hxxps://gofile[.]io/d/AS6A1T

Resubmissions

07/08/2026, 02:38

260807-c4txwseq216

07/08/2026, 02:34

260807-c2lhqsyzgs6

Analysis

user interaction
yes
max time kernel
344s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/AS6A1T
Sample260807-c4txwseq21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	api.gofile.io
29	api.gofile.io
30	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305439129008888"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{8864B56B-7CAE-4E06-A175-D344C00E034D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004fe594f939e3dc016d184b4442e3dc015cbd97131626dd0114000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2356	7zFM.exe
5728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5648	7zG.exe
Token: 35	5648	7zG.exe
Token: SeSecurityPrivilege	5648	7zG.exe
Token: SeSecurityPrivilege	5648	7zG.exe
Token: SeRestorePrivilege	2356	7zFM.exe
Token: 35	2356	7zFM.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
5648	7zG.exe
2356	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
5448	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
5580	OpenWith.exe
4224	OpenWith.exe
5728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4844	4916	msedge.exe	85
PID 4916 wrote to memory of 1728	4916	msedge.exe	86
PID 4916 wrote to memory of 1120	4916	msedge.exe	87
PID 4916 wrote to memory of 1120	4916	msedge.exe	87
PID 4916 wrote to memory of 1120	4916	msedge.exe	87
PID 4916 wrote to memory of 5096	4916	msedge.exe	88
PID 4916 wrote to memory of 5096	4916	msedge.exe	88
PID 4916 wrote to memory of 4912	4916	msedge.exe	89
PID 4916 wrote to memory of 4912	4916	msedge.exe	89
PID 4916 wrote to memory of 4912	4916	msedge.exe	89
PID 4916 wrote to memory of 4652	4916	msedge.exe	90
PID 4916 wrote to memory of 4652	4916	msedge.exe	90
PID 4916 wrote to memory of 4652	4916	msedge.exe	90
PID 4916 wrote to memory of 3232	4916	msedge.exe	93
PID 4916 wrote to memory of 3232	4916	msedge.exe	93
PID 4916 wrote to memory of 3232	4916	msedge.exe	93
PID 4916 wrote to memory of 2424	4916	msedge.exe	92
PID 4916 wrote to memory of 2424	4916	msedge.exe	92
PID 4916 wrote to memory of 2424	4916	msedge.exe	92
PID 4916 wrote to memory of 1768	4916	msedge.exe	97
PID 4916 wrote to memory of 1768	4916	msedge.exe	97
PID 4916 wrote to memory of 1768	4916	msedge.exe	97
PID 4916 wrote to memory of 2356	4916	msedge.exe	99
PID 4916 wrote to memory of 2356	4916	msedge.exe	99
PID 4916 wrote to memory of 3352	4916	msedge.exe	98
PID 4916 wrote to memory of 3352	4916	msedge.exe	98
PID 4916 wrote to memory of 4356	4916	msedge.exe	100
PID 4916 wrote to memory of 4356	4916	msedge.exe	100
PID 4916 wrote to memory of 4356	4916	msedge.exe	100
PID 4916 wrote to memory of 1544	4916	msedge.exe	102
PID 4916 wrote to memory of 5152	4916	msedge.exe	116
PID 4916 wrote to memory of 5152	4916	msedge.exe	116
PID 4916 wrote to memory of 5152	4916	msedge.exe	116
PID 4916 wrote to memory of 5224	4916	msedge.exe	117
PID 4916 wrote to memory of 5224	4916	msedge.exe	117
PID 4916 wrote to memory of 5232	4916	msedge.exe	118
PID 4916 wrote to memory of 5232	4916	msedge.exe	118
PID 4916 wrote to memory of 5232	4916	msedge.exe	118
PID 4916 wrote to memory of 5368	4916	msedge.exe	119
PID 4916 wrote to memory of 5496	4916	msedge.exe	122
PID 4916 wrote to memory of 5504	4916	msedge.exe	123
PID 4916 wrote to memory of 5512	4916	msedge.exe	124
PID 4916 wrote to memory of 5776	4916	msedge.exe	135
PID 4916 wrote to memory of 5776	4916	msedge.exe	135
PID 4916 wrote to memory of 1488	4916	msedge.exe	139
PID 4916 wrote to memory of 1488	4916	msedge.exe	139
PID 4916 wrote to memory of 1488	4916	msedge.exe	139
PID 4916 wrote to memory of 5476	4916	msedge.exe	140
PID 4916 wrote to memory of 5476	4916	msedge.exe	140
PID 4916 wrote to memory of 1716	4916	msedge.exe	141
PID 4916 wrote to memory of 1716	4916	msedge.exe	141
PID 4916 wrote to memory of 1716	4916	msedge.exe	141
PID 4916 wrote to memory of 6032	4916	msedge.exe	142
PID 4916 wrote to memory of 6032	4916	msedge.exe	142
PID 4916 wrote to memory of 6032	4916	msedge.exe	142
PID 4916 wrote to memory of 4912	4916	msedge.exe	143
PID 4916 wrote to memory of 4912	4916	msedge.exe	143
PID 4916 wrote to memory of 4912	4916	msedge.exe	143
PID 4916 wrote to memory of 5728	4916	msedge.exe	144
PID 4916 wrote to memory of 1232	4916	msedge.exe	146
PID 4916 wrote to memory of 6132	4916	msedge.exe	153
PID 4916 wrote to memory of 6132	4916	msedge.exe	153
PID 4916 wrote to memory of 3112	4916	msedge.exe	154
PID 4916 wrote to memory of 3112	4916	msedge.exe	154

