D2000-memory.dmp

Download

memory/4216-110-0x00007FFAD29C0000-0x00007FFAD29E6000-memory.dmp

Download

memory/4216-109-0x00007FFAD4EF0000-0x00007FFAD4F08000-memory.dmp

Download

memory/4216-107-0x00007FFAD2AB0000-0x00007FFAD2AF1000-memory.dmp

Download

memory/4216-106-0x00007FFAC3340000-0x00007FFAC3423000-memory.dmp

Download

memory/4216-108-0x00007FFAD2A80000-0x00007FFAD2AAF000-memory.dmp

Download

memory/4216-105-0x00007FFAC4400000-0x00007FFAC44E8000-memory.dmp

Download

memory/4216-103-0x00007FFAC44F0000-0x00007FFAC45C2000-memory.dmp

Download

memory/4216-104-0x00007FFAC3430000-0x00007FFAC36C6000-memory.dmp

Download

memory/4216-102-0x00007FFAD70C0000-0x00007FFAD70D1000-memory.dmp

Download

memory/4216-101-0x00007FFAD8C40000-0x00007FFAD8C54000-memory.dmp

Download

memory/4216-100-0x00007FFAC36D0000-0x00007FFAC3A60000-memory.dmp

Download

memory/4216-96-0x00007FFADAAC0000-0x00007FFADAAD1000-memory.dmp

Download

memory/4216-95-0x00007FFAC4D80000-0x00007FFAC5036000-memory.dmp

Download

memory/4216-112-0x00007FFAD2CA0000-0x00007FFAD2CBA000-memory.dmp

Download

memory/4216-113-0x00007FFAD29A0000-0x00007FFAD29B1000-memory.dmp

Download

memory/4216-114-0x00007FFAD2180000-0x00007FFAD2191000-memory.dmp

Download

memory/4216-111-0x00007FFAD2730000-0x00007FFAD275D000-memory.dmp

Download

memory/4216-99-0x00007FFAD2EA0000-0x00007FFAD2ECB000-memory.dmp

Download

memory/4216-97-0x00007FFAD8D10000-0x00007FFAD8D29000-memory.dmp

Download

memory/4216-94-0x00007FFADA9D0000-0x00007FFADAA04000-memory.dmp

Download

memory/4216-93-0x00007FF638250000-0x00007FF638348000-memory.dmp

Download