hxxps://drive[.]google[.]com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view

Analysis

max time kernel
1255s
max time network
1256s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1492	TheForest.exe

Loads dropped DLL 1 IoCs

pid	Process
1492	TheForest.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mono.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\msvcp_win.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\version.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\imm32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\imm32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\UxTheme.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\UxTheme.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcrt.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\bcryptprimitives.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\cryptsp.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ole32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\oleaut32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\powrprof.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\cryptbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\advapi32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\combase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\psapi.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\hid.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\ucrtbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\advapi32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\winmm.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\nsi.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\DLL\psapi.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\bcrypt.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\bcrypt.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\UMPDC.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\msacm32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\ucrtbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\UMPDC.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\apphelp.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp_win.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\sechost.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\bcrypt.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\gdi32full.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\glu32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\powrprof.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\cryptsp.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\DLL\iphlpapi.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\apphelp.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\ole32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\hid.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\advapi32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\sechost.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\opengl32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\DLL\iphlpapi.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\user32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\gdi32.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32full.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\Kernel.Appcore.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\cryptbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\midimap.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	TheForest.exe
File opened for modification	C:\Windows\system32\symbols\dll\win32u.pdb	TheForest.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\user32.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\DLL\iphlpapi.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\gdi32full.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\msvcrt.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\sechost.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\Kernel.Appcore.pdb	TheForest.exe
File opened for modification	C:\Windows\DLL\psapi.pdb	TheForest.exe
File opened for modification	C:\Windows\kernelbase.pdb	TheForest.exe
File opened for modification	C:\Windows\gdi32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\msvcrt.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\sechost.pdb	TheForest.exe
File opened for modification	C:\Windows\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\winmm.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\imm32.pdb	TheForest.exe
File opened for modification	C:\Windows\mono.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\ws2_32.pdb	TheForest.exe
File opened for modification	C:\Windows\cryptbase.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\ucrtbase.pdb	TheForest.exe
File opened for modification	C:\Windows\ws2_32.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\UxTheme.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\bcrypt.pdb	TheForest.exe
File opened for modification	C:\Windows\kernel32.pdb	TheForest.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	TheForest.exe
File opened for modification	C:\Windows\advapi32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\ws2_32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\oleaut32.pdb	TheForest.exe
File opened for modification	C:\Windows\combase.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\gdi32full.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\ole32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\rsaenh.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\apphelp.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\user32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\nsi.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\mono.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\midimap.pdb	TheForest.exe
File opened for modification	C:\Windows\ResourcePolicyClient.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\advapi32.pdb	TheForest.exe
File opened for modification	C:\Windows\exe\player_win_x64.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\win32u.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\imm32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\opengl32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\glu32.pdb	TheForest.exe
File opened for modification	C:\Windows\dnsapi.pdb	TheForest.exe
File opened for modification	C:\Windows\apphelp.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\shell32.pdb	TheForest.exe
File opened for modification	C:\Windows\UMPDC.pdb	TheForest.exe
File opened for modification	C:\Windows\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\win32u.pdb	TheForest.exe
File opened for modification	C:\Windows\ucrtbase.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\drv\msacm32.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\cryptbase.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	TheForest.exe
File opened for modification	C:\Windows\sechost.pdb	TheForest.exe
File opened for modification	C:\Windows\psapi.pdb	TheForest.exe
File opened for modification	C:\Windows\msacm32.pdb	TheForest.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	TheForest.exe
File opened for modification	C:\Windows\ole32.pdb	TheForest.exe
File opened for modification	C:\Windows\symbols\DLL\hid.pdb	TheForest.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
3240	msedge.exe
3240	msedge.exe
3488	identity_helper.exe
3488	identity_helper.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
1612	msedge.exe
1612	msedge.exe
1492	TheForest.exe
1492	TheForest.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4780	7zG.exe
Token: 35	4780	7zG.exe
Token: SeSecurityPrivilege	4780	7zG.exe
Token: SeSecurityPrivilege	4780	7zG.exe
Token: 33	4308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4308	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1564	3240	msedge.exe	83
PID 3240 wrote to memory of 1564	3240	msedge.exe	83
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 4828	3240	msedge.exe	84
PID 3240 wrote to memory of 1592	3240	msedge.exe	85
PID 3240 wrote to memory of 1592	3240	msedge.exe	85
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86
PID 3240 wrote to memory of 5068	3240	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3f6d46f8,0x7ffe3f6d4708,0x7ffe3f6d4718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,10534379708746754675,10189520568798288367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4652

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\[AG] The Forest 1.12\" -spe -an -ai#7zMap23760:102:7zEvent25700
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest.exe
"C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3bc 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
2f7e5f48c943e3505277404de1b1b614

SHA1
6d16b678c15f10f62e7c79b75e920a69432da3da

SHA256
c3a48a481f17e65736f0218bcb622cf2cd65635d62a6268c9e4f1c443fe6fd06

SHA512
06bcd70fa0ac2ca5e9573bbadacebda6541088ee3b4e79fa477cadf06fda578c15df4f7f769bd7474f20874a767eeda55d5df6872e0d406676fdda67995a6592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
adf3883740c7ca821a262e6fd9af1d6b

SHA1
d40af6f531d62dee450791d21104a1aa06fc6267

SHA256
b5d17bc135a53b1b302ef57597593cb16326a786f0f68a285d662d0ded0616de

SHA512
a743c6515c6e89b1f94b5d172e66fc9b2d495ca50dabc1194de3e311b10f7c1c4d1e05bbf070a9072e2f8cc6d0d4e8f6403e1ace2a84d866f2ee803ec0d6f2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
92d44cf010a481461c34331504068f99

SHA1
dbfaa6eb9a893641ce22e2b1022f48111af56300

SHA256
2b4b54f64c408dd2170e43de731e7fef5e4726b2253e04322f31aaa02c45d02e

SHA512
ff0af6c8169894ec27079037f0a94e12153148809f6cd63ac08b0bc1308a30293cd06677fdb28813bd92c5ef3e2f851d79ae3e6f7057c3bb7ee739cddcf171a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
177e795633c5140cca98b9b39ec3d890

SHA1
3b7e0c40ad39e299961d9eb16de88bf5a772547e

SHA256
8542f4653f6bff2505699998877043e65c62eb8978363ffcb9fd4b1494471067

SHA512
80ee187a6d4f3a94ed6245609831ebdea664e2530fa4469e68ec69e7ef6cd9191eb92d4ee725c4aaa7a07475a83e17f58271f034f62862979b3b173823071b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9fd80685f3d249955620f4bcf8441cea

