hxxps://gofile[.]io/d/KkRps3dX

Analysis

user interaction
yes
max time kernel
298s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/KkRps3dX
Sample260826-e367yayxcw

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	api.gofile.io
24	api.gofile.io
27	api.gofile.io
31	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3812	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321921591514459"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{9D707405-60CD-4A94-9506-71836A5C98A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1752	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe
1752	vlc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1872	4656	msedge.exe	85
PID 4656 wrote to memory of 3812	4656	msedge.exe	86
PID 4656 wrote to memory of 2156	4656	msedge.exe	87
PID 4656 wrote to memory of 2156	4656	msedge.exe	87
PID 4656 wrote to memory of 2156	4656	msedge.exe	87
PID 4656 wrote to memory of 2852	4656	msedge.exe	88
PID 4656 wrote to memory of 2852	4656	msedge.exe	88
PID 4656 wrote to memory of 4764	4656	msedge.exe	89
PID 4656 wrote to memory of 4764	4656	msedge.exe	89
PID 4656 wrote to memory of 4764	4656	msedge.exe	89
PID 4656 wrote to memory of 4860	4656	msedge.exe	90
PID 4656 wrote to memory of 4860	4656	msedge.exe	90
PID 4656 wrote to memory of 4860	4656	msedge.exe	90
PID 4656 wrote to memory of 2172	4656	msedge.exe	91
PID 4656 wrote to memory of 4740	4656	msedge.exe	92
PID 4656 wrote to memory of 2172	4656	msedge.exe	91
PID 4656 wrote to memory of 2172	4656	msedge.exe	91
PID 4656 wrote to memory of 4740	4656	msedge.exe	92
PID 4656 wrote to memory of 4740	4656	msedge.exe	92
PID 4656 wrote to memory of 3248	4656	msedge.exe	97
PID 4656 wrote to memory of 1240	4656	msedge.exe	98
PID 4656 wrote to memory of 3248	4656	msedge.exe	97
PID 4656 wrote to memory of 1240	4656	msedge.exe	98
PID 4656 wrote to memory of 4640	4656	msedge.exe	100
PID 4656 wrote to memory of 4476	4656	msedge.exe	101
PID 4656 wrote to memory of 4476	4656	msedge.exe	101
PID 4656 wrote to memory of 4476	4656	msedge.exe	101
PID 4656 wrote to memory of 2876	4656	msedge.exe	103
PID 4656 wrote to memory of 2876	4656	msedge.exe	103
PID 4656 wrote to memory of 1636	4656	msedge.exe	111
PID 4656 wrote to memory of 1636	4656	msedge.exe	111
PID 4656 wrote to memory of 1636	4656	msedge.exe	111
PID 4656 wrote to memory of 1588	4656	msedge.exe	110
PID 4656 wrote to memory of 1588	4656	msedge.exe	110
PID 4656 wrote to memory of 2608	4656	msedge.exe	113
PID 4656 wrote to memory of 1752	4656	msedge.exe	115
PID 4656 wrote to memory of 5356	4656	msedge.exe	117
PID 4656 wrote to memory of 5492	4656	msedge.exe	118
PID 4656 wrote to memory of 5676	4656	msedge.exe	119
PID 4656 wrote to memory of 5832	4656	msedge.exe	120
PID 4656 wrote to memory of 5832	4656	msedge.exe	120
PID 4656 wrote to memory of 5336	4656	msedge.exe	123
PID 4656 wrote to memory of 5868	4656	msedge.exe	125
PID 4656 wrote to memory of 5868	4656	msedge.exe	125
PID 4656 wrote to memory of 6024	4656	msedge.exe	126
PID 4656 wrote to memory of 6024	4656	msedge.exe	126
PID 4656 wrote to memory of 1704	4656	msedge.exe	127
PID 4656 wrote to memory of 1704	4656	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/KkRps3dX
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbecdfc188,0x7ffbecdfc194,0x7ffbecdfc1a0
