hxxps://cdn[.]discordapp[.]com/attachments/1507700610554920974/1507701695583621240/Gosth_Fivem_by_criaxd[.]rar?ex=6a12dc1f&is=6a118a9f&hm=c7c62dde56482b8dc34c293b2eb93761469ee2e5268c3063692e19346d80a3c7&

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1507700610554920974/1507701695583621240/Gosth_Fivem_by_criaxd.rar?ex=6a12dc1f&is=6a118a9f&hm=c7c62dde56482b8dc34c293b2eb93761469ee2e5268c3063692e19346d80a3c7&
Sample260523-ncffzabs5t

Score

8^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
172	4720	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	winrar-x64-722.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
3884	winrar-x64-722.exe
4464	uninstall.exe
3644	WinRAR.exe
3304	fpsboost.exe
5212	WinRAR.exe

Loads dropped DLL 1 IoCs

pid	Process
3236	Process not Found

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1276925427\manifest.json	msedge.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1313642480\protocols.json	msedge.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-722.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_608982086\manifest.json	msedge.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-722.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_608982086\nav_config.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240688359	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-722.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1313642480\manifest.json	msedge.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-722.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-722.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-722.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe
2628	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240085146544994"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tlz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	WinRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR"	uninstall.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
4752	msedge.exe
4752	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5388	OpenWith.exe
3644	WinRAR.exe
5212	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	taskmgr.exe
Token: SeSystemProfilePrivilege	5232	taskmgr.exe
Token: SeCreateGlobalPrivilege	5232	taskmgr.exe
Token: 33	5232	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5232	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
3644	WinRAR.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe
5232	taskmgr.exe

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5388	OpenWith.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
5888	AcroRd32.exe
3884	winrar-x64-722.exe
3884	winrar-x64-722.exe
3884	winrar-x64-722.exe
5888	AcroRd32.exe
4464	uninstall.exe
5872	AcroRd32.exe
2860	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1832	4524	msedge.exe	85
PID 4524 wrote to memory of 4720	4524	msedge.exe	86
PID 4524 wrote to memory of 1412	4524	msedge.exe	87
PID 4524 wrote to memory of 1412	4524	msedge.exe	87
PID 4524 wrote to memory of 1412	4524	msedge.exe	87
PID 4524 wrote to memory of 5052	4524	msedge.exe	88
PID 4524 wrote to memory of 5052	4524	msedge.exe	88
PID 4524 wrote to memory of 1756	4524	msedge.exe	90
PID 4524 wrote to memory of 2624	4524	msedge.exe	91
PID 4524 wrote to memory of 1756	4524	msedge.exe	90
PID 4524 wrote to memory of 1756	4524	msedge.exe	90
PID 4524 wrote to memory of 2624	4524	msedge.exe	91
PID 4524 wrote to memory of 2624	4524	msedge.exe	91
PID 4524 wrote to memory of 1204	4524	msedge.exe	92
PID 4524 wrote to memory of 4308	4524	msedge.exe	93
PID 4524 wrote to memory of 1204	4524	msedge.exe	92
PID 4524 wrote to memory of 1204	4524	msedge.exe	92
PID 4524 wrote to memory of 4308	4524	msedge.exe	93
PID 4524 wrote to memory of 4308	4524	msedge.exe	93
PID 4524 wrote to memory of 116	4524	msedge.exe	96
PID 4524 wrote to memory of 116	4524	msedge.exe	96
PID 4524 wrote to memory of 2860	4524	msedge.exe	97
PID 4524 wrote to memory of 4472	4524	msedge.exe	98
PID 4524 wrote to memory of 2860	4524	msedge.exe	97
PID 4524 wrote to memory of 4472	4524	msedge.exe	98
PID 4524 wrote to memory of 4436	4524	msedge.exe	100
PID 4524 wrote to memory of 4436	4524	msedge.exe	100
PID 4524 wrote to memory of 4812	4524	msedge.exe	99
PID 4524 wrote to memory of 4436	4524	msedge.exe	100
PID 4524 wrote to memory of 4812	4524	msedge.exe	99
PID 4524 wrote to memory of 1112	4524	msedge.exe	101
PID 4524 wrote to memory of 1112	4524	msedge.exe	101
PID 4524 wrote to memory of 4164	4524	msedge.exe	102
PID 4524 wrote to memory of 4052	4524	msedge.exe	105
PID 4524 wrote to memory of 1484	4524	msedge.exe	107
PID 4524 wrote to memory of 1484	4524	msedge.exe	107
PID 4524 wrote to memory of 2092	4524	msedge.exe	108
PID 4524 wrote to memory of 2092	4524	msedge.exe	108
PID 4524 wrote to memory of 3852	4524	msedge.exe	119
PID 4524 wrote to memory of 3852	4524	msedge.exe	119
PID 4524 wrote to memory of 2000	4524	msedge.exe	112
PID 4524 wrote to memory of 2000	4524	msedge.exe	112
PID 4524 wrote to memory of 1616	4524	msedge.exe	115
PID 4524 wrote to memory of 1616	4524	msedge.exe	115
PID 5388 wrote to memory of 5888	5388	OpenWith.exe	128
PID 4524 wrote to memory of 5160	4524	msedge.exe	131
PID 4524 wrote to memory of 5160	4524	msedge.exe	131
PID 4524 wrote to memory of 5160	4524	msedge.exe	131
PID 4524 wrote to memory of 5748	4524	msedge.exe	133
PID 4524 wrote to memory of 5748	4524	msedge.exe	133
PID 4524 wrote to memory of 2228	4524	msedge.exe	134
PID 4524 wrote to memory of 2228	4524	msedge.exe	134
PID 4524 wrote to memory of 2228	4524	msedge.exe	134
PID 5888 wrote to memory of 2452	5888	AcroRd32.exe	135
PID 4524 wrote to memory of 4196	4524	msedge.exe	136
PID 4524 wrote to memory of 4196	4524	msedge.exe	136
PID 4524 wrote to memory of 4196	4524	msedge.exe	136
PID 2452 wrote to memory of 2816	2452	RdrCEF.exe	137
PID 2452 wrote to memory of 3172	2452	RdrCEF.exe	138
PID 2452 wrote to memory of 3172	2452	RdrCEF.exe	138
PID 4524 wrote to memory of 5316	4524	msedge.exe	139
PID 4524 wrote to memory of 5316	4524	msedge.exe	139
PID 4524 wrote to memory of 5316	4524	msedge.exe	139
PID 2452 wrote to memory of 4904	2452	RdrCEF.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1507700610554920974/1507701695583621240/Gosth_Fivem_by_criaxd.rar?ex=6a12dc1f&is=6a118a9f&hm=c7c62dde56482b8dc34c293b2eb93761469ee2e5268c3063692e19346d80a3c7&
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,18267773921085796358,1289702289692574017,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,18179406487737161871,5142043073100031397,262144 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,5184970418079101194,7707781176394162577,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,3942131959775932196,1015640035052046253,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,1799941917651428492,12361870026628004570,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6379683202886648082,4279072991053517280,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,16731921810184915705,9630504767178278495,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,8955165451815788186,8364538248358930991,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,2905360973311200406,3685155828576810878,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13677860745649093288,6659743761435754990,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7501812727745474640,3946256064933037506,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5840,i,11496020871783295040,18070740376903235400,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,14627367659137908490,11770237569837228227,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,2429889825566200920,613797008751916847,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,9906282294125801505,17708492505982784466,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,9906282294125801505,17708492505982784466,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5103005158463910746,8930758684024185646,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,14246383418887226558,17841230837204814017,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,2254934513491791601,4084685362711642442,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,165844266530151216,9357606467288338640,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,17655401127627860606,5629343620949842676,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7436,i,2390477436829185769,1782350361180637148,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,3087471542779954995,11282139764970111,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7228,i,12783289649611960536,3338806457515255147,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4552,i,1896440796657456820,5637039628206448498,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7160,i,14126380137590349249,12279908408713664142,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7032,i,6218379909318995867,12874560269363503778,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7044,i,12959931977261993497,2593455340036515555,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,5387612461051503987,8001581865336738824,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:8
  2⤵
  PID:5620
- C:\Users\Admin\Downloads\winrar-x64-722.exe
  "C:\Users\Admin\Downloads\winrar-x64-722.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3884
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,1107703092822641872,13079489070549278288,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,9191276092455720843,12719032134532951258,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,213483109612510252,4245834169839183966,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,17806218354923577866,17109071521366618016,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,7973331367991323346,17620540365090397389,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5568,i,10736115255208434830,15961977487670130413,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,1010729093358308467,16084358847891016716,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,17893338323335225724,10414079391123438609,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3840,i,10949977824389525115,13569985319559505581,262144 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=3528,i,11066863013125731209,2756007946144366606,2097152 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,12544136913316889858,3994859538238687459,524288 --field-trial-handle=2336,i,15043154528067275417,9032747434328291414,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,8982317288310248211,16421945193553069116,524288 --field-trial-handle=2944,i,6159594807992305008,16956907957544005390,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7243922617866327379,13732505416337447615,262144 --field-trial-handle=2944,i,6159594807992305008,16956907957544005390,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,7110290307439304101,5811659705089782478,524288 --field-trial-handle=2944,i,6159594807992305008,16956907957544005390,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,1860392502076855313,16828748270535123373,524288 --field-trial-handle=2944,i,6159594807992305008,16956907957544005390,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,1860392502076855313,16828748270535123373,524288 --field-trial-handle=2944,i,6159594807992305008,16956907957544005390,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Gosth Fivem by criaxd.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=63AD5F7E85AD1E2748AD3158B302DE34 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7B389E4531F67A163209BEAF415113AE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7B389E4531F67A163209BEAF415113AE --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6F1599B700A2D827DB43B24D95E0A4C --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B1AA28E6550A51AE25E10D584859AD0E --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=39CCE6027631B05526ABE12CFF803887 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Gosth Fivem by criaxd.rar"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Gosth Fivem by criaxd.rar"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Gosth Fivem by criaxd.rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3644