SHA1
5ff25a1fab818a9ec39d8a8b9db67dc801af2922

SHA256
bbdbe3c221e0650496971af0b707915317db7b296f18c993bad69843d09c739e

SHA512
994a3e1fd433893a677db565028714687b913016c4b8b9319335a46c734a9eb832023c620c495b98dcef48a9fad7e552eb2166ac025f5fd8189df64a1d9a99fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5e26ead95993ffc222817efe6090cf27

SHA1
8929d5be6c9ac6f1a95bb79d8f285e9108541dcb

SHA256
0d508eeff3cfad692034629aa7ae71c2dce88d157e9824263dd9c96900d81a68

SHA512
beb60549f31d2e3ae318973deb0ee216a8695881b6f84f078cdecf4e8674262d013d528fb2ce9dac4a29debb6aabee64bd27022bedf5a08f186535e0c70443be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8435d7beaa7b7f5358543904116f726d

SHA1
bdf8b4c277f8a9982019dc1b9d599060b3500c55

SHA256
25b58ee4ac3dbcfe3680cc7da888cc0da310eac353a6f7b1ef42ee4e5cca9f3d

SHA512
a7caffb870000f5ed6e4081296f6c9c9a6d088deb08fba45eb4635d53ab92c0ba8c265976c48cbac2266479284072e6642ecef9de9da06600c529dec78a6646e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3e0a92d96e9bd8a99253ec405a7c897b

SHA1
60edfe14097c332b84588633678ea86543295574

SHA256
aa7d0ab196ebbe05a9f5a47381790b4a71e3eb62082e3aebe985ad0949b96889

SHA512
dd20a6c5f88cc5356023473815dfd08059475418b9f164b52a1b3dd8702948c2aa9589653d3a9fcb4e29896205ae15ce9a3abfc477ac6bde546dad44a91678e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7d79e63cbaed7f9b9d9d10a67a7bbde8

SHA1
923b51d5f3ed2d2c24aabb5f443df8cb9c7ab6e1

SHA256
900738646a84b101f3b7e11f8d575e5ccd6f64c00f4f8321e8142fde8e789aa3

SHA512
6d3b0fd9df5f4451ca2b2ef858282492192d2168a8a25251d2ff3f4db07d729c7dc82c18befac04444f3b388917bc17ee8827f87d6d215eb0b23dc78bafe7da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0163050fa96ed802cffd531fd196b052

SHA1
53e6f22312f61b4be0c9109343ff9b6d1925227b

SHA256
4f4c14bae3def6082fbd4ec14c3bd9438dc3aa27d6b175af11d6e1bb535c942b

SHA512
864e7f5839e1d6e8e39b37f8b497e235a8747203315de4dde308c7e784243681c65dcf96617ff7a27281bccff499a739cfe1da84273b90cdaf1ba2cb5e22d63f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1fd19df0e13db605978583f6db612166

SHA1
6dd77f7bb030f56070a13c6026c8a1b40b928454

SHA256
c0c2f2ea78ff17ecb158e313ea5595681d3f9b03c176da8f2f568733905492e9

SHA512
8a2cc2341cf1ae3f29f89c88fdc5d2f3ddbe7e3d4527c13faba42ac431f733c0520bb66b0d8ba5df9ab1dccdd365306cc664fb856afb8f7c77fb2695e24127de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4feef5371077ae7e89ac5c33340c9001

SHA1
63a73f10ffdfbe3082a14e319848607eb1afd418

SHA256
ce166d7da1b1bb8adfd9ec9e6d632aeb07cf7aacf988033789159d234c99081a

SHA512
0edb42439ed842f2e6ce726feea6bda7895778861da6f84c55284caee82ac61f3f70f7d1aabc24948b1e6c3bca79b47ad4ed860c63ef87e58b983e920e7e5d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c50994f6b745396a402abbaec0fc9b1c

SHA1
5871accd2882668e096e003253b4e95556e280f4

SHA256
6baed3c661a4044733d5f92111a16ad42b19a5a724f29afb2f19c646f86e0fad

SHA512
91af3f48529e1613a128ed99b7d9f7976b13c739145da637b66eec1db2fd3a9efc9edd52539ab3e2994e846c8df297a43fb93ad88d439ac75e28b4083f6c9ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
de8034c2bb95f0de5a8d58e782abdcdb

SHA1
e093944a4a09fc1da54adedd85edadf0d2e3c382

SHA256
0ff42db397836fcd5ebeea4ba345881e79dda1fa7654ba98a78a87da38fea692

SHA512
b30112278a4429809ced1599dd40bdb151d587c188a60e082f9f4ded8cbbffdea9587d9c8aed62b07a1a8919da7ead15179d911766ffc2408163248fc503a6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e5e66f257c789014e61cb832a313afc

SHA1
df72bd68d74cc1d055f02da895948646313fc61e

SHA256
16d092744c85daf5f4ca9b48cf511bd0ad0d675a7ebe7bd0e3fd8aa62fdf5f4f

SHA512
5965d1c78618f6dbdb6f7305d93b96109116cce115c847a6e3fdee9f2c319604d3f9bf354f8c9121983aeae657825a6597bd052a3030633f5b7800ced7cbc975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
828ef060c49fb840c741829d37700094

SHA1
4d2f7c36f49241f5c5ec7fdd9f5f8b85b75a37db

SHA256
45dead900e8bb2633f06b8d1fd2ef5d15157eaa8cf76f1dd5952265882accd85

SHA512
f3c3a8557082c675a5c4cbaf14fbeb1e89fe182dc497b01bde68522e263985f462745f7a92b7459a9d7207fb1411b48e343ab1e8116f1cd221147d8d87a7de03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9118342a3e1c1b8f706ca663bf248c3

SHA1
dda69cc26e88f1300b27b911bc0daba45462bc4c

SHA256
c10178a1a784bcb213417eb677f4ee9977a612955efe5a3a0735cd4dc7824051

SHA512
098855cdf23403691b4106fc38c160db803eed8063072ddcabbc8d295d03b6f80964df373ab663e68c3ef00eace821befb40ce552ff0301d69c41e43b567d83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bedf20a2948af4e0d10159cf004420b4

SHA1
c90efc133546326469121367f70174b0dbeffcea

SHA256
54afe8bbd83b4313909ddc1e07f4ae8636d36f5adcb3bcba8ca37dda4108cae0

SHA512
42cd20634fb94a698f6cbc1304db9fa78e294d4ef0540e62989d2bc5cf6140229ed56fcede2ebcd2db6d835b10dc398863c7ffbad5f3b3a235f4fa123af46dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e864c66f4d198cd1ca3e8c86acf839fe