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,6585273627388398362,3300188059982684882,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5868421200171954433,803971668512590840,262144 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,12848026389399049113,6485772623986354810,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12295444665269316471,10944026418411256798,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9612419237856694237,14050536820718224787,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4419494573306939744,4560237301213444951,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,12754496788630948947,14254018976246201032,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,3795167739671569405,3163330898583653510,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,14405353055615165077,13221152266198842966,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1920041702267259917,7774631783355927650,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1920041702267259917,7774631783355927650,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6028,i,10441770606078153953,10257223640717553883,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,12092325289540877317,1158468963998344163,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,15823212544433648233,3334987679670631505,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4424,i,9305802262628085302,16388420942570159106,2097152 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,16610633934617701634,12653130562541305052,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\NUDIST TOWN (STRONG NUDITY) HDR.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,16058206752396952997,10393068592426270140,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,17277126398082609552,6925605721515005661,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16380556809917267587,15012957860453874900,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,13339320951364815063,12527659052689462100,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7352,i,15383987624409808370,4009010361040273230,262144 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7574645934088784382,3175136697836991950,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,5463695710342786890,3908645418429972436,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,9219054672310924614,1427892667063393171,524288 --field-trial-handle=2004,i,624246296591393860,17596610349157620982,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
  2⤵
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 1024KB
SHA256 43d748ad4c67a1de36d62fe6c4805ee4dbecd522ea1665565d134d61289088aa
MD5 b4ac879c67e444b115ea5212491e0198
SHA1 93b5f30b34b9df2e579b168f7f598516ad93c68d
SHA512 5d7664b86b5cfe1e74ba790ac0e93fd0987090f8ba66d42806ff0e6876a025e75a28e94cb6ff4faded56ce48f7f1565d8cba6d64323038606fa3bbfc32e705e7
SSDEEP 12288:kftgvTjUxz9hkU3oXuFGJ5jmbw91+jKThwniZii/ofZXg9lYvpvr9xxFKl9vi:kfenCz9zYX05+1+jKTgW/k4mvpDzil1i
TLSH
T11B25DF4ABB368447EF284BB0D9E007587A72D9E41347D30B12D9637ABC07FE46E895E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2bb021467b251aa0dd802a1a7d2b83fd3a5877d4addf539959f7b6568c3da971
MD5 76f37b7f7c078c013726d9d60344b43d
SHA1 ec8e48ed2c7565b0edb9b4248606e2782de99254
SHA512 e012d5e520d14234ddd00b8fe9b74635c9501c1ca0db1ec75ec8a6a6d5f630875fdfc2ff169965e25d59b9a1079f5add972a7aa2626956aab3b42028e30618fd