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5232

C:\Users\Admin\Desktop\Gosth Fivem by criaxd\fpsboost.exe
"C:\Users\Admin\Desktop\Gosth Fivem by criaxd\fpsboost.exe"
1⤵
- Executes dropped EXE
PID:3304

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Gosth Fivem by criaxd (1).rar"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.txt

Path C:\Program Files\WinRAR\Rar.txt
Size 110KB
SHA256 830d8bafaa773e1163ddb47ad58239bb43178d1f813ec553bfecb81f7944b01a
MD5 8473701b6ec8a373fd4797c3bc576146
SHA1 3869cf71bef24884603120a6a405ed66776e8d85
SHA512 8c53467a95edc9d84503a18eaaaeb46c15cbecc51759bbf44a0bc721389cc40805614c211d604473c91d1ce416f484df882a7d08373c2eda072d9cc1077b115a
SSDEEP 768:kodhu8h1SIfjcjKVbRZHwT93KEYiHSToOKyIQiVL18e5xGMm1tgD3cb+WkOPMmuB:kodhuGKKV9ZU9nSbKyIJL1ZYYsiWB5w
TLSH
T119B3D8277E8E1371257201965F1DA199E31090EF271B169538ED838C7F3A8A293F66EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RarExt.dll

Path C:\Program Files\WinRAR\RarExt.dll
Size 659KB
SHA256 6be275126f15aaae6fb48e028fc3e65cd4ad9f7b4febebceb1fb3c984f040f36
MD5 1e757b4a2da19953f02e4629dedd97f7
SHA1 67cddb5415645dd716f4a0a182c23965ab1f2611
SHA512 5f5022ebb3a1ee234a44c4820e46e7ff38ad108928980ca41a75d4ff0f79eff516a70cb81ae9ad5beead484ec4f07db8f4230455d9ee1eb5e7d955eec9b5f83f
SSDEEP 12288:CyrI1lJlLZHJndEB7UFJtdqri2+avBQKuk9ltyy:CyrIHJxHdEB2JbqzvBQKdltyy
TLSH
T1C9E48D09A69853BAD47FD07CCA83461FEAB278558372C7CB03A156AA1F177E0573E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\WinRAR\Uninstall.exe
Size 402KB
SHA256 b35ff0d49825c222aa5af767b2ea6d04c5324b8c2de68e2d7b257bf8f2dedf87
MD5 150ab639be8319e6b030557c434f4305
SHA1 4d3d6d61f9fdc089a7e653a98b1786f6bd91f3bf
SHA512 44823fc75f74149728cf4725daa66eaae4898efeef99b8e8fdb5e9f8f13dcd34b6b46ed8dd4b6134bf7365e857fd384753cde5dac63077a5c91629718bc47ec1
SSDEEP 6144:aljRoo4zIa63bknS2ecOTJDPvDOnSfIHbqeC2PIII+Sn5HBK7jcRkj6:KjF3QnS2EJzLOSwxC2PIIvS5ejc6m
TLSH
T125948C1DE3A555FAE5B7D53CC8A24606E6723C558BB1C3CF03A1099A2F237D09E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WhatsNew.txt

Path C:\Program Files\WinRAR\WhatsNew.txt
Size 63KB
SHA256 bb537fb508773b401911149eea35408d110176be59a985d559639aef3dcfbd3b
MD5 723286d7036d2fb94305b9754b751960
SHA1 2ddeb036bcad72c4c556be97d7af88bcec2fe84f
SHA512 61f943392c0f075f9b3aa85c683819a1636cafa0c2541973b0172724a38b5b38d576bcc6534bb575d1f9334f48ec936ebc9ea38297d537fc65177fab398b6ef7
SSDEEP 768:KMiHKKDaVkJimxZ1Z41kVEbUDbwXic9p63Df3fXxuWJo4c:KJqKDakJ/xl41kVxwXicDYb3fXxuqoR
TLSH
T17153A4237D9A13712AB242956E156295F31861AF370B42C4787C838C3F369A7D2F76F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.chm