SHA1
1a9d062d46ffa34779327d50af08cd89703a4d34

SHA256
b618d51c1c40be3c67215a2c0030839cfc9bcece9a7165b356273dde1eb8db85

SHA512
73e97aac3b00e88b7120427d657e0536c946e8d60e5aee1d1ef225b823ece05bd911eaaf116d7c9f543fe18b2696623c72387bebe63afe50ea5039c2d2cbd7fb

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest.exe

Filesize
21.8MB

MD5
ec65d24061d3ff38d6f41287ec8dcb41

SHA1
487b25b9ad5255bb46a13aa20e11d72846ccd855

SHA256
2e93a06b8bd865d5aa0ee7257adc7cdfd3d3b8bd182584ef77d7df6bb936c943

SHA512
6d3a832eee30fd306c05fa6998d85cb960868154558aaf97b1224ec6564291f4065dc1ddbb5d797588dd370aa16b2d4ebd63e699c71882f3b681c5d54e0aa39d

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest32_Data\level29.resS

Filesize
128KB

MD5
e43b614b0adc2447c42401b8cc1f0ccc

SHA1
57bf92f45793cc7082c3710c37a02dc995a1aca0

SHA256
f9b5901392ddc46e3d9e3113973f57a7c220545ebc0a8511a0fb5208ada9304b

SHA512
2f63c4182c37dfd5f3e5111ff30ea351d8bc674fb08ad0e201dfb7166beacdaaa41b2379aeb45078fd56929dc6a31400990c3e13d0ef98f739d007d6bf79efd2

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\Plugins\UnityImageNativePlugin3.dll

Filesize
22KB

MD5
0eec1f8c48f00c0a8b9b3bd483f89569

SHA1
0a3df3b4e05ad1c4a05e80d653e23f29ee2ad4c3

SHA256
77c83677236f5123d32b69c0d9fdcd6dbf1ca1854d3a0ea451b644269ab9cabe

SHA512
c1127a6fa68b8e5e3b5a438c712c673ebc9115fe83adfc2749a6b7a1f83fd64728a6bf48f167f5abce1cb0f4425cea44251f9617b5b65ba93b516dd394ed87b4

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\Plugins\cream_api.ini

Filesize
995B

MD5
1f9a56aad29b8cb87265e51635199968

SHA1
9a3da097e6de90de0cc35dffe7bcdad0c4ab2a4c

SHA256
49c031f3526ef0045f05a1258a334d616ccfd36b3e342a16b40b30738f7f7aaa

SHA512
6faf604b84c43a486d17848c7b2d799b78c5e171f094f60ec8f629e685fdebd04a10d950238eb2f546c23f360acd7d4e6610ab706490d40c7fa28e16a20dad31

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\Plugins\msvcr120.dll

Filesize
948KB

MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\Plugins\steam_api64.dll

Filesize
500KB

MD5
d3c537df603c6a1889552161306c3249

SHA1
43d5401fb7137de570d7d612f2a8afb024f39836

SHA256
b5eff95a617b267ed50f3bb9e63e4c82bce8b7ff03ae32c2946ca55f0b3276f7

SHA512
76065a0367d521ac79f127572aa6ab834580f8f2102cedc878d96c325aad38f9da4d369e553a906ee0b684bcc4229e1f25e747bcc60f74b7b372dacea94f9d83

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\Plugins\steam_api64_o.dll

Filesize
206KB

MD5
3a26392c0f0b4fcc85281488d9a448c5

SHA1
2c112bf98aa0379cacdea69ef12cb2d97ae4aaed

SHA256
c0a90aa701795c5e6d9515f86a2c86fb31441275f1fce244a0518e71ddbad05f

SHA512
653f9d31e64c76661c78936d6cffaf0cf10687870f8f692b262db0405d0b0f705f7bdbd97a74355df76dd8c329ba321d95d22e239693f45806defa2b78e8e63d

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\level12.resS

Filesize
128KB

MD5
b278c33344beb83ad41398a988702b71

SHA1
d2d0156185cd005f314e20bbb0a4e4f28e926a63

SHA256
984ae8df41c8e834bb2a81a25d9098d7a922f0197c45cb8d7004bcd7bff33963

SHA512
2bd3f0a4d5e05a0f793d3675f44eff4db4d58ea8bb2c97b004d424425d5ec206fa84d9047965789cc39fe5702baec855b364a05d5182e907f35ecd5f18a79840

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForestVR_Data\level6.resS

Filesize
128KB

MD5
623a227c2b338f4c6af80e4a1dd81864

SHA1
a303ffd1d92859a29076408b00b51cd2cb591aae

SHA256
740e1830f0a0e7cc05f92e024224097e202c9888bf6f84aa9989ddc33ab43adf

SHA512
054998f1d277527f20ee1c3997a37667e6983e0e06d4f1f71e9bc2cf64b7712ef30c3a796656db70b096524a33d6dedccc7ec8fb75bbd9e0a72b51a2548ea6af

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\AmplifyOcclusion.dll

Filesize
3KB

MD5
533f35098c7eccdc859ed5e520042eca

SHA1
c567247029bbab009df3005bd8df18cd01d84c26

SHA256
db299fef58132d7579f2bd84908de6e0ba7d5b840e72b2b0c9751531d4b75e8c

SHA512
646005071963bc12155c1d9d0785fd0e2d97e1a0772d6d89caf3b8aa9cae5de36cca5087aea8677b351390f64a65024033f397f4841680377fa414afd1fc7c1c

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Assembly-CSharp-firstpass.dll

Filesize
791KB

MD5
37626517a534512e8f6291310559f119

SHA1
f17c61a1496649c7467015eb44895dcfb065f376

SHA256
4a615402231c4a785fe22be60aebccd7ca6d86c398f2fa9ff4fbcb56036c9aca

SHA512
5d58bc3e9ddc32eb59be40adbf5daaff920a6593b6cf61284d3388c498796a3ddbb22568d11fde015ca01f549d283e4e1e5735ca58b750bf42569059c97d1191

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Assembly-CSharp.dll

Filesize
7.9MB

MD5
ceead5700590c5db2d5280ebd6f6f1e8

SHA1
945e262da598af9d6323b7e58da51f1e0e1e5c86

SHA256
3fcb3958d5c6a04c16b010a056bc0798ec4e1a4705cdc1e974d70ba2fb5c1c59

SHA512
d2ec8946105a254c2ac5aa31d2d0a4c1d2c4913f2e0064fe9e8a28ad1b61fb3c9e0c677e0d95ff498fde783b88de1989cdbbe3534f521583b1683b5c612abfdf