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/AS6A1T
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a0
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15494458121952788706,13966102843227415846,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,11673798800483682489,14938740307083516081,262144 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,10596325100593847913,4760707706985662407,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,9068210831676974654,1161585613966357485,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13629585309580192782,11380435953844635151,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,1503754151806915015,13918887986068479663,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,17898552831799111147,11980512624203986287,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5140,i,11222047074381317888,1253565955334285265,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,13945333298675238131,10121464595301859387,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12244141324675101968,10921292440027164948,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,3439840466535155420,13856615624396331654,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7606449531541994487,3347248449375966742,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7606449531541994487,3347248449375966742,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3644,i,4006026594918158509,13814326673730236547,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,12419008696750608855,4692757803858508508,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6392,i,18170364680482625099,10378433064432619744,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,1335201405774369918,17870887628635746513,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,15898630937903510974,11349270132494851753,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,8905073576623905773,7908519836544630292,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,10916489256959823672,3443734362452452149,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,10736862212957554464,8428847861841540635,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4908,i,4083701989038705195,12751399511304169754,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,2115020494978612259,3586159624381965665,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7228,i,8766465476280939940,13372818053722113926,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7384,i,14527508387167117259,16086856938659465798,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6592,i,9922987138662788076,1894914426699492956,2097152 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,707024627823407309,7932549317795738143,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7680,i,211588131537888968,6057044584190458043,262144 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6346045421873778478,5075724551665154481,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,17884958593520069318,12429360537808851125,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,17377831604819490475,5646598850698673211,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,11301509737575744659,13185601465287841423,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,5157450655743570606,13907898857960144573,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1356,i,9135811488792202585,16631380100704880198,524288 --field-trial-handle=2292,i,10247571522077711893,14013239620245683407,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\TheForstFixOnly\" -spe -an -ai#7zMap26215:92:7zEvent32514
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5648