Path C:\Program Files\WinRAR\WinRAR.chm
Size 320KB
SHA256 68038b348e071df04fc97407f6e0d4135cda3f6520410c917533091a57f13477
MD5 943c004c4be680c15dfbf5ffb572633a
SHA1 8f19755ab1a6dfd7d6fad988a3ad9114df3f0add
SHA512 b1f1f0562a2956fbbf2b24298349766ad4672f822d8b789623cd6eebdfa1dfca18b97a529a47901a7f2abb6ded621829b4e196cd47132f2b0de642a1cfcc50cf
SSDEEP 6144:80W9Q/Hy3rKBB5k2UEiG63C0s3Vphf3rn333NWVBtKX4ngVTom6XNRLCHSR:I9iygYuV3f3j33cKo8oDfyG
TLSH
T1CD64121E7D9E8131E4E57D71EACC07CD2320B82A00C27F112D4FAAB6A5D8FED8169794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRAR.exe

Path C:\Program Files\WinRAR\WinRAR.exe
Size 3.2MB
SHA256 93197a5e32265778176e53103e56666f45a085ee579d668317fe1cdbff5767cf
MD5 a129e870a870acd3d59cc1b49404cbb8
SHA1 04121c5d4abe73472329f2914ce1c0d9f661165b
SHA512 03515ddd51ff47d16b72d267a9288c7ad484adfa49ac54c2d36eb600a839f1af278876b47dcaf378f8a81663297477842f302a323f33f81b0e3bfd07c3b9728d
SSDEEP 49152:XzksfrJMv7WyI3kkv6h1oD8eiMv3SmGlO3m17PnKtbtYbsfUeT+uXEkjNEEBHLus:oUyhvdc8a+uUkjDBHLus
TLSH
T12AF59D0AA3E406ACE0F7C679DED6C553E776780D07B0A69F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1276925427\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1313642480\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_608982086\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 15654e05c2ba2d0d66d5315867cac37bcc78272088b18b379960548afad9dd1b
MD5 fdc90236e68d222449a3343e1ea83b13
SHA1 95afdac0903586dbd185314119a9c7182439a723
SHA512 8091032152272cf536377d0d7592c731850606c8d7bfde75cb2a01734607169b4053355850af1385770f338db1764e725a64363ae8ad83fe24179987b6bb0709
SSDEEP 384:yerdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:m+eUZsLQCZsL3hUS4
TLSH
T1C453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9c7f53bb7f47324e773dc8209de0171e01f576e519c0d152b637061e4cbf2c61
MD5 042dac63e59a4b699442551eb0d72e80
SHA1 aa3afaa5a23494ad88bb14b327437cfd3ee2036e
SHA512 a511042ec53a0bc05fec3dea929e93e974a2c5a843beb466f1bd1324787a689bd033b631fb67634473084177e5f4836ffbae0c5833f1755181c9c895f5050b8a
TLSH
T1C2D02374FE1198E2D13A717B151943051FCC4873111311A85B282C2CCCF58C6C8D1E96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1005ad86b938f5d07fd87565e124bba2ae93258d8eee0488f715e8c5f29b510d
MD5 fb9de71b9029293e0a465a73ea12bed3
SHA1 e24e4380914a755b882680f5150963e6565ad192
SHA512 bd0513051ce61ce5a1ceb930af444bcfce2bc99da88a939f70444047ed5c9c8600002b2be281330022d009b9c59ed2580808738f2987ccea5b862763bf2477b7
TLSH
T1F4D02364FF91DC51C07B7137294EC3052F8C8850505350B84979353C9CF6989C4D5755
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 abd1cffa5fd85e52c483c770ffde8b9161f8c158cc9f7cb3b2e11bf911da96fe
MD5 78b676881f0030bedf8b244a91c5c6cb
SHA1 29edf4bb37734988cb4e76a0d4b4c6ad2ea18398
SHA512 3d19c075d9ec30444d924fba8fa595b920ae513a74cb87761efe41ba50f781fbb8e258210853edc886077a82b1e157e86e3a2c8179cdf1c7ca45edcad6ef5640
TLSH
T1E2D0A764BE91DC51C06A71372959C3052F8C8894505350A84969352C8CE6989C4D5655
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