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Assembly-UnityScript-firstpass.dll

Filesize
21KB

MD5
d2f63556b7663c06d9bf64dfa33ad22e

SHA1
6c80c6c4803866fcddd0f0ed9d5e6cfbca00ec75

SHA256
039ea5720707096eeb3d3031ad1e4342b274fc0a8eb4c3f2c714335a17c7478d

SHA512
3c06eb655187cf26c418042a68f30da7bd483243be3e7e4dd1bf8f8ae944c5be42501b260be2cd6e3a2b6c5cd635698add2ccdc41ad1eba7c1220690c8e33d76

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Assembly-UnityScript.dll

Filesize
366KB

MD5
bae19ae34984124f8e8d803fd71a64d4

SHA1
22a32a4c38d073749d35f308a7c5d9345a2efe78

SHA256
187ef272336708284190e3c80a5e3a09331be6365dbe0ec3d7214b8c05de20cd

SHA512
7f7f5caccd5ca199dc3cb37f6b4c448e3d923f0f14204c475966057d0a45b87dd6a299f3ca120b6ee3cbe09afeaab0680fc61850d2ecbc173d9cac8f9b457448

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Newtonsoft.Json.dll

Filesize
483KB

MD5
81ee461c0a6aca7ced9659b2ccc56fa2

SHA1
389c630eda9b73c3736685a5527b83f68e750b9c

SHA256
c2386d0f4992c6bc97e93882ff57875e7ad3d1597d2fb68e05bad060b9f76894

SHA512
1ebd0aca96e529489242a2ffc4df9296a9f4475cac4923345e51ea70c8d5239711402212be62bb57000ecf248c20cee4786e5f93609a49097494887c347ac976

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Pathfinding.ClipperLib.dll

Filesize
57KB

MD5
e82386bde402a5a775495a0835809330

SHA1
0db566966943f1639e4f78888fa42d86ea264985

SHA256
4651eba68167202db81c212f445e23a2742560d70b605c0b367ad26a4d8dc1b3

SHA512
d91ba121818424d7836299a43c30dd98e6f3d2c63e8447d120f8e798da39dc77396f0d3bb477897637a5e8aa81bc3a4a4e23cc18b67ee315591d6ffcade3073b

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Pathfinding.Ionic.Zip.Reduced.dll

Filesize
235KB

MD5
1bebc6f68d83ae67251378ac7bfd0e56

SHA1
7650b24feee9be0d5227b59c7f2735df6e05f15a

SHA256
481cc0f9a53a9ba94f8ea3fc0fb2a520b41812c2fdc6ab10581751eada743d34

SHA512
7ca948290df3d9f4f58d3bba2f5c2f111d74f6859b0ae145b94b08e288da8d24e863887decd5507e30b3da764f21912862b8536c828e13d5ed191ec8ae070b7c

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Pathfinding.JsonFx.dll

Filesize
55KB

MD5
f9531f6a850bcbc72541e615329ec1fd

SHA1
a863328e48b43f567de60eba8fa4a0d338737739

SHA256
7705bad049f46adc7b1fa2ab401de1c84e7cf229894768f4869b6d23824c32ea

SHA512
02f00257307a40fca01247687a95f0bd0ee2bab6864378dc5fce3f510a782d88456d6ea5006236b800584a7b7b4fdcf8bd9107e164016b965ed3424f5efd9dfa

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Pathfinding.Poly2Tri.dll

Filesize
35KB

MD5
dcda1343c31e6ebf82de68348724fdc8

SHA1
acc2479a5b56c71e2c95cd7cd2b8a75412f1c908

SHA256
6d37c20001d050b2bfd5071d64ee19f7fd7415e021e8122f1e9070613e4d570b

SHA512
7338a203d9cc6f1c98a712421ac715d2b0103b458fac40913922c2e6c2208f8f83f68b728483eeb4bb846a0f0d5ea803d81f8d4dcc6ed3b9ad391ad8eac68e85

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\PlayMaker.dll

Filesize
153KB

MD5
1873c974b38d7a66e0710ef24e9e4ed9

SHA1
b5cca2f9702bca352ed0ee6e86850897bfdd8c16

SHA256
c52dc9751db3cd4e61bf32d203b8cf82c7b34ba9ab6b253faff06a6883ec7c09

SHA512
821d2d476dce720e38ec27c2ed74c7618656aeee01265889038b037050c025838ecc8c90285a489063e9191dfccf60912907e17695f70de2bef8a42fdb1240af

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\RestSharp.dll

Filesize
158KB

MD5
641fae5167bd61703311d7e350813e35

SHA1
360b2973e871091a7ebae2569ae49278fa6f2776

SHA256
c29e542b89e72b82789d9534cde1ea3ac2104ce189a031776a8ade6517eaec98

SHA512
47093e1c2a691f77757213a33de8da2d3c0e57ddb202ff3f60b8fedf8e415d62fc4342ecfd2dd328292a0084764e44c383712117accc4a432f73d9623d7613bc

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Rewired_Core.dll

Filesize
1.8MB

MD5
70c94e60f091ef631027651079288162

SHA1
e7fefb3c3018d1dc4361522be01e1e79da731858

SHA256
85bc58b11e3f1bb160ecd9ef51ede81b3e81c293a78625e7dca0ad1da9a25602

SHA512
3e3ee6fea242305c22a93e5b7f443e2280e06e835058b7a21293c2ff9bdf58c89cc771580d85bdb270e6a9e454259fd9234d4f03631fc7a314ff64af3ad4fe16

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\Rewired_Windows_Lib.dll

Filesize
1.0MB

MD5
862e2b4fe04360293df6273d4ecd6944

SHA1
2900cbf00185ec2588b8532eb907209dd827e362

SHA256
115ede6394afceefd9153cb1bbc7697ecd72bbbe1c49f264db4beacbc2731c83

SHA512
97679ced940b0c4ff4ccf79e3e24b31b9fbc2972ad84c1f293e94bc1ab248855397f8aef1d9cc5a69bec71fa75fd4f9bcc9c2a26c12e8e1730540dde5add8937

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\SteamworksManaged.dll

Filesize
346KB

MD5
1e84f66311bca12f83b91a3e9fab0473

SHA1
b2f32a13fbfc538fbe988130d0c5e38df275a9be

SHA256
9c3e4564b66d92a90528a7f7db4c01f256fd259b0900209fea964721f88eaab2

SHA512
58f3805baa4cb8a8adb825dc8d4086d04f82c09bd5bb60be9fc36b24b1ee101709f540d9467c8212b271c717d3942d682e379ddbecf44c90406f92b79ebe3729