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\TheForstFixOnly.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d742e9c97e0f08fe852c31accdd4e6d9d573ac0bd8314467d2249a6fed21a46c
MD5 473823eb417fc498fbb889aa6a4b80a0
SHA1 e8c6b3327d5f943c3f5a663fe4d0913c5ec5de06
SHA512 ef4739788f3bc638b72eb5c68dd8fdbad5a89d96748be5c1db466a6c4f552612cdd9fa215f47d1b8f8e830fc464a8db21f14f105de2ef9f1af90b8877a0c12b2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d6bdd50456eb80e2f02551910f93de86540029f8f9060844983691614f61ab52
MD5 5e3f30f090554b59d596cce7aa1153b9
SHA1 f6aa942740933d765cce2ef22241eadd5b74c5c2
SHA512 accc1781a75df608d446940d6d8fe545444371799ce80fb67ac9d606e63a49f837e34f2a818319d408fec5a5a34d2342c227332f79991adde8fb0aef0a76f690
TLSH
T182E0680442D0E1B845039EB3B008C30481D3B21BAF4DFA59B300B18E2052E32C982AE0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 4966aad63945796b876595d73e3c052d1a27dceb2d0f51a8445dff8b0c383964
MD5 d9b4ebf3db4551b67f60a03b71e8cc56
SHA1 4ca546e87ab6a483742ed3937f911eb1cad57eb4
SHA512 5195a78fce4f90e29d22398f4c9c1cc1e848890d06e9b780c474920cedfbe8903c8b349a5fb04f6da221d54d103f92110d5ebe11b39a05e5f97f44c443435b5a
SSDEEP 192:ucfnKt3ZOnGGeDHcJiGG9uwyRUYkjP2iUdI7ZpBUsWQilaufJvXY:LvefsVVwXYDsd41o
TLSH
T1EFE1B813825D6042FB496634C9C91B22B5B3A8FAD44B6F260348AD7F61337F1D3AD66C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8f4ce2b554f0c8ce630e983b85fb82f037697aebfe669a205a6d386043d8fca9
MD5 05ba8b09103fa7530a4ffa726b82691a
SHA1 c922f3bc6a0327bf1050107d86adfc3af79069d2
SHA512 54097c724d2f65ccecf9d249d8c13fdc4e8ef482cdb171d4bedf16adcef257b8b85734f615a3c185e83899b592481014ca5996cbe1d2938f7dd951f03e8c49b4
TLSH
T1BA817E06826DA053D7591731C8CC0B02B1B376FDA90BBF1A0648E97F6137BA1D7A926C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e71c7d8a4725d431656403c4ecd227f2d403ede2b1a9cd2af46f1a8a5221c603
MD5 4e4a14d705936242ef37c1898d293fb2
SHA1 91548d844c907eb1c16c4c2bc65f86212fba053d
SHA512 111174e37b8b0d4663c5e9c535021ac373e7a514161a27d5dba919919b1948701ca2eb9ebdf0e4efb19169dcb164c996c4331984315f84b8afe7b1ddffc1b2c1
TLSH
T13A41BDF7C3E8956D8D2296F4AE14AE1BCE1C0416832C7D398AD4AE17A3E3831E10574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ad1029951404298e0db883c1aa53fe460e129a57c8127dbb95b29a1f63406b53
MD5 e0dfac1bb35b03adda580147884c8e9a
SHA1 a88eed2c8fd9af5fb5e7699b43ce1ad6ec6cbd9d
SHA512 132d03b696f2c2a9075787d46e14f3e4ab459409d7f0328d5b748480214d8ba2145b1d4e2fdee73b28c2f86e0f2d0908f9ed0434152bb3da3e248885d583d7d8
SSDEEP 192:DDMV0t6m03T4JiZn/1PhqxMqQykzKElU2CnmhVbsEapBmV5t6T1bS/tUx:DDMV0t6m03T4JiZn/1PhqxMqQykzKEl2
TLSH
T16022AEF6C3E4862DCC1163F55F287E1BCE19082553683D2A89D8EE87A3E2472E25164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dea977c1abe49e5f657b7be97db91c37d012823f718c8e59ccbbd19d554a04de
MD5 6731b1a3b34ffc760162171c167ed872
SHA1 1aeacbb6da7f65d1d378b97b6c9d835a72a3133a
SHA512 6e7233c24c5bf8eb65d4501caa3156fbcce9586334e56155abe5065d69724e93809799911e0bb96a5440347574d94d8a8babe568b8cdffdd731978135efc434a
SSDEEP 192:sxZzRJyM/jK1Ml8MkT/fGsdAyTIdpjlPHW6+WNewG/YwoWJ+fIgrJ:sxZz7MT/fGsdAyMZHbU/D89
TLSH
T12A522B016A34A977CDDBD209FA41BF53D6F9457292940E44AAFCDA0C04E6FED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 bd7bab11ee4c3b27908e931a4ebc567f8f76f6003bf8ead3c435b115b0ff8677
MD5 1e20df94f597add20b0c753267bb24bd
SHA1 1481039c341b4d56a3976f1f879eb9be1d27da9b
SHA512 b87846c4fd1a20fdf3c453c7ce63d98461772deccb9d075c1a150fbbade3c5f4e841e6e4775243358a76ed6f09eef3e2a9e0917f6cd67b4bbefa7e8d0a0245d0
SSDEEP 192:sxZQQUnERJyM/jK1Ml8UQE9T/fGskAbPtsgrbj8AddpOSIlNzHW6+WNburGDSjHW:sxZWnE7qiT/fGskAbJ7JwHbbvqnXW8K
TLSH
T12E82F8826924297BDEE7D219F901BB53D6F94022D5850E98E6FCDA1C04E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5bd8a9be1901d31540bddc1695f2f969b7ddc4f3e26cadcd5d241d0b2b19c333
MD5 46898b5b4c7c98b7cac4f93180a06f9a
SHA1 2a001e2edee3badab1a03733ae07a065f8d36228
SHA512 6ecc4bcf1584cc1719bac7bc7416686c49c91cbd0d5180ecf87246ee330266a2638982aa3b395de94b876529e54797d25edb64799ada2e73e2b6ad2b39e07841
SSDEEP 192:sxZzRJyM/jK1Ml8M9T/fGskAbTIdpjlPHW6+WNeGDXYwbUJ+fIg5RJ:sxZz71T/fGskAbMZHb7XO8B
TLSH
T1E15209416A34697BCDDBD608FA41BF53D6F5457292840E48AAFCDA0C05E6FED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ffa8e109e414a8705640778651c986cdddf59facf6ee23bca23f26ee62dca5d3
MD5 29b5ceec3ba81842d84d28f8d23eb3f2
SHA1 80ad9939f223a4902ec265fef3d088be46f22e72