5f1d4348-4d02-4ae0-b85b-ff08d0e8d89e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f1d4348-4d02-4ae0-b85b-ff08d0e8d89e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 b5c7c5a2b83e2bde80138413996c8e3dff073166782c9ca96a711fe951e0629f
MD5 21a8df6e9c65c84ffcbf1e96e0675af3
SHA1 4887e2acccf27a549e9a2111983a81885f455f37
SHA512 9a38e04fb2dd426a4721041cbc443b2e2d7fb2366522d72b6fe0104c944988bf757e93d111ffd7ce8c26363abfcc1872cfe4d9344bf5667d21f749df000768bd
SSDEEP 96:be7xk1TObg8BQA1G1FkH2Qk6zjkKVdrciMMpzvN6e4LOi:Qk1T/8J1G1aWQkQNfrcYpz34J
TLSH
T103E1843015FA7A79DF1C893240D84A5E36328AFEF91B1E56C3105D3A600375FAA75CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 558fdf129074306b2bb8b58b7e557a74375b2443a3fefea4ce16f0cd1de707dc
MD5 3fb1b6a7188271822f5e92e2638f3551
SHA1 b51c50396feb7c9956f1a5cc6701fb157ec417c3
SHA512 40d7a8264702287bf1314687d9faa58ed9ea2ffe4c0c0475cdc8b1dc46f4bfd63fe2741c71aaf42f75595097364310cff97a5cdb1b0c7c9a119f0336d1284a03
SSDEEP 96:3e7YiTapRg8BlakOscQNzJRjIHYojGMMOzP6492O8:/iTH8ra5PQtXYY4EOz3e
TLSH
T11BE1953045EABABADF2C853150D9195E373294FEF9275E46C3015C7A600339FA278CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d925.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d925.TMP
Size 3KB
SHA256 bddb9bcbf9fd8d916851fe61f5cc67eb2eb66994bc5f5e4f62e45b2f5bc37b05
MD5 d4b50087b8173c20e17756325f9de13d
SHA1 cb771b6d47b3a143708b180c6ce82036d83db4d7
SHA512 3264fbca694769c7906c57de738d6cd251a1289e08d659fb83901985a9c87995dc01e8adcb483a8d5c92677e500e775332476f04b0ced1da837ae382db330f30
TLSH
T12C61C5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990805633761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 5a34658873835a75ae4ff44c794519234943db39900047edcf11245ab509fcd1
MD5 f12a8c9b18c0d4920ba73431a6ef08a5
SHA1 474831459df98ce4ac49109db4d56ed01ec2fafc
SHA512 edf29744f41d390d208766eb4dcfeb4b5c8e12ab81fa94c43cc4cbf9442fa8e5eada4a327dd5775320a0f669a60c8f5f30131cc1a65549fd95cccc703ade7d5b
SSDEEP 3:MsEllllkEthXllkl2zExllb:/M/xT02zk
TLSH
T1CA440404FFC04405F54430315033C3D01771D415051157C3755115177DC75C00C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d9547f6-ae6f-429b-a6a9-2462ccb8517f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7d9547f6-ae6f-429b-a6a9-2462ccb8517f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e8375e2dc6fab674ec6c689cbd71cb03392184cfcdc5e8ccccb5251351826549
MD5 239917cb30595fb34670c8ca6f5aae26
SHA1 f83225f776558034877a29809488b73207d55324
SHA512 0ec5835a6b20b49d4ce898ad2bc9c5e39990f5586426a010ab324cadaa4dca1ef5813a8a01c756c5da321774428009bb5846de9cfc630edbb1a542b5c06a60c3
SSDEEP 96:Dh7OArzjEegrkqzOkifejEQzBs5w/vj6Vuqvb1GQ1Yx:DhiArzjrgrkqSkifej5zmevj6Vlvb1GL
TLSH
T14AC1ECF3C3E5822DC91156F0AA187F1BCE1C0956436C3D5A85E4AF4BA3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 81662cbaf498bf79e4a459954a232c0544badad1e582972330f47753a879ed86
MD5 d5ec6a37fbd5f27da3e90a5e90697d87
SHA1 0675a32b39f3170a2d89db629ee72e5eb6f2d8c3
SHA512 dd82bfebfa350aff0873c79601528a8a3d133f38df9e407ce548644719c1073b10c8ed08cc51269d11317c4f9efd79647e3b5b9d361a40d607920f1b5dca0a2f
SSDEEP 96:Dh7OArzjEegrkqz215kif4b/k1GjEQzBs5w/vj6VuIGk:DhiArzjrgrkqC15kif4b/k1Gj5zmevjo
TLSH
T167C1DAF3C3E5822DC91155F0AA187F1BCE2C0556436C3D4A89E4AF4FA3F2471E191A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 65fca3f6cceed1503d475c84a0fbfeb4f2e22245c7d5388c5a5d8635add4a240
MD5 0605e5656b4dd80adb350694cdf447f5
SHA1 756435ce34a9ad73bf7d19f95aaeb5838ee35e71
SHA512 985b4f0d0187ea8c1fa506d7954d0410fccb1022cd124588362bd52e4b484f26b20f4410a45a0b0fd654bb33319edc301ff54852d966f404b8b30ed4c3aa11fa
TLSH
T15ED022A3231070B6B56C6EC799AAFC8FE726107C2C83FDE920F49898493396D0507188
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58af65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58af65.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 85932c0610f23a1f044d2d27d92cb840f34e4c1ad5a3d9c2f9bc8a3fa46c8161
MD5 34693e5d98501f62ff4d2c5c5f1e7bd0
SHA1 9d2b20e090469ac2e5d3d54e9984ae50de02e7b5
SHA512 210a96f605275446026b33e861e12801e0f7b333ccdd4c034f8e9eda11f07f4236813c94d9f98b579c837a283d2df1da0ae94ac8745902e79cc9e32ff4037487
SSDEEP 192:sxZuRsyM/jK1Ml8M9m/fYsOK+gMwGVK5OmVcIdpJHW6+WNGYv9jzRIg4J:sxZuK1m/fYsZ+HwtOQJHbGypc
TLSH
T1F652D916AB34597BCCCBD20DF9557F53D6F9146292900E48AAFCCB1C05E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d0cdc1d368561fed3652915ee9b81b2b3c784f9c7f9e3e71a0727d83d475c15b
MD5 c490c27239765a18937c881ca800a726
SHA1 b63ffa93b85d22704cc5d00314ce92025cd78e75
SHA512 451c67559be9d6c570ec99ec1162c337d3b82905add6652ecebac883ded4565536fddce88576de788c1eb0db4356596a8df3f5e91bb4821799d67751af09ba5d