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\System.Core.dll

Filesize
290KB

MD5
2f63e6e523dad9afa35821b43b503d19

SHA1
eba32ca6bddb80e753684309e65e35215581890b

SHA256
bee0286ae2fd663a44ace8c89380dd7d3d41c8a40a4f782eff3c4b4bd36ca398

SHA512
43ca475b9869f2e1ba7ffabda9808164f779a474ddca7e3bfac190bfe2ed66d8274008805ccc142e06e7156dad0da6a7a3df1a2ac2982f1be612f5c3fd3cc0cd

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\System.dll

Filesize
1.6MB

MD5
ca9ee9dd157a36cf544a9d8e1a62c29d

SHA1
cb1455c9c6e7311ad6a88e2577d13cb06491ced1

SHA256
0c085a45cd9704019cfbd14f797eada2ba5027398b40e4b144b9b6660c36b7ec

SHA512
cb979837d02ad5c968be01f1c3e30b197f0434c72f1ceb40661aaddcf3127ff36a0eba7a1d6b0d57587d4c99411af8dc9457bedf5f6d1216025975dab3932ea8

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\TheForest.Commons.dll

Filesize
5KB

MD5
0c0c51f701c97f7ac55befbaf28d8dcc

SHA1
7f2cb3bf276f89b46272fdf8d92c86dcb30fe8d2

SHA256
41bb1f858031d4c7943fd85f248b0402d0d224978fc75521244067358e9904be

SHA512
8ccca793da5c4f8267bd051bc388d21acfb81c0b53b8027342f1f1103fd4716eb99e722ca3da014c185c439c2b0a0c71b4f9f9c30f77be6c99b8a1abb20c5a34

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\TheForest.Modding.dll

Filesize
9KB

MD5
0f68e5dd84f1c624a448d0785eeeafeb

SHA1
705fc54976c8223d3e21d1f79c20b62c67d893a8

SHA256
9de5cfb76aa5837e973b02af1d4780844e6ab0a005c1f345ef6c3b3ad6887c97

SHA512
de0dd4485127c7399de7480389b6c2aca45a593893762bec0426e3d143708da6c076e7570f1cd0dbfe7c00d19e54141b73b146e76eceea14f8fef7f0758605dd

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\UnityEngine.Networking.dll

Filesize
248KB

MD5
dbd9f16d77475776725c668d30e52733

SHA1
93ac6c33859f1156f96536b2208972c0d8681fab

SHA256
40d978b09d93a97693a747ef8c92a075b682b80a681cbf3ce06ed4d9d3ddc18c

SHA512
3b84f1bbdb7c53091dfa3b74c31be381900f53ad09d1b12924fee55640e8bf1c9bf7ee403aba2b45b9ff01510f2d39074e00303b1d9fa8f6079b1c54bafee11f

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\UnityEngine.UI.dll

Filesize
240KB

MD5
b18442bb52f67d3456a90a72086cf5a1

SHA1
6fbea260b10bbdc2a73d9060c2af20a565f1c924

SHA256
7d8093c850bd6d034796770c01489e00ab610bf95ad73484df605d89c53a15df

SHA512
35ca79c7eabd3f04208fb4ed531ff6d8a4b2b079812ac9eb9f2534cd1dc1bb7abbbb75fe6392217ac2a54dc918f8431fc4ec744781c1b21f2fdbc9f0ef463c03

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\UnityEngine.dll

Filesize
1.3MB

MD5
dedab425d380fb45e531217454f5afd7

SHA1
19e8ba75c739a3e98e85ef1a53acf7832f714d31

SHA256
adec7f60e0024771165a254e4a3e1cdcd78612fc91f690212d621a65c2fb5d5d

SHA512
19bedf9a08d86e5761e586f49c10716e5bb8f64561aed4d95abd9b055107c00a0677a0092b9fac7bec4676c5cbeac65ff44c548861c5efff901a6883c6a19a2c

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\bolt.dll

Filesize
195KB

MD5
c27f1e54895db80c1c8d0f16fbed22e9

SHA1
65ba419a1f8215fe2ee0b211963770cfe82f3639

SHA256
d2b93e9fc2e2c48f159b736eac62cf51453e4cd28866536a55ea0feaba0b42ec

SHA512
eca8499df7a1eebccd0b22112e68930bb346ee5d78e87947d2a9f9fcf211c23c40498d331d58f9396cc5aab4b02e387d086f4d6851bf587800616e484bc897ca

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\bolt.user.dll

Filesize
896KB

MD5
7aac772907c2adbf137fff4d599014c0

SHA1
2e38cce896122f98c8c92f20245cc56b688066c5

SHA256
628c6f87c3de09f59ae0fa116f33b76e13c98b98d49f598828713604efad70b3

SHA512
5c49e726828117d07c4acf0a125e3ab2bb7eab16d05ad40689545d869ad3f542cb418fc16239572b2a9e782ff32a545f326269ba52352b23dbb5d734b9c6aa20

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\mscorlib.dll

Filesize
2.5MB

MD5
b14f67cd2b55d6ba4b9af8007afa1ebf

SHA1
cb1ecb676751d90d3c3c652418ceebc8170ea865

SHA256
57e3a820a75c409fa1965a550d8f0d74eb4e1364d98afd0424a7f617c7b4487f

SHA512
556f660c24e456ca4f7c6dbfe7f6eda275e7b43bac9df2c7467ba61a97cd5a5bfdbc4d2f40e2dc87e525757755ac0ca5acf151ae811a274f9f087748898a1807

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\udpkit.common.dll

Filesize
27KB

MD5
cc0dd08807016ffe46661594ec1e34bc

SHA1
7ba8cd4f62d743378699f564b9c04e1a8f031f5a

SHA256
3adfa9b2d3f0b1efa21260656b1d24a38efb2886e2adbd536bb96cf16290b7ec

SHA512
2ee0312b0f23d6624f47e43a8b1e358433a4b1929559905b27ea1d3e0ace3816f53c5d7fd79721d042b379dba052f219b595f5e384d2e5fcc71ec9064c4e0fd0

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Managed\udpkit.dll

Filesize
88KB

MD5
a3abf4025b8946faec335f0d493d0519

SHA1
4bdbbdc9dffd6fc27cccb2082deabb03d8202e47

SHA256
23dfd810213e48ba4e6742ead15e1cc01d32cd93e822224905a5d6f72b36d994

SHA512
62451102b101f6d0b1d56644582e1ed25f0691647b01463f7e7bd77eb90074a624e2d7b66d4b92267dd1c5509fc646f56f591924292a920377f676f4f5fdcaf4