SHA512 6d73365366a277955eaaf7e8525f0cb226088f0782d3ca6d6ba19d1b56f79893ef8a9b549db773c6192caec12e487bb8a1320bb54bfe812422b2c25d0d20d96e
SSDEEP 192:sxZQQUnERJyM/jK1Ml8M9T/fGskAbPt9Gbj88UddpOSMlNzHW6+WNburGDSjH05t:sxZWnE71T/fGskAbkOkHbbvqx/m98K
TLSH
T1EA82F7526934297BCEE7D219F901BB53D6F94022D5850E98EAFCDA1C04E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 221d16ac8fbc9808b603b7c149d59f454667757033996fde5706813a32860989
MD5 c4e1cd47adbe8ef671534c50d4b5ffc2
SHA1 ad38633e8e7235528ca2d8ed24fb4ceff39e0828
SHA512 424d1b0919ae0fa814ee97fa90f1b889bf8268b7e962b8b153f956763f5bc30153e029dc7e23a19cf1003b6c39be0c5fbc91745fea9fae860a3f0a703c04ecd8
SSDEEP 192:sxZQQUngRJyM/jK1Ml8M9T/fGskAbPm9Gbj88Uddp4MlNzHW6+WNburGDSjH052+:sxZWng71T/fGskAbLO1Hbbvqx/m+8B
TLSH
T12772F7426534297BCEEBD219F901BF53E6F8416295850E58AAFCDA0C04E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a50294b230d6f4cea914c96c72c0d18f03631fd792a267c0fd50ac80e518e2bd
MD5 4272604ea90b5e0b816546cd433c6dc9
SHA1 ed8ee26d9aead8aeab01108a42b6da18bd1f0ee2
SHA512 97fe1f48159968c7bcad41b00dd1c2d0ef888135dc575a6e767ec6e283b4392adcdd5190ba8b38b76bb970a5f133f3bc75f8af8626e41e59583610bea4c2d55f
SSDEEP 192:sxZQQUnIRJyM/jK1Ml8UQE9T/fGskAbPtsgrbj8AdYgpOSIlNzHW6+WNburGDSj7:sxZWnI7qiT/fGskAbJ7WQwHbbvqrT78K
TLSH
T1E282F8426924297BDDE7D219F901BF53D6F9406296850E98DAFCDA1C04E2BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6ddbcc95b644361210fbcdc30fcd8d7c66885216b26a86430f18effb6765a4ab
MD5 4c94630f39c037bbc5b3563c13041229
SHA1 10df19a05575b842110bbe782d2c407c3ebf8da9
SHA512 0f52b559f6621466c21b543903d30b3a85d002443574b59a8c53fbcda625f6813dbec909f4f48ba1244afeb15728a5e7fbf4e1b154570442077ce2fc56136c0d
SSDEEP 192:sxZQQUnNRJyM/jK1Ml8UQE9T/fGskAbPtsgrbj8AdYgpOSIlNzHW6+WNburGDSjw:sxZWnN7qiT/fGskAbJ7WQwHbbvqwn58K
TLSH
T17D82F8826924297BDDE7D219F902BB53D6F94022D6850E94DAFCDA1C04E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fec280a459b1df8046e5b163b209e60144f15b1fbc46c71fc3199f633494cf6d
MD5 6f35f77c15005e5c64a08034e923f14a
SHA1 4dd11e7c43133e48acdb5dd8471a9723c6ba1169
SHA512 1c8c1176e20b8fb377541a487d2be8d443d7bfa16b4c7d2263f6c02b3e6d76857c8e29cbb2e324a9e3a31134f9b39c2c50110c2e1b8e429547f8f30e75b6c6bf
SSDEEP 192:sxZQQUnFRJyM/jK1Ml8UQE9T/fGskAbPtsgrbj8AdYKXLpOSIlNzHW6+WNburGD9:sxZWnF7qiT/fGskAbJ7WwwHbbvqmNr8K
TLSH
T17082F8826924297BDEE7D219F901BB53D6F94022D6850E94D6FCDA1C04E2BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a8ee9b66583dd768b1e7c421edd68a5b656d99be02a51b86defb94c7759d575b
MD5 7c38cdbe79509ec7b52c14df820af751
SHA1 8f822c6045cb2d9a49d92abca9cdcb706d352f4f
SHA512 e0c819ca0d6515f879071f9dc1509913347df4543f99709ce76795fb146a46f0efc3c16c6230d66bcabb422de6c91bbe027f3d42fba60c88673b6caa576b791e
SSDEEP 768:VG4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dCroh6zc3aD:VG4jeXmWvmKLEu1jacPLZQdZ0Ik
TLSH
T109D20A3B244CCF7E4F844E5CEC26AE976ED802CB5A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 816B
SHA256 966522e2a3b617bc0871f2885dc260255c70dcf427ab122bfa0398b7ff2f9840
MD5 d9017b8334901cebbba7407d26588561
SHA1 045ca2cd5e472ec824cc4e8f32f061ed8248c1f7
SHA512 4d8e5449316d7a9ec7be4033cf08af5748f8fd40a6f1cacb60a42d47b213d44ca96b31eded69e817e44954b96017ab2c0be3481a6dd99d6854d7fa8b6aa9ecb2
TLSH
T12D0141165EA65D1FE85402BB15BAB4F8B3304DCCC721E223A82C01732D2A34925571CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 6aaa4c2058a696c51f5f45d18a586a5b95fe641bcecd44bde077cf6451c4c974
MD5 34e3f03acdc8ca3d7c276fbc06b2f527
SHA1 6ecfacee6da02be03d1cc17516ebda7b130ef6f1
SHA512 5a8e7cb30e33216d3a7a2943f5c244d15a0221c75494e679c2ce129437ad4f0132ac97baba2cfa7cf5e6dac4e5264505b8e25644ae1c842b3368aacf07aeb687
TLSH
T1DB51C98ECC864A5AED9C11B318FA1490737628DD96C85F0BAEDCA434BCC323E2D67564
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ecd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe59ecd7.TMP
Size 816B
SHA256 c83f8a278af214072701b7e3f96a2dad26dc584025b996e20b30b0675d68fa73
MD5 62a14d32879fe58a6085c1262a8ee6d4
SHA1 c6252c84fa64ce9cfe4ccb98f8d74c13d32f39b8
SHA512 830089ca578a6874df2ea6919681fb3d42f9693bd8ba17500ab856ef06957b20ce0436dc668ce91843d573dcba7734586b919464034d2d4561af17c9e1de0868
TLSH
T12C01E1578BD24D1FD44411BF1DA9A0F8F3314C008326F3A3A42D253A5C767C91A070C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39f7c431-8139-4e2d-9c3e-06edb1691683\index-dir\the-real-index
Size 72B
SHA256 451b0be6651de990b35b7d423f19072515a6f57648fadf19e17a998a9f077fa8
MD5 6262b0842ee007405e04b97b2cf6baf3
SHA1 b1c3447db7c53fce2e06505433fd33b75d7c70aa