SSDEEP 384:sxZuiam4m/fYsU+VwtOXwXHbdI/p7pmIwr:sWVm4m/fY+VwtOiHbQV5wr
TLSH
T14A82D7536624897BCCC7D519B9257F53D7F91462DA904E4CAAFCCA0C04EAAED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9de16bab4c318a54b3356be12d34e09e31ef2518db06fa8a91016c5e93f35d78
MD5 a8995e7ca30c9c1ca27a90b01fc49754
SHA1 3932ad7c3e21b6784e96a45932fd11e9a8c13bef
SHA512 28cdfc54214501c822cc0cd83d4a1bc04b5ad70e39426d8d3a7d2e210dba7035c96c4010f155d0f06e40b11f862db97db6855822cac204de4adba7e66fde8b88
SSDEEP 384:sxZuism4m/fYsU+VwtOXwJHbdI/dpmIwr:sWTm4m/fY+VwtOcHbQd5wr
TLSH
T1A882D7536624897BCCC7D519B9257F53D7F91462DA904E4CAAFCCA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3316a22a9434102d87ed720e6ee65cc0f10df27cabc1dbb711642b2052f14eb0
MD5 c67a33d938e1a6d86f0069db940cf9f1
SHA1 b0e49fb0c50ed26866ac44c93ffb4715d05ab648
SHA512 7f83e1f73f2c58fff8463d72d3f2e74c303d63b17ef49e03f235795c2306c276e5b76653116aaad208e2f59814131802e71c3eab491f2e7aa7cca2564d699cba
SSDEEP 384:sxZuKsm4m/fYsU+HwtO+waHbdI/ZpEIwr:sWLm4m/fY+HwtOiHbQZzwr
TLSH
T19A82D7536634997BCCC6D519B9257F53D7F91462DA904E4CA9FCCA0C04EAAEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 c9515bc39e17ccf8bdd515df427431547c34321549bc433aea388c59c817ffe1
MD5 967b594f619d248b18523e598803f5db
SHA1 ff3858f2db760dbf47d47af8670d7274f7683886
SHA512 4489a7543322f86560cb8d8aeab864bd56ad7d38997555a5ad72f8d6367254ca91946b84f3f5c65e950cb45d3d1367e7a47918e7de62ae02378977535c27a5c4
SSDEEP 384:sxZuiqSm4m/fYslWv3+VwtOH/KFHbtI/fgQIwr:sWtSm4m/fZY3+VwtOHmHbgfqwr
TLSH
T10C92D7136524897BCCD7D519F925BF53E7F91462CB905E48A9FCCA0C04EAAED2212C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 795e3727bc6bace2909988ba42ae5aba461401fdc0649dce54d3367eb65db775
MD5 30116b7ab2e09e8695830f95dfdf576b
SHA1 a2d341a73ae8b51df9e2f659aa2ae3a76636f28d
SHA512 408acf4318c9b729dc2a87d360e091b575831bd592ddf948e5dcd9b1d9e60e0700c08778a13f713eb77504f31f8723c5a0d1bf6200618cee85d315b262559ff7
SSDEEP 384:sxZuiqom4m/fYsU+VwtOa/KFHbdI/p7pmIwr:sWtom4m/fY+VwtOamHbQV5wr
TLSH
T10282D75366248977CCC7D519F925BF53E6F91062DA900E4CA9FCCA0C04EAAED2617C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c5811772ebff081faf7d801b8d1745cecbe62bd1cc97e6cb2bc93b555a6091eb
MD5 20fbec6d20eddd0aeed8ae72aa743bda
SHA1 3a3feaec0f56df566a9c2dc7d259e42c1ed18de1
SHA512 3e1482ca40eb91d52424d6b0ed77aa7d35b6894bc83b04e39bbe755e1e79c952166606632dd18a69017a4e0fdc4333b09ccf1ee6cd9dbed3999090126cbab662
SSDEEP 768:yYseJpv7pLuLXhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCEVcLly0pplroq:yYseJppEXhxWvhfynu1jarEVcL88peq
TLSH
T123F2EB3B680CCB7E4F844E9CED2A7F9A6EE8018B56D8899447F9840C02C76EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 5abb4f5b1405a13c0575c178618e29d803082bb8d388dda22acd4f9cd4e620aa
MD5 01f67076425f5a5505ce22386ab72cbf
SHA1 541f692acd140f9015453b2756854e64fd47d696
SHA512 b7d4941b7c37ba6d5dfbf3d2420d4bb9f884b4b557d15c957521dcfe1f1ad0812762753ebe33646cd542c74ab3a79d2366d091c0de63238bfec89b11c3bc799b
TLSH
T1F2A0025203A4001BC21212B1155242517B02C820392063074099006CCD505D44E4734C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 43cc9cc2046aa154c825ab39b8ed36bf2bca036feaef1245f8c0264cf32d720f
MD5 9b26d244ccf8d59ed5d5d42d2c25030e
SHA1 83faa010023f4f85948366aeace2f63b711794d1
SHA512 15f08531a47f498ecf56d5cebc0442f321b7fb66cfe9712868ea0d149e4227cb425d89cb383cdda1a3dde134227fdbfa98d9ae5e232abcc7bacce94f9e6ed149
TLSH
T1F4A0021802803201C50732B239D601B562105ED40641272D9590209CD8E075B565240C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\434c4a48-2127-46c1-8c3a-5173ec138527\index-dir\the-real-index
Size 72B
SHA256 0ed1743ffc654ce17987203c35859c58c2843ab77adb0038acb8448e8d186a84
MD5 6d9007dbc1d39bdac11e86d1bc9336a1
SHA1 6943fd0fea6d474695a400893972afcb73c4aaac
SHA512 ca56afcd746246d6fef6bf0bec327764452653762f304987c4271ad770fc31caca970b90d53a721d85818430c68995b24dcadd69973ef8441f3721c84415a21c
TLSH
T190A00224058A101DD82123705141A361B3625D6853B5E35185D81184C9511808701012
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\434c4a48-2127-46c1-8c3a-5173ec138527\index-dir\the-real-index~RFe599f53.TMP
Size 48B
SHA256 c72365d668a75cfde1091f210b287eaa0893c769d553cc2700fb2c394a6ddbb3
MD5 0078ddfa0f06275754eb831fac97cf95
SHA1 18594c52dfe31a611f1089888bfffbf9c2f38c79
SHA512 cdd054edf4e4d9baa09dc187ed44a05d2de71f4dab6df732078ce6eefd1206f26f6984b1cfd89812136d428a458a0cdcb29e0bc0e21f0cb98acef47d2f14a17c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 027d8e49eafbda24f503e671b0de03b30e9f7345af7e72f84cceb9b44c44c24a
MD5 4ccadfe3c40bb2cd020a839aa96f4144
SHA1 3f875a74d2385d7df356830b96624a0391cf2b79