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\1.0\DefaultWsdlHelpGenerator.aspx

Filesize
56KB

MD5
66fed2411c14a0fc8ce4c593ef601bfb

SHA1
4680a34aae1193f1e4a6aac1a5dd3c307de257fb

SHA256
d87d5196b2ae2abf4e673315e1fd22c3a44df80192f23e89b78108579c287524

SHA512
331874a9956c87db0646e4d21937a88009804a59fdf5f5882ea5b1dfb7dd7ef17724e09877d98f52e7327bbf38a46dde0c54d5c85f1e860b88322bdfad64679d

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\1.0\machine.config

Filesize
16KB

MD5
4bad452a2ffc4c6f982e2f43fb44f6b9

SHA1
4445d53dc755ca2f977b01bf9d77357b3dfb0cc7

SHA256
eded908c507a7a230ee7ad3146d8893cf140638e6eaeab58bff05c95c2f3a7e3

SHA512
1611968d2c19f3c9472a43d692a4451fd140dec1d6d5da6b819d33e62936f1d69d69e65c13b893158aacf985093bd7167f50d9c80c0789a79303fe66a9ad956c

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\2.0\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\2.0\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
3b3452c399f27a24ea5a589c7bfe750b

SHA1
b06cb1d09ad3bbdf1d8214c910e3da2a228d113c

SHA256
ae044cd9cc2c7c42f8864195125ab440472d657e5f0d55e131f7890bd45c518a

SHA512
41c099350159e942be8bc04c8f59c7fb0fd4bd99db46f1c0158f0fa053c08ae0c73e9d169f6816b77376283cce5beafdcfe5d3d5e3b98e8b358d67c34b954a04

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\2.0\machine.config

Filesize
26KB

MD5
433d143955ab359dff61c0bff982a176

SHA1
7eab623c58d853d733c0a5e586a47e09c4e3efdb

SHA256
531d0d5bc30466a8a7ea6c032639721d7f16aab57c9701ef0afab5fdb432792f

SHA512
914e7043806fcc2788dbe388f94a2c9cbc6b0d5eae59609ee411a4815926d879b05ba8f338ee07b88e95a44304ebc9cbefa19a948fa52ffc0f786957c9729c39

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\2.0\settings.map

Filesize
2KB

MD5
55dac562878b7dd98ee8a7ad203a26e6

SHA1
d16baa15e7d3042bcf9d7318209c696f4daf2cb0

SHA256
ca89036b7d7f1ae9311a6a2fbcf05fc5b997bd43fd21dd54e11c18018ef65f08

SHA512
987c5cd86a9825953de670e5c15404694feb15cd5fa9afa8af4c2d5bda9d805839c9695d44122b32e0ffafe08d720c3df58000e89c8822fd9a5eb28eaf2ad478

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\2.0\web.config

Filesize
11KB

MD5
2b6303c4f12762b71051db6e947f90a4

SHA1
a4d7e05516f63d6ab67327b299d4fb2852cb840b

SHA256
3c1a76a5849074b437d297656a208a3bef6d84b982153542b9c797046c601dfc

SHA512
80f5da60654e1851ef21526e434b32d94e18883a08bacbbaa0e1f85b80469c46510b6ddb9b429f16cc4be89c6f2bb2627bbae9cb1d0c7e45b665efb7721c6d86

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\browscap.ini

Filesize
304KB

MD5
378be809df7d15aac75a175693e25fbb

SHA1
2d5454e161de8a5b65910f27bd70d9d0ad8fa476

SHA256
4ddd50f31fb968f30bedefc253a46dc3f2890192d05cdaa9e0a64a056eee807e

SHA512
d0d181e806cbd2c016eb0a8786f7d9db877463eaac0195db4e891be111c9ed87491a1abcfa0d9ed7c2743e004e1f4a3f4789333d0b535e63358c672ae833c363

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\config

Filesize
1KB

MD5
f95c345c1c53b820487f6b72e62d5485

SHA1
957e4e50e74c50347af92abf240c2c7aab3f3f79

SHA256
b585c70c70c88b3e03489361558f5d711c2ef71df9baaf37d92dbf95fbf6cd92

SHA512
6b06434d07ee51be064a3efdca65b73e6c8e7560b43fb61633b08c7d2a0d792fe0670e57088c1dabd23929e0b7f7a27f65f503f2b640587042c8bbe98946368b

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\etc\mono\mconfig\config.xml

Filesize
25KB

MD5
f34b330f20dce1bdcce9058fca287099

SHA1
936520d5bb5c00a1985d7a4c4f0ef763a9031862

SHA256
0c56e34c69124510fa8c19e7b4c2ca6c1c4ff460ae19f798dd0ca035809e396d

SHA512
d6d4a8321eb44c117755a41a2590296be86a0568d27a5347f9d7f32f2d151d8f7e169675c83faed2dab5ad0f8d81858f8cd1167e439cd4bff7e68c243e3544fd

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Mono\mono.dll

Filesize
2.5MB

MD5
59b052102adce70da15ddb1b1721f62f

SHA1
c62a74e7f105d4c4d49642339e74870d54bdf252

SHA256
ef2695a442c2127237b3362a910722388e3576907534ebf0d529c75b2be50fc9

SHA512
34aebd20b50ca51d5f5da99b4535923499ecc8ece4eb8c281c8deb122b0aed75f3317de672e2db41921dbd93aaa70f65f9c9d21b618bbcd49c3454330b761057

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Plugins\sixense.dll

Filesize
144KB

MD5
74a6e0ccca660f452356ba8a148b770a

SHA1
01824cd688001de32892df521249118fa98523de

SHA256
48817f955901f65035fca5c502ea0f13e2533fec2db8468c91bf1a7573327146

SHA512
9fa39cc4edbb88351edaf33713bbeecff9693682483126c8997537fdb94439d07d28baa4c7dbc82b0be745681265f2475fa1976738d5aa6872f0f45702b3a2d4

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Resources\unity default resources

Filesize
734KB

MD5
5d424e0cfb77c52cc384f9d99d9372fa

SHA1
fb03a9254a76a7e238b3c52949b12d388c8ad589

SHA256
a70ae5a287982e4ec84dd75dd2f42d7a743a4493c4f22f7afa815f0684f120f8

SHA512
7cbd19d220cc1ffbc8e7aeeb75f9be1245e201bab6e90d8b88a74d576c71cff1b97d1a7f9e035e72afa8338f29e8ba8b8f59d323e14adadec677b67e2479253c