SHA512 c55f38939c054162f42f17c5724528c7c196a08a7c14a45e366e2bb03f07e35cb01dc3c3c44580e148c06589eab6bb25caa2cbd55c50e37220f9f1ea40000b71
TLSH
T1A7A0021B314903B5C1080374245263C13E5398937A032301D1941194DF901AC914F18C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a89e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39f7c431-8139-4e2d-9c3e-06edb1691683\index-dir\the-real-index~RFe5a89e2.TMP
Size 48B
SHA256 e8c7525a6e23257c789b99f65edaacb66955658938d54b4b8b6174e0b87fc987
MD5 36b2d8fe794f15681c6407f729ed1fdd
SHA1 dc8715be6fe1d69effb09800350137bf3f30517f
SHA512 2212469d8af34ec1f0c118720e72fbf7c27ba17cdf8242a8c3483b73639dfe7dff104a29c09cde4c774eadb7cca21d161022de3b33ce8d0cf554e149fba55723
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3c00c727-a42d-4dda-8781-27462a00dc28\index-dir\the-real-index
Size 72B
SHA256 2b94b53ed76a613101d05ab2d5de88217d0df96f067ed23c811eb2395190752d
MD5 07d27ad7cb1d0737d9a32d6c45df3561
SHA1 81c5623ec9adf6cad440be33bd1ca92b7f4dfd6d
SHA512 297a0e157e7dbf0aa85e9f1c968016dc8bbc4fb67fe0ba3936939237bf65a22c4b7fc83884bea69cb9e626e763eaac023d3abaee253ce8edc3b44155b472bc3b
TLSH
T1CFA0027311A80049C5014AB4914302546317DD3D8541C309909188D59D535E84F21089
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 dffb56ac7f89f8fe2049f64bf03141f378a194fcdc7a9709e9624d1e2c841640
MD5 d465d4ff3ad87346cf1114e649f0024c
SHA1 d92c91f6d2eca5135611033cd2272561cfb5c0d7
SHA512 6d50563c4c50b62c2183c5c50ba2c2bb4979249d59122d85908375fe8769fbaf6e5cdf69be72ac2c89d404d75b7e9148a30c0a85601b03772aa110896c15b409
TLSH
T1E8A00252CB800045D01751B5195323411310CCA01204131B81D200AACD514504E4540C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 942f5a93ca0fe0380b70fe8a732e5a4c76b36b56d6e987314b0253539afb0bb9
MD5 3b29c39f1eb29773d48cdd9a53b5438d
SHA1 d72a6ecd0e4efe4910f12b3e4eeead3ddd02e9a9
SHA512 d2f34c90f321b418a681625208f0777c3f848dbef4f9665685ac4eaf07dda85d9d938f3f1331b268b2259cf8bcb1a99e4b551c20a9cb59a03425425bbce6604c
TLSH
T1B7A0021503813002C00217B2A9D71566225089D042411B2991AC404CDCD0B574581A8D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 8a525ad353d74d126fbc63fd8d75170dd4f51c4f090f6da79d4344b299d58400
MD5 3ed0c2a42d09fb3dd4586ca507b357be
SHA1 3b04f21a1cc2976a75011628a2db24e9619b3eba
SHA512 3d05994815634dbfa0ccbdb4f8871f7b8210a3d0b5782ba90906221fa77e9991d121c244897715eefee3414b66db291d57f075d11c41c94f2033ed077383cee3
TLSH
T103F027F23EE72D18FCAF93D628B244A40609B4288865EC4F2416B3EBA1B1218106AC71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 0bc0bad40b6e7b8f957ea7895354b5ee2736d3f45b4e7b9f2571bf68b7ea22fe
MD5 33cd980bc76a800f152cc07bc5865c1d
SHA1 d09f9c901c8f780c7fc0b0b8c29f19770cdca93b
SHA512 78c3736f8b728410f3fce2c287d2d015be0ffeb426778c751f92b74f46265c79339701b0418fba760949d361af1e603653d76fd6dd6fa869f8abe31acb6de9fc
TLSH
T184F027F23EE72D18FCAF92D628B245A40509BC288866EC4F2416B3EBD1B1318106EC71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f96cc68e7786020a7ee9e32e9018846d93322bc2304e1d4a6f5beeff45c29b61
MD5 8e258caa4906b2274f5f353b2abd27b5
SHA1 3501e20a973abfd8e38ab734e65d29b4cf6075cc
SHA512 32852f17110ce2a3e9db07344495f8a885f9cffa8465d596d3cba2d002526245c2973372c0be29da61e541b84f6ed1f8b4d4eaa88a6de2632243150cdc6a4a3e
TLSH
T1F6B024714D1D50C5CC010330DCC1004C31110C5143071170007DF1F44405304D1C3105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a5d35.TMP
Size 48B
SHA256 6d4b990c345d4fae0ae97910ce6229928e3f096ce5f60c56589db0d5096fa001
MD5 0afcc857f5ce926eef9940bf694e07ed
SHA1 477fbe2f243ea99f76e1f88c42a8c329e964631e
SHA512 f94cde4c7c6140c509fc564e61f954b6b3c9c8e9d592e24e90fe13c8f51dddbc0ac225e179f2c0cb37e9f85e01b4d66b2a34516663bdc2722948cb99d8378bb5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 898088767d620b59a88a08330980f6a93cb5da954d2677fa714ae30754202c71
MD5 38c7803526b056375c8d39355448ad3d
SHA1 2ccac741c757014da32cbac6e80a6277e7d64072
SHA512 412ecc61cb61c3944560e49cbad16933be0687ab6b0b34c4c149c020022e95c7b31887541cf0163fc112ac94207cd31af9f35604729b3ef44030a383a4dd180c
SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjy+:K4TINKEkY7yFTI1KQE44LI1KQk4vyJc
TLSH
T10C913D4631BF02253D7F291C939496668A4277A33518F82F7BAC00B61E6BE250CBDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b6c7c81-6460-4176-aaba-dc35ab78910b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1b6c7c81-6460-4176-aaba-dc35ab78910b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ee8f22d5031ff5f50b45ebce30a66ed75bddcdcf6a6243cf7cb55aa4fcf35f1d
MD5 79fe2763b69fbc1326a234b5ea441322