SHA512 b696b21462aec4bb787c19bb04e1c39c377b262c165258ac8abd3a7b792c146f44fdd8f663450238011997a270697ba8401e0a01b613e610befce77c6dc214fe
TLSH
T1D9A0023222691259D10356F0D1C302506317DE1D010943065090855598D115D4D31188
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 3KB
SHA256 c902a58189d3ebe260b18e54066741fd148c29942d26941944fcb107cb8b24bb
MD5 b0e474dd46705eebfa2c570b4ff6294a
SHA1 24427845654e4620397e6967ebaf2ddede26def1
SHA512 22d6a990d0d6783bc5bb1257ba2db5f02a3f5ab69fa6ba568c40c86d37e9a5467eee0b8dd80a97b665e24cf98564d87f74651589f083f1f2e873a3127d6c0145
TLSH
T1F851B34D8D820B69DAAC01B314B20519737D6CEE2AC88E13A4EC9078B9976791CE9328
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 636b61fe3e7d2f41e92788bf3fc178f9d08a51e584d43d9b694dc85911b81487
MD5 675948eccb5115107f2acaf2591424c9
SHA1 dbf4bf612aab668cc6482591f7bf826f75d482c6
SHA512 bcfbe73066a42edbe12897c6b3e2cfcdd32c300b8bc50599267f25550d07703ee83ad471bbeff20c6e27e9c59f626f2d1ad91445201a4ded1118e1a2352b15de
TLSH
T1F831338E8E41959BD9E884B2157674E433F0D9CC1B11A2534C7C3A3A3C6635A6A4F0CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe585f61.TMP
Size 1KB
SHA256 268aae2d9e3c4aa26e8e077a3d8db7b67888c7d31593a7dca19b12b7ca836e32
MD5 bb6c68f2d40446f3bd7fb3c6af00234f
SHA1 9814f6fbeadb12e83e722bbce654a3af4a284fee
SHA512 0cc70f7b365132ff86118a2267304ed215f131cb0b73a15b35616a44e356eea238bef2a80b2093bf1b4439358d40ef986c671a3fac5999cbad618b8b451f16b1
TLSH
T1C431428B4A41991FE8D440720596A4B83375C94053227783987D633A7C7579D6E5F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 877e907f183b520b3ab3df33fd902bac98c0b5343889786876d234fce264dc6a
MD5 b48fac99ea2f050f164c31ae678c7b56
SHA1 fe92713b816c2ab18aa5aeb274c33f8801cd9ebf
SHA512 db53b4158ffcde9ffed2e3e89d9a29c48d6d5bd94d04f198905dc61aaf3b9513e462b1747d122d17780df23ac221cfa84b694d64d3a5588a1868b021238b80a6
TLSH
T1BDF05C773FE72914BDABD3E660308460164D7C59D413EC4E5527F69350B2319309ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 14256cb995f76f85d7ee0da1a986ec1509ea095961ff8a3c528e574ba392056b
MD5 ea1e618aa6d2cc58d946410264eb35ec
SHA1 43ce228bbe008b78a0906722f578f1a3d3f3d268
SHA512 458c5eb79afdf083441d81db3597fe1bc7f516c7910f8037671c25910e1e38954761551675f520649e830c7a8634c397b24c98ddc95956f7bb75e85815652719
TLSH
T179F05C773FE72414BDABD3E524308460164E7899D422EC4E5527B68350B231D30DEC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 724bd1e35243bea56614692ef13662e417fcafe354b3691b6d9574efd284c918
MD5 31a61fa9bd73daab7075045223d2dda5
SHA1 67135d237a8d119defc43f6c709dce38d89a9b60
SHA512 948f825dca2c2c46176a862f451fe9919dc68e218b8f11b22398ac6363f2081d93726fcde8d19f4018dc67888745459c0c4e3925d5a0db71d50ac88e99c7221d
TLSH
T1E7E0C0B62DD32414BDAFD3D22430C090060A74ADE902FC0E941BF6C310B231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 91723c4e64955df1c3cd6a1454fb3400e2aa4240f3f3e7a18c4e48ba1ef2ad9e
MD5 80de3d679603f8159cb1328a71fb6e41
SHA1 c0961fdc767b6b65e464db2fce6cf59d9cffb290
SHA512 60346256b2c1e83598dce2372aec0bf19656e04ceea7e220908fa0b0adeda076e2b0e62a4d5c5d5ea306979c844b1c6adb243f28dcd08b26e6a7fef448ca4de5
TLSH
T1DCA0023382685149C00042B9B0451A84E222C8140E056222C4E5D154B9611879532414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b4c4.TMP
Size 48B
SHA256 c4161b52c4ae7205269375fbdc16d0170f0a8a1fc6d4ca015a9ec78c1cf2fb79
MD5 17205b851b48fd4451dcbb075c385c02
SHA1 8637319df5f85a7a3d7d27dcea66218fe800b8c0
SHA512 d4b0b2e8b75b0d7aaf5d19adeedfc21c74df7935a63ba8c0529dbeb16db72a680842ce75f7c4e3bc38d041e02ca9c3baeaa2e9dc844ba6bdc3b6941e53e0e745
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b90e253cccd691a1657bcaee7111b1001377c282df568a34939ffee92bd9471f
MD5 f0eacc6bdbb23f13c3618fb4751caa34
SHA1 c35eed3b47d969954a9b7ec72e37dd8ebdf85b87
SHA512 95ea6dc6aa267a36b68dfaf4bffafe854ff8609ca995d4b918ba6311b99caab66dca0b876e6f55c4277a7ddcc6455028650c58ff9ad9a371e5fd13b779b3d401
SSDEEP 48:KYHIhKggkXySdIxK+cMjyXUB26cOO9nyLwIgC9K98F89xEtCTSOGyXDIvj5Zpyn+:KYH+KggmBd+K+cie5WKKsK6sgKNH
TLSH
T191A1421230BA02423CBE288DB7A295375F8130E2345CA5AF7FB854951D66E610FFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f96612f6-9532-4a26-845f-d7907a00354b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f96612f6-9532-4a26-845f-d7907a00354b.tmp
Size 414B
SHA256 1954f32a37329705ffbc69bc141aca464a75aa284cdf989a0c682938a88d58d2
MD5 2c9a40d9cf5e21d5b0c8d97c9c6ca141
SHA1 1bb0eb66a8c69ccd7d6426f5da1703a507aef9ee
SHA512 1ba07c34392ddac23abd1d9dff72758df42c517e9183798886941c1aab218172bb2900c4591c3f87603aed4b3994cbd5cc713c0a3cadb62636ebc4b6ea0717a4
TLSH
T18FE02BABC821DC271DF95718E454074AE754035B27A18D1F3A3DD2098FF0A7A455685C
MD5 SHA1 SHA512 TLSH