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\Resources\unity_builtin_extra

Filesize
1.1MB

MD5
f6a2bb2eaab0f1aad132bab52708f389

SHA1
7700b18fede4a3b4df983ad9e6f20f7e846ecedb

SHA256
1ba7b0d748111bb29dd2b8180f585aa34aa3f8c89bd6539675b214b5e1de0022

SHA512
6394cf5bb4f5bb7ca4c3b6417cd9be41328fb620f6455cd5b65382cbadf64f856a5f7fafdbce3c60b38c4b44dc1a63779bf915cde97f86c85ceff671173eade4

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\ScreenSelector.bmp

Filesize
206KB

MD5
cd60fe57215b6b339722ee203409f6d9

SHA1
d424bf41fba6e19bbec8807709572f3947859166

SHA256
651511032a81ddaaab417e24de3a73c4c498b1e1e9c315324b2f2ae4675934df

SHA512
c63ece99a161ef9a5786832100ad807318cece31fa969d2182e1fca7dd45238e6426a65e2648035ef8791e8f0a9e791a8f8f2b0ee0e87161530f423e072bebe5

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\Master Bank.bank

Filesize
40KB

MD5
bb4058354ea582b5652690094d3637cc

SHA1
b83eb6b8c1d3b6a87911c9401558f9f89bf8721c

SHA256
0497d58715d6416ada0fa064d9482ffb6c62895fbc4883dfd1ea0faa39e5cc05

SHA512
89b6febfc81a1a96f2d9600b9bc330e820f1e269c7a32236e78103d5ce65c2719d5a81af0274236dcb87681b66b19529f9fdee27bd9060cd967a9d279236ce46

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\Master Bank.strings.bank

Filesize
78KB

MD5
2fc3f8e69cff65b2a9753e824fea3a25

SHA1
095f4c52510be93cbbea474b65096eefcc7abb34

SHA256
ecb2a0539826fa1c8c589ddd796118d6f223993242678dec12c1bb83ce64a932

SHA512
f7e1f71b39e1186edf69418284b6cb5840da3ce4fe4b6fef1c5a658aeb1df12b0e567e1f41535f16fb0f2c2867d5db372166f651809a34b6320d0ea7e3baf219

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\caves.bank

Filesize
2.4MB

MD5
de6c8f768b26d047255007659d94872a

SHA1
7edd7b3d0bee6fa783440932aa757052d8b71690

SHA256
35081d2cc7adb47f12f3530ac53b81bd7e3b07c8ca3baaf1cf321f8f81bc7528

SHA512
9451e41719be37e44a9db7b965d4ddfc593553a5d846cda05dfcfa09964124e313f1743a84697c84562e82a4b0f1170f84e7322a0288818d9fb292f32b786bf9

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\end_boss.bank

Filesize
10.0MB

MD5
e5f79ffc8047adcbe45252827a1f768f

SHA1
db7c2508ece4c165458baed9944368c7837d38b4

SHA256
0b2c88cd3b0c824c444d930edd545fd46645a9f0737868b843b049735e314863

SHA512
563711abd493f0f8d9928466b873542e2163fae69e1e58d0089233f7e7aaace34b65a45d50335249113e2eb1715979d2085497d66baa5d50b54e0ea1581ba539

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\endgame\endgame_sfx.bank

Filesize
9.7MB

MD5
1b219c785b5e1d7dbad4a2b41442bf2e

SHA1
cdc3274a3daf2e0cc27432a9a925d712a9668b86

SHA256
d729633b24426f7729601384198634f4a6b1649364019745baa187ace5b7e842

SHA512
6d0bd436f81b233f2be6cf9e3a833c1bb2ff3ff7650633e0f6b3bac6c7b7957e7dd8837e05106cecbb6f275cc98c3a1b92277f48543f28635ee07604a3df57c7

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\endgame\endgame_streamed.bank

Filesize
24.9MB

MD5
f7f9c1f0bcb5c45386306d518d71ace8

SHA1
8e3b197a798d491ce9016265fc8c8591ce3bd0d5

SHA256
f5a2d5e5ae06556fd938614912c2f116d10176b87566c57ec8202c51cb2f47a4

SHA512
cd73ab9056090bff676f0c7b7ea5f305f0bd20b3cf7abde6d6a37160954aff7f89a3dc70e156c0b527de766e52edca1933af4a00a2b5554fd048a51f51f731ad

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\plane_start.bank

Filesize
10.2MB

MD5
b7a4876003f46b69577dca6498378574

SHA1
1d39cf61c6d9161d4d0774661e263eacfcedc8fb

SHA256
e6c484ce12aa0ab999b99a68718ae7f5cf4e124669ea027c5717eb7eeccb76dc

SHA512
8b82340368eac48368a900b74280b34a97398d7a8a44c75e2a52d54b7b02bdb616f557e26265b8f265cb97887bcd61907227787c70339e48194ee2584ac18fc7

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\player_high.bank

Filesize
8.1MB

MD5
c48ab3dada05d574728831dfc8a85c8d

SHA1
4722b1d69b74a85eefc526239734acd7a80a96ed

SHA256
e1652c2efbf9a4424f1b1224d7eabce9a9110cac494da34bddaf27566b135e04

SHA512
9bf00f401e4a7ae42935cfa4fc6cb4504fd0c122b67e2e1ea84312dcbd303c5c8f85fccb8fc40bc32793809d7b736ee19b69d30a86b70125f042bf12739e54e5

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\player_med.bank

Filesize
15.5MB

MD5
616b7f46d6f7bfe4f3025b70fc20db57

SHA1
995e88f18f34c9675f526900735bfde6570dd914

SHA256
0b4533de1a204050f142a99721373a6ce00bea320d0b7651b90bfc166c0853f1

SHA512
f19f41763009ae375fedcdf5c23f5543d25f2b018f7f6e0bac77f9130b66d04a4e93064e960c1918ee21a39bed2254f40851b0457f3d3f7125aaa3860431dbac

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\sfx_high.bank

Filesize
5.6MB

MD5
0fdca85f76e0dbd29d5e4ecbcafd90c0

SHA1
c5ca9ca5cefc895a4060bbb7d555c035cad01281

SHA256
0fb7c6203c9b28aa57e57aaffb729c19c12db1cd8c14757572d9b2bd0c00002a

SHA512
ff12c3be756226ff009cebab2d63d2be9d6fd612ea1f7c1a4e914acd28f9b1dc4fdf3deae2886ae58021b2a9f766615e808e3b89888366f1c337a334bf028a2a