SHA1 d2cea37d0eec03e24c33641ccff87ba6f1bfccf1
SHA512 06172977c8ad6e05cdb989aae6228c255b53487b9acfce91d74591298510762d3303dd16c488e3ec38d8d6f6ff1e27d843f62854e770a01d1f5607bc1ee41b86
SSDEEP 384:IZcIhsNQUUbnH9Ygf+uOdKc+2VFVf5UrzpKDS:2hz+IjOAclPVSp5
TLSH
T12F928E711C78AC365AE2E644F44736078FF89137E2D63BD8E5EC7B2D049A6AC2707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d8230bfecd74309b0a750c925934953b78c93f13163df777094d5ad5f9c601ce
MD5 7bd9b0dc0bf112ec790d757092a60372
SHA1 7638bac73ea1bdeb243eb466ee05df0955570dad
SHA512 2a1bbaa1fc6ffa23ac56efc916f662305a3d986c8e730c9a52908e03f3c6504b364af185ed9e95a07b015ec46857e6a432389b976bd357dd3136defac3267d55
SSDEEP 384:riFPZcI+usNx8TUNTUlIlxbnHavgf+uOdKc+2gFVf5UrzpKDS:GFH/Iwg7AIjOAclOVSp5
TLSH
T11CD23BF208D79836DAAD9B43A77E2E024EBCC163B5856694B3DC6A1CCC461BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 382b1a3d7597322f726526367a1853c3e6aed2d2aa51feb958770fccb4848755
MD5 b674706c322381e838df10c4f8544831
SHA1 39533db6be86fd6e4f67607669832c5db7b1c6df
SHA512 c12701b3544c3f254c320d79e0ed7923918342412b0502003c672f63ebb849291a11e14f52972010c2e18552be7f8cc5047ee9f1130dc11175365c8a1e1ce924
SSDEEP 384:riFUZcI+ksNi8TUNTUlIlxbnHavgf+uOdKc+2gFVf5UrzpKDS:GFSVZwg7AIjOAclOVSp5
TLSH
T1B3D23BF108D79836DAAD9B43A77E2E034EFCC163B5856694B3D86A1CCC461BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 609df693c942a65dfb508c72dd73ea6ce445510987ff3451fc506a2cddef4372
MD5 8ef32a059fc3abc024e82c88bd7c230a
SHA1 0256dbd67db8b9ca828bf7e88dfc5d6aa5fb8120
SHA512 94550f113b766d72b8f58d68379ad601cbb9a0f76191261d1ee712b7729e97822b4cca3116d64de15c0c41d06f5a5fc7470b4e76af38ee6549ee21e67413d184
SSDEEP 384:riF5ZcI+usNx8TUNTUlIlxbnHvvgf+uOdKc+2EFVf5UrzpKDS:GFR/Iwg7nIjOAcliVSp5
TLSH
T15ED23BF208D79836DAAD9B43A77E2E024EBCC163B5856694B3DC6A1CCC461BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5c9d93ab2f482184cea3f95d513131ef68f84c3f3c90dbc2f6065507c3c65210
MD5 00602d99f12817528f7ba6136dfee386
SHA1 0ae9e2d41b71130ebd1c5985e8eea1235bdacfe6
SHA512 55ba262f4f3a654afd6c86bc947b1ba69308297e8dc1a15886fa1b8e520cd1ae620a791bd6e1a0cbb649e798e4cdfc78dd48d0416d9048a642fa66997bd40a44
SSDEEP 384:zZcIHsNQUxbnHvYgf+uOdKc+2oFVf5UrzpKDS:rH8AIjOAclWVSp5
TLSH
T138927E711C78AC365AE2E544F44737078FF49167E2C63BD8E5EC7B2D008A69C270781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 12b73afbb3e9f4e2362c8f025bb3150438635734bd994f406e87f2d596576b45
MD5 2dedb86a6e32ea86da7c92943ba65a58
SHA1 a34c69d98323936dc167457973c0dbe952ccc8e5
SHA512 f6d3fbbc99903d2f33b8cfca1765a8cba8b45dfd19ef3d027cee72a51da9d43b971782b5648575f47145ae50138cf322a565f302d32c68d86f6fdb364a801360
SSDEEP 384:1ZcIUsNQUxbnHvYgf+uOdKc+2oFVf5UrzpKDS:NU8AIjOAclWVSp5
TLSH
T104927E711C78AC365AE2E544F44737178FF49167E6C63BD8E6EC7B2D008A69C270781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46ec8e592556b256252e2e36920f156113617e04172878e7b99bd1bd3b674f7a
MD5 ee858441f0a88ae68663abb46cfd192b
SHA1 6ac49a04a03716f5d5d0e496b8f257d8f41980b2
SHA512 37327fd92c068e47a7ab0e8afe1053a41d8c16603f4c369b8e91a241d92e0e90fb405514f134a6863315a06c01271c801e21cf9cb7d5240d83407be5c593e6d7
SSDEEP 192:AONq6hZKQmiUyHAAc/+jVQO1LKc+2BI5cOqYq3U6:AONq6atAu+uOdKc+259VU6
TLSH
T1D812FA366868AC274EE1A551F48736138FE55227EA86BFC4D5DC2F1C04DBA6C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b7f1e7fd951788e7588b1f2a6ca85e244ca8719ad8d07aa3bcef535d1aa3bc54
MD5 bd25a8f034284fc8b2d9bc2b1d72b9fe
SHA1 081ffff6a483040a187d3069683eafcd82e89ed0
SHA512 83f1cb109db980ec1bc342874827e601f8ab0af1e5d88cba78cc040c87e58555c2229589cf2e5355ae3d2021244a0379a2ed01b462e73047e78d336f98b07c39
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aebd4517f212a8cf746075d048e01d5ef6c7f87f01bc80fa6ddf5495b6a98a85
MD5 d64226a5ccfefdd81200ea8b2fe627ad
SHA1 f9c6d1191712250f4035cda49eea8b00400e1af9
SHA512 c9b57df5794d34ef33f3dadbe456bcd797a1f6f727ce5c9b18a1b3f556c49b292cd490748faa931eb959dc99b2493f10bff8805b1694de6ef02fcc18ae71b15b
TLSH
T152E00253D30804FDD03D033100935D3429D34030017100044D3116593E237502B20FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a1510.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1510.TMP
Size 392B
SHA256 efb83f92a8afffa7720654edc8acbce6d1a0bc2bb865d74e5cb685868a412311
MD5 7b4de376468374f947774f7d1bf72569
SHA1 f842e3555196e6192b73eed5a0760bd8ab7badd5
SHA512 468774028e0fa5b95a2d98ff0fc4770d17758570f1bddd9257da06c108c352cc4abfe43f935d30f254f9e0b865dae3bf5724883f47d699b9cb29e88f2ae9e042
MD5 SHA1 SHA512