Submit Download

a275be97-f69d-467d-b951-7c38e3aaaa03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a275be97-f69d-467d-b951-7c38e3aaaa03.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7251e306b9e1e74f7e2f6dcbeeec8a9ffcfc5433cf3541eadf80999d5a1fbad4
MD5 8ff51e4da3d8e8f2904ce6b2188be108
SHA1 d30bf34073ec61cc8b54184d79ac37352bbcc224
SHA512 dab21bd3212992d27e21dacca4b42297e7e65c57ec9ad4a85cd02278f39f0ecb88de5a68a61b702f32e09a1a291ac8c75db2827663fb90137655f6f7a47005ee
SSDEEP 384:nn7tNnNnb9YsNTiTq7n7vVzFIKPlV9v1yk:n7jZbaGH1FxlV9v1yk
TLSH
T17F723B736C396DA79DA3BA56F14E37031FB851AB96C41F84EAEC1F0D00D725C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ffae9ea72e4ff8df892c3fc6114f29fd045bb6c048f3a2876b243758c0af6f7a
MD5 e44736b6abd1b614df40558a361384e8
SHA1 6fae93a712bf62a282422d5f9654cc6c22eabe9c
SHA512 8953781d9cc94bfae555db52ebb6a8b0a997118573b77df53d58c24f3ec46950dac4a164ed9dfb3ebe8f38d5bf2512a0ea7cba317e341900a9d90f0f21b0360d
SSDEEP 384:nuiFGtNnNnb9k6sN+8TUNTUlIliTq7nuG2V5xfhXFIKPlHd6vzVSJAIDSYsw9rkM:FFGjZbPlwgj12rXFxlH+xSyw9ljyk
TLSH
T15AE23EF198D78DB6D89E97C7633DAD0219BCC163B5485588B7E4296DEC8B0BFC302815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bf930634a591b722b4c10fedf6257802b55e3d713c98be3dc5a186854189f9c0
MD5 b65e55d5d5493eb6e82f5b435967000b
SHA1 4d7788cd2e39c929d19fc8a0d0a38189bba627e6
SHA512 12fdb9e794165ff997521491f2c0cd541a721733ec9594766072c0a000c97a1ef3db6c6c1d4d6c98c58815d0b6cb376f1f5ff8b3b5a52f72e1dd534a1f84088b
SSDEEP 384:nuiF4tNnNnb9k1sNt8TUNTUlIliTq7ntnV5Df4XFIKPl89v1yk:FF4jZbkcwgj1QXFxl89v1yk
TLSH
T18CC262F298E78976E9AE5783A33D6E425EBCC15775845980FBC81E4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a9a3ba80dee27e6fc0828be43f5cb1f344e99e373f83ad271877e62ca0935c68
MD5 7048bdc078055db27ea6e148bf3f6d75
SHA1 f35b76d73c871ae293ac5855b1b7a50ec1d96c9c
SHA512 399335c2ab70ad6c8e2d2ff10709d64c2d89a0417e13c49f6188f29921533f9a84aef25ef8e18aa812d8aa5cf277217312eb0a567a3f3441a5e65946e5311637
SSDEEP 192:uuhZSNWMsnMwy8Hrnb91AsNTYkQOM7qE4QmiU1vUO4MTobWCIK++Wyi768z19X/B:nDtNnNnb9OsNTXC7nYmRzFIKPlM9v1yk
TLSH
T1AB623B736C396DA79DA3BA55F15E37031FB811AB96D02F84EADC2B0D00D725C130692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 84530896998f4c5368b292e09502b99b59c3f90ea72ae3abcaf31a1a6e481f65
MD5 aefa5f2ef6a192dbc28b0398e3bb810d
SHA1 5eb82dcff4175197aeb055c367d7f7104985a9c9
SHA512 7022aa69dc1877a5499fe2c37fe0d01bf338cbabc4d6c0b11d244cb8021ee47f69fda98c8eb2b364b738c72c34c6bb369d96000669fda4554cde45c76b48d370
SSDEEP 192:lONG6vMtPQmiUygLThTobWCIKp8479aLU/u:lONG6UtRXTiFIKR9UU/u
TLSH
T1E7020876BC686C7B9EA3BE45F48E27171FE4116FA6905B50EAE82F1C00D765C130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6b960218833e4b8108eaef95d10858171cb1dfadcba1550ba196b7cff5c4fa6e
MD5 4017436a130b9f80aad791ab4169fb2d
SHA1 52199acfc17e31d07f9c0739cb04888a1c0d8714
SHA512 59a2d2793b62786d6ae2462550c13193277c3becf8ebbdea97a9ab6d49ab8b50eddfaffde4c288ae1b10ce73f1472e7a6d9a9235a64290127289288edd95b834
SSDEEP 384:nKtNnNnb9OsNTXTq7ncvVzFIKPlV9v1yk:KjZb4rk1FxlV9v1yk
TLSH
T111622B736C396DA79DA3BA55F15E37031FB851AB96C42F84EADC1B0D00D725C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 33ec133731952cc415dacea604193612c80c43f654f02bd6132c09c69b6b6284
MD5 bcd1aa42635392c26f5146e3ed3e3252
SHA1 3899c6fb2d37807591e341cbc303efed6e8a5b65
SHA512 b2c7a14a8e657cc369226e5db51ddd4cc8b781ced1d11129382926a4596fb37f7c0c198b38818281bb9f68630ab18c1ebc38b9d9e1187ad1d7de3da0583e6020
SSDEEP 192:uuhTSNWMsnMwy8Hrnb91asNTLQOM7qEKQmiU1vUO4MTobWCIK++WyiK8z19X/31T:n1tNnNnb9YsNTLC7nGmRzFIKPlK9v1yk
TLSH
T139622A736C396DA79DA3BA55F14E37031FB811AB96C02F84EEDC2B1D00D725C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c6d742115d63c0d2da9c1776154a397bbf5935954dcd437364c86f59a5377b6a
MD5 e85287980c133d900868638ce229a131
SHA1 c71f71c6ada0bea90a3edfcfc63017952305a8fd
SHA512 f3c8af4bcdb46d177c0c9732dca12afebae0c4e3d489832aaf009039f676b98e1c69d2f2b4cae99c138f0b6707b8d1056bf5cea6d081cebcb9a143e0ce30dd9e
SSDEEP 384:nuiFttNnNnb9k6sNC8TUNTUlIliTq7nFFV5xfhXFIKPlm9v1yk:FFtjZbP1wgjPrXFxlm9v1yk
TLSH
T115C261F298E78976E9AE5B83A33E6E425EBCC15775845980FBC81D4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 15636432101c15acd6621fa270e32ab337ba3c63ff92e10d496c77cf945d4d86
MD5 4a31f42a61ed0ca6b133d2d05cadc265
SHA1 a779aee3eca556955b0397d0ce2966845ac98dbc
SHA512 e737627444bd26c5d8a64c33cb19b74a883d97fd115f0884d257632b3e818e89697723ca3bef7337a807e654c448f76d9e3b4853ec65b933ba187b5ae5688b16
SSDEEP 192:lONe6vMWPQmiUy2LjhTobWCIK++Wyi180I9X/31U/u:lONe6UWRTjiFIKPlr9v1U/u
TLSH
T1D6120A72BC685CAB9EA3BD56F48E33171FA4516F96805B50EEE82F1C00D765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 818f9d93429b085a6f22f6328aadcd12f0dd83b160ffac5b46241d958f8ef690
MD5 3abdfa9a575a8514e5584592d2e674f6
SHA1 226b3123c87352bd3236a36e29abaf631143c7d3
SHA512 2ce13f5a1f37810cfe6f0fec4c8cf1010f795b5d83a8e4d1e3ed3fcb890fe2403c16020ec5862961fa652b9b603addf285dc6de45a443a6cf39c3b7b1de1a7c2
SSDEEP 384:nuiFKtNnNnb9k1sNC8TUNTUlIliTq7noYV5xfhXFIKPlm9v1yk:FFKjZbk1wgjPrXFxlm9v1yk
TLSH
T14CC251F298E78976E9AE5B83A33D6E425EBCC15775845980FBC81E4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c42aff3486e95c3b1db638c6533f6965dbf01a3ea8da5121d4da31bcc763b740
MD5 e70f3052806f871ddbd1b0eabd722e3b
SHA1 11bf917bb6a0fccf2c6d22dfc57bc22abf2c4262
SHA512 4c11f22e34a3020295a52b13d1850984e295aa8aacea56981fdcaa0ac78adc14eaf04e0536535e8eccc0e29676d171cf36cd3bc73f357ce20cd39bbb56beee12
SSDEEP 384:nuiFGtNnNnb9k6sN+8TUNTUlIliTq7nun2V5xfhXFIKPlHd6vzVSJAIDSYsw9rkM:FFGjZbPlwgjA2rXFxlH+xSyw9ljyk
TLSH
T18DE23EF198D78DB6D89E97C7633DAD021ABCC163B5485588B7E4296DEC8B0BFC302815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ee8cdc46db00a12a2f5fee37d4df47d5667552c842395a18591b406b2f571ba1
MD5 f588c1e0427ea7f87e25279276e9947f
SHA1 937b6ebeb23d3438fdc65cf83d09c36bf16fe869
SHA512 9a157f60a7c5193bd54e96c390a6f4c4ad6f07cf7ae32066d99169693915ba00bec1a0771ec5d9dfb4fcbbdd1cbec5413f4f87eb8c975e41b652930752b070ea
SSDEEP 384:nmtNnNnb9YsNTiTq7n7vVzFIKPlV9v1yk:mjZbaGH1FxlV9v1yk
TLSH
T185722B736C396DA79DA3BA55F14E37031FB851AB96D41F84EAEC1B0D00D725C230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e20b7f878d36a6b08fa24195e4ce218543c371657aefcd91857eff52359e176e
MD5 62d31c3089429703f000ff31ce857442
SHA1 35e752fd9ef8188a154d583f7eeef1c67ec974ac
SHA512 d1096639d5bf980ed5f92d2a576deaa81b603172d5bf78b2e794453aa29b178c08226b24e2ad026675d973d9d091909fe0c6bf1e3b3437aaec960009e7ba0659
TLSH
T1BCE00102E70042BAD06957300097136023F2C46006F21307081401743D932401EB0F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a1251.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1251.TMP
Size 392B
SHA256 4fe6971d611524bd988766126e51f2deedb2118bd015aa84adcb6ec20ad5502f
MD5 7c8984cd6538a6f0203fcf57a34cd507
SHA1 271c1766e97137c46bd97ffe6aa2ab44c74c2d36
SHA512 89b2d82918f167b75a4d91c2063d740e8d32ba388081345da5775b8d8ff60071369c2c768677da893ccd1e47c45203e55d0acf867f6c7cc7524e3102da28d0aa
TLSH
T1DAE00202730042B6C05953300087125022F2C46006F21206081401741D532001D70F80
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 acb0d3c4423d1054ae0ba506b8e42f4a0c0f15d44f6e51737b271bae1d239ca6
MD5 50c61d528c99531329b5ba312148c0e4
SHA1 436f6f9a473ca689d3448e1d7046236fefbbee95
SHA512 1b4e40789605fdf743f2e122cb6b5b242871fa58dbf52384c4280ecbb388adba8ae8e44141129e7d15365822ed7c564d17f33b0a1180b32560c407706a02055f
TLSH
T1ECF05498503C1C81F4C03D39E032DED9F2216C98BC01C32D544C7C52C8566724406B1B
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 5a14b98a8fa2dd38ba1220aaf698cb1fe4c290dadd01b786d4d95410c157494b
MD5 ce2699ae19060f6742534854159aeeb9
SHA1 83e138a5298154e21444e93656ed4050df8069fa
SHA512 a79ee5ed3613446d071e15427f190ce6d1e4f5adeee2e94dd2d7409fc805192d2bdd74e32cb92db686593bc1b62046babb3f597b24caf2570bbb6a48ffb42543
TLSH
T140514BDAB9BE6754C0030440C83161CCE99279DDECD8EC1C9DEA9B630B50E4D0875686
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