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\sfx_low.bank

Filesize
5.3MB

MD5
ed1b71cf80b780491259734c0f701915

SHA1
c3533de749980f480a9808cf73c8685c684d92c1

SHA256
f98553a95cb95c132d22d2d8aa186aaa3c005de3d8b85f742c6b33766d0afc31

SHA512
609acfb281d4f070536594b663f1a13bdaad7431225328762c5fb2c91e6e448b95f60f15369ce28fc82e25629dfb2d64d0d5f1d9a738cd741bd83361f05771ae

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\sfx_med.bank

Filesize
14.3MB

MD5
2ebcad09e1897ad8d4060131572929cb

SHA1
b42daedabbe5f014169a6aa96f5120f63c369147

SHA256
52d41e1691fcaf81c7d2531ba17ced038c6ab077d84e4902a6e1d66291387269

SHA512
94fc35fb73e7496298e7f05c8567149f38bca751d6bc5cfe717ce8accbd29cb82606386c4567f4542c5130b47d793608989f5a66c15ac9a413078f312c298dfc

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\world_high.bank

Filesize
2.5MB

MD5
a41d6769476161e2a854c4a84383512b

SHA1
ff702618cdcfa85aca0b0f2180a46d65972463ce

SHA256
2eb5632a4afbfe8c9fde04b4aae979fa40a79793632299ff9cbd9826d4f897d8

SHA512
b65b07e63ed910e34b40d5a309a51bb67a4fce064d0763444f54a116f91c37e8c4f584eb44fc9536a861d060380800d14a86ad591da01ed87ad8243696796cd4

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\StreamingAssets\world_low.bank

Filesize
19.0MB

MD5
df814553b8b15e10c37e0ec91e09ee02

SHA1
4f8869bad08453fb0d4666f64081f06463baa434

SHA256
9dfc55e35b3729c57f71d6a112056b1c8f4140689553d1d5b3a71d95389b5908

SHA512
40f883eb6841ecd845ba58e2f200a8dbc72a915ce56f0cf8412c2189a49acfc985c9acebd3f87c5e5c39d16f88070df086f2c349e72349dbe057832f9d411f13

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\app.info

Filesize
13B

MD5
576dff3a7c775837d79f3c35962c3213

SHA1
4f07d1bcebab89f4b16e7269bfdbafb2ef7b4529

SHA256
988540f2999208586c70a86430b18a2ec184841e869ef0b318349aa49631f44e

SHA512
524ed9f10bc6f3b30c6b7f9c21619d876859766ea94f0be105794b2dc9f77d0fcf4731b5b46e03f43c0b30cb4f6841ba41f07497094752eb57e43c2e0baaabd9

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\globalgamemanagers

Filesize
5.9MB

MD5
6de5a3db3a98f892d7a3a8128d1d96a6

SHA1
09a4bd829fbd2a2b8db87696522a7e4044faf6a3

SHA256
ca21567d2de89af511699eb2a510f9cae0996ecef49d7d8e5bc032ebe8c768ab

SHA512
e70506e9ed45f2f691edbf1dd8feae930b690f5aa866db6d1dcb5e62679fa448ae282f5ef35b1a9df3d5c84ebba8b7de2598b84e92b69fad26799a7734ed04bb

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\resources.resource

Filesize
166KB

MD5
778fc2b20601f3d83c6cef1f54d7e025

SHA1
9ca870c39ce8fa1b1817ef42ef8e5b15836d2e53

SHA256
5bfa921216f29c153d56f346c2c4c48a6f461c82931fa7860cec1413e8ab380b

SHA512
0b797658303a7a6e34955753617ebf12193888730604a6fd96f8ac1828ae92a69a4968e0cf09052e8b8b9e4f198f16cfe747de463640f7bc2bfe65f1b587f7cc

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\sharedassets0.assets.resS

Filesize
37KB

MD5
02ece9a1984f016c865b78bbede20ba3

SHA1
dd4799157539e69bb24032037b792ec84e0ce253

SHA256
c61df410e2155d21e48438eca84de09b9e4498e09f168d8e323f390aec8e72cb

SHA512
4940c92c0ea10f46236f02d6206d5bc889a41fb56fe3734cbd6ac11f0f118cc9a3d74622b596502540065996fed84528456c51b8df210fcecc32e3640fb17f67

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\sharedassets1.assets.resS

Filesize
21.6MB

MD5
f6a1f9cf462d6ff21eb34366d2b691c1

SHA1
7119ce7a1cb5608459b3ac5d53ab2098b10ad588

SHA256
5bd7ecae32711d7d3e18a983cfce930d9132219e626520b0938f324ca3e86ff5

SHA512
074bbcb038872fd2adbac1e28a903e13c8cd6a9d028b8887856ad08fa929d3ace663a35515bce477c54330e90ad13b51771b1cb15b575e22a535eb59787d2ff9

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\sharedassets14.assets.resS

Filesize
1.6MB

MD5
2500cf02e5d67a73cb5fb8209d507fdd

SHA1
5621beebb95ce158f488f1790416f5f514e4689e

SHA256
5fb783bff26ebb8c9e6466349a8af1e366269b506a8c5c8faf2da0584e0d38df

SHA512
c2fe198a0a93c95bc81bb51dea81811fd81da4e0deecfc6cb21d76cb38e0e93ea468ec5b5fc031a1ab2c89445e86585605612f789c57c7c0fc70d4ef2d9167f7

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\sharedassets16.assets.resS

Filesize
1.5MB

MD5
f00f9c39592a1ce8e6e58a0efd147844

SHA1
297c8c5fc797384317a393b12022ab2f33ab362a

SHA256
29c801cffb9cc418ceb2229aa708df4f364c623e490aad0d1cce8aad8c9fe186

SHA512
d8b289818c1ff4d23254a6e2dc0bef620976fef85d5c82d25960b9e235fe202ae0a2bdaa2b9430140a6f7593e3be7715183e5e59bbeb65fda09a2ed3b4a63c36

Download Submit
C:\Users\Admin\Downloads\[AG] The Forest 1.12\The Forest\TheForest_Data\sharedassets20.assets.resS

Filesize
171KB

MD5
b9bf173723b67c877970f4ddc616831e

SHA1
d0c7513075dd3b23e6a06b3666e78311a940feb9

SHA256
a7f6392c4b1d66a1fc086c76710040b7f3659ead0e53c0db935c43417cf3ac15

SHA512
5181bd28660a2e9b2146adc3942622601cc6e466d8c2cd3ab6b7efbec9445692357f3e0e5c9758c46fefe476ebcb667acd946c10d1e1b3465e82fffe3bfe93f9

Download Submit