Submit Download

eeb156ad-396c-4132-8664-911edc985900.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eeb156ad-396c-4132-8664-911edc985900.tmp
Size 8KB
SHA256 4872e4f6eb4af6835a7c3564975f1e9d79f81716630659b834e5cada74adeda2
MD5 ee01d30b0d43de17e89f00bd1f5d50f6
SHA1 a45b2851cdc2d68bdb0c4628e49d3bb3cebf4d55
SHA512 a93db542e2b7303d66dffd528ee7b0febe2c317b7a3ccb75b0f24166ab3e5b3d1cbea228c46f6f70f991d51de62b669c346e383362e2fe45e90841f012e6024e
SSDEEP 192:EONo6hZ0QmiUyjApc/+jVQO1L75wOZYx1WU6:EONo6ojpu+uOdC20WU6
TLSH
T1EE02E83568686C678EF2AE45F48737239FE5113BE9956F84DAE86B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eea63598-ddeb-42c5-b048-6159aa966b1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eea63598-ddeb-42c5-b048-6159aa966b1e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5cad04667f73bcd453a3c6b61af254e281b889b509ef12aa6b2010836e902adf
MD5 53e88a75a21758afdb85de15b98686bd
SHA1 3ebed04344a6ca8cc5df9b6415346e7412ca4769
SHA512 29ad3ae56597846707d72e1292ad8e6a9cea17c15ef094ab64a00ac83a2d03556fdc224ce30104b625b9aea66b1ac7d2a1c7186f0db99e85243504e2a1f67de2
TLSH
T1B841FD58B7EA1148B3B73E56AFF6A86D487FB9732F06D05D10110D4E0A66B44C861733
MD5 SHA1 SHA512 TLSH