b3ffc1b9-6835-425d-aeed-b079b3d70d19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b3ffc1b9-6835-425d-aeed-b079b3d70d19.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5128e384bd7b1bf749479033762238b1cef89b1e0804d952c5c07af00a902e18
MD5 8538cdedefca9c12ccc9cabd147842c9
SHA1 20719c57473c40e1cae2b61d7a8839ce54c78768
SHA512 59f6f21bed0f5979a236accc3d8dfee130ee6e656d6403874f905d6a411bdb57f5368ea41a836a44cb518fc65a04855c3c84eb3872e8e1677b94976e1ddc068b
TLSH
T191412D5CA6ED5118B3B37E46EFF668AE887BB9772E06D55D10110D4F0A22B40C972733
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 f5abe1aef2c2309e27638199ed46a36f626d63c5aa613ee7f520adc4c2dad091
MD5 06f3eb580c0e617dd94a9a912faea4ce
SHA1 d1c991b5b8c6697e10618960a64ba1d17b33fbc0
SHA512 f251c1537a3f7d76f4c59028a3047d04e04c34c795c1c646a073d2a161c8a7626292bcbabbf98f74be1206bff20ed9a76f808a6b29982de9272385d4ef5e7d7c
SSDEEP 192:mCl3AwfoTP0jlWdeiAS5ZTH5gkAVtBFdFdUS+X8yO8GsuRJPM/EEllG6cb:2wc0jlWdeViZcVnPFdUSa8ySJPM8E3kb
TLSH
T16543A3A2B848C205ED0E2C769FEADBEC23317D16CE6B431335C1B77E89BB4C14A49585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5210d57a-4513-44f4-ba75-ce9c87e91001.tmp

Path C:\Users\Admin\AppData\Local\Temp\5210d57a-4513-44f4-ba75-ce9c87e91001.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

953ccb13-18f9-429c-80ea-d7b2e416b7f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\953ccb13-18f9-429c-80ea-d7b2e416b7f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

de69cb9f-3fcb-494e-80de-883b045c8d4b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4524_138908159\de69cb9f-3fcb-494e-80de-883b045c8d4b.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4524_1521844972\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 84efa0c0fcce85a148c6346c5964d0799127e14e2fb43b9e1c02134d313f333f
MD5 fa371f07dd86efeda2f5666ab16de0d8
SHA1 b0009bd4a1f1dc0ff2a67431745662305610045b
SHA512 9c34b2ca1184b25b72f03cbec52c185caf50fb01af02201b269ff8b0a07f5170597dbe39af32590e981a1ffb5970438c6bf258326ff664e4f2c8536a090dd008
MD5 SHA1 SHA512

Submit Download

fpsboost.exe

Path C:\Users\Admin\Desktop\Gosth Fivem by criaxd\fpsboost.exe
Size 2.7MB
SHA256 d81663a79e0c0735ad82497468c51162704b8ebde59e1dd34d5c2a4dd0b29bb4
MD5 0830361afd40d1f5cd8853b3c8750a2f
SHA1 139d96f05e5947ca7bfed7e2cfd9bc3b79f5bc51
SHA512 470c37d1e15ced481bb20d19843d07816bc109099dcb83dface085f47a482c6aa4d6b60ed81efde849be4a1e8376d6b79a20d81a5a506ecc97a8bf82047789fe
SSDEEP 49152:RINXFBxvCSFjJ0FKF1RkdPM77sT8+HE2a69AJRGFge0haaplvP:CK9FUkJFAJYQplvP
TLSH
T123D5BF43A29506D8CA66C578C54B5767E3717C0803309ADB6BD42F9A6FA77E03A3F390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gosth Fivem by criaxd.rar.crdownload

Path C:\Users\Admin\Downloads\Gosth Fivem by criaxd.rar.crdownload
Size 1.5MB
SHA256 78b268ca8a06b0b8bbc1a1e99584f6687d274e8fba5cdf2a4c3d1b91bb82462f
MD5 e342b86cb34ad70c09eb7ac20d587cc6
SHA1 9f4b946e4829a074baad1518de61d5f1611827e4
SHA512 dfcc75a4e96bbfa28245766d839b73d3fefb75b0e670aff5f876d313d05d5279e184397dfcd3191d6fdcfc1573342c9adcab6a47d4675006a37933223916b9ec
SSDEEP 24576:DmMTf8mTdVNmopSypLKhJlQ4cCcYX6mVHth5EDx1r1YuObNj4x/sr/seC6cAFWoM:DmbmrNPgAKhJJtKuhaDrr1NQj4cx7S0+
TLSH
T16B65331D4221CB4E46F80FE4BB96B94621D5C673E48C0C673946DECBDD0AAE0DAC9EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winrar-x64-722.exe.crdownload

Path C:\Users\Admin\Downloads\winrar-x64-722.exe.crdownload
Size 3.6MB
SHA256 bbc088fc6e1b99042567144cd6601901d955703d8062e299bdb91ea7f869436c
MD5 a03af0edbd39e51377977a17184b0960
SHA1 35039beb903ed4d8b45d89d2165bea330d78a08f
SHA512 b064aebe7e9c3362d7509ed735fa5e045ee78957caecfe65d01442ffd256fb064f6f8ca11d7ef4cc773d79a31542511d1a7b038bdd44f328b2b113bec7d6d1d2
SSDEEP 98304:x4BA9vcjkuKA1ukzK5P/HVPpu1l700HzTEt:ftuKA1uk25nHVPE3oEct
TLSH
T12906232DE3D154F8E27BE634C8A28607E6B23C9E5760D2CF23E5169A1F376904E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-1608-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1618-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1612-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1607-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1613-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1614-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1615-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1606-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1616-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5232-1617-0x000001CDF25C0000-0x000001CDF25C1000-memory.dmp

Download

memory/5888-1589-0x0000000008580000-0x00000000085AA000-memory.dmp

Download