Submit Download

TheForstFixOnly.rar

Path C:\Users\Admin\Downloads\TheForstFixOnly.rar
Size 27.2MB
SHA256 15e961d751a7bfd52c9fdb3c37b7f8bf00c86bd0718425cde0f98e9aa45318b4
MD5 b9e7fca874078e749e13c529a6cb6917
SHA1 eea53d2ad6ffd7825e8031753fb64bac105ccf93
SHA512 ca2e9f953dcaf0481c12c2f38030882efd0e207be2b3ca8544623322dbf8f5ea3e7b5991ff1bd9acffd05a6c471ec5a237ff19b2877fe7544982b98566d7861f
SSDEEP 393216:/X+IcJ6PiLyhz4W0opmlX8lsIX+IcJ6PiLyDz4W0opmlX8lsGz4W0opmlX8lsU:PFI+i+zV0Jh8jFI+i2zV0Jh8PzV0Jh8Z
TLSH
T1285733B0702A7A1FD5DCF6862DC68843E9C7000D3A5D89896834777CADED472A396EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnlineFix.url

Path C:\Users\Admin\Downloads\TheForstFixOnly\TheForestVR_Data\Plugins\OnlineFix.url
Size 46B
SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
MD5 59bf167dc52a52f6e45f418f8c73ffa1
SHA1 fa006950a6a971e89d4a1c23070d458a30463999
SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
MD5 SHA1 SHA512

Submit Download

OnlineFix.ini

Path C:\Users\Admin\Downloads\TheForstFixOnly\TheForest_Data\Plugins\OnlineFix.ini
Size 707B
SHA256 2682a8c8961101e738a1d9d48168aca5c3655a81507cfdf8dc1dd1c10c1bb209
MD5 3ac02527a1a28aab273f6012d2f98478
SHA1 f5d1481d456c84ca465d82c51c8ceac5c6897eab
SHA512 e8af2cd1af660e00ad6c2a1d6defef237282ef2d7a108b046a65899fe55347d33f81ee416c9598a5ab80c1a98b3a9038d4b5212b115d2b879b71d757f795d494
TLSH
T10E01FEC83D6B3679E20299AE7DD3EC539456316B701B0900F0955E8E364BE4A055521D
MD5 SHA1 SHA512 TLSH

Submit Download

steam_api64.dll

Path C:\Users\Admin\Downloads\TheForstFixOnly\TheForest_Data\Plugins\steam_api64.dll
Size 6.2MB
SHA256 848ae5c29bc9723486bb667173f4ccbe3ea2c9d11e13188342539aae68341a6b
MD5 c6d74dafc1f5cded74ef2dc08062a066
SHA1 c848374e15380f4bc5246782b9cdadc059d0b001
SHA512 5a93b191a0cdeed3aa5d72ba6ecc1fe61d5a3ceb904a9f3c47b74e73dadf080100177114c48cf54ddf3fd12bd4442c8d9625067074543f3c3485f29ac9662458
SSDEEP 98304:tAuL3v08TGxgBhLGbxOALr1LuXdJ+evmckt7XPHYkFgwf5IeR:GqfOgnLDkib1mcgbPyO
TLSH
T1705612AE715133ACC02F8838E5336D4BB2B1111FC6D9896976DE9D807F9F910A643F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64_of.dll

Path C:\Users\Admin\Downloads\TheForstFixOnly\TheForest_Data\Plugins\steam_api64_of.dll
Size 206KB
SHA256 c0a90aa701795c5e6d9515f86a2c86fb31441275f1fce244a0518e71ddbad05f
MD5 3a26392c0f0b4fcc85281488d9a448c5
SHA1 2c112bf98aa0379cacdea69ef12cb2d97ae4aaed
SHA512 653f9d31e64c76661c78936d6cffaf0cf10687870f8f692b262db0405d0b0f705f7bdbd97a74355df76dd8c329ba321d95d22e239693f45806defa2b78e8e63d
SSDEEP 3072:Lfo8LGKf4PxTuB9GMbTJf1VhAS1xTtwUfBy6avvy+8p7ZICZNCLGH/IFa7:LbGKA4PGMbTx571xhHfwSntSCrfIM
TLSH
T1E6243A36337408F5E5B7D234C9925A0BF671305B23215EEF2760433A4E6B6D26A3B792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download