TLSH
T17D71A2BB410287AFDB2DA2FD64DE71A03C70B4D9F9335D965E5047353917B0242CE688
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 da390398aef03bb8bae2759cd4c7c1a72456f04efe1b96acb1ea8c51fe36626d
MD5 029c6ecd0eb13ae82fed2a84c209974a
SHA1 d32ea9b84d88509b3c61e3d6eefe213a94b1f1c9
SHA512 904685ff7e633f16c45b979738017cf268a1e89e7608e173a317db498f73dbb71d5ac41484165b92794d8c6eb4f7bdb3866692a1b9028bb050bd3eba85c2d59e
SSDEEP 48:HLFpVWSJhllsSHE5kS0f7ALAiP7Jl0lx8CmhVHIa7cjmKC8dkBKwsPq+GSRFfgzi:z1lNdAh7JGFs8DC8cyj3fdS2
TLSH
T1D4A1C7B6801D576BCB1EAAB8A4CDA1617C7CA4E5F8331D964D4007B537077820ADE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 721e73d06d5b5c5ae4a00032953ada26f0165e03e58f40b8c048d210d58e5cc5
MD5 42ab5c191ac01f6de8be2dd312df0e62
SHA1 6805b3bc9d832f52e480f913c7d11bdc464f7802
SHA512 aa1e15169f633b20369dc52124fbec5b025d3123b23d054caaa3aab4371d35668cc4b9308171a819af93af0e634ecf049a2539223303810509b209d713189193
TLSH
T18B41CCF3C3E8956E8D2252F4AE14AE1BCD1D0416832C3D398AD4AE17A3F3832D10564F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1749341a463d3e6f6a086e8926fa01ee3f5f9716792ce7533d05d7969829da2c
MD5 251103fd30bc26d954eee9c895dfbca5
SHA1 ef81b56d39e38b03882aa66c20b4e7de84f35be6
SHA512 09e2cbee06c3e919bcbe1181cbbe06536eae914d60a58c655191153469766be54cfd9316eb45ec3f2b07201f04cb47ec0cabc5b1cc1041923a252d567fd978c4
SSDEEP 192:sxZDRoyM/jK1Ml8MkM/f2sxeRzIdpjl+HW6+WNeiQ/YI6Y7UIgrJ:sxZD2MM/f2s0RsQHbU/S9
TLSH
T1BD42C7116B34A977CCDBD20DFA55BB53D6F91472A2940E48A9FC8A1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f95548d9cb594af7b3bfd0e01e556525f429da7eec1620270ed70239fb04c526
MD5 3a2c19d0b00cc034d1844486d4791526
SHA1 7121808c0db69b9048b3e4c743684f4cc0794b54
SHA512 fd63377690c1bdbfb1f66645d9be86ff0050ad4fd75644767f3189afe53d33e9ad536318767d3917e395f8fef63bf103fe383265b09ee180deaf19165661beb4
SSDEEP 192:sxZDRoyM/jK1Ml8UQd9M/f2sJe8zIdpRl+HW6+WNeqBNYISb7UIg5sJ:sxZD2qHM/f2sc8sCHb1Nzm
TLSH
T1C952E8116A34A977CCDBD20DFA45BF53D6F5147292901E48A9FCCA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d6808b1d681a40f4d99f311d33183028b0b713324c2c10436480494540d410d1
MD5 bc35560680895c87c65543b072d4089e
SHA1 28f72ea763fed71751a279c57829c5e678f14f26
SHA512 4aafccb97b7e5508970d36ad617963f72107102823448354a33a724deaa5964ec93cb47c31da96d319d1169244a268d0793392885b20f05c906969402da9362b
SSDEEP 192:sxZDRoyM/jK1Ml8M9M/f2sJeRzIdpjl+HW6+WNecLdYIgY7UIg5GJ:sxZD21M/f2scRsQHbVdks
TLSH
T1D652D811AB34A977CCDBD209FA45BF53D6F5147292900E48A9FC8A1C04E7AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3cdfd8faa7b9d8b8657caf0cf43caa1d50754c8d76ca25275ccbcdb64487e6d7
MD5 280a70f02dab325cbbab0838b3a38000
SHA1 b57ed4891171b9286f6a5eb237c475466874efd9
SHA512 d4c9ca7089eac3cf47a47588458e9b6721ae9091aa541fe70d4cab7fb93779686c45f820f26a7c7a5d098effc492e5c933c3864cd3d1f90df34ba7d12ebacd9c
SSDEEP 768:8isqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9/ros4S:8isqxXlWvJD6Tu1ja54LAs9ss/
TLSH
T1C0D20B3B694CCB7E4F840E5DEC266FD76ED801CB66988D5447FA884C03CB2EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 46523a5b7546150915a6cc029363fb0fffad0c4b5cc6cc9cab5623fad1cdf5b4
MD5 bbf6831d7445c580ecd53d00d95966ff
SHA1 d93bc50071f437818af3f2abefc7d2b25f8406ac
SHA512 0477bce6f7f866a6757c20e7ce1eed333f4a04eb36eed93b592b4601455baef629a68e16b9d2d97e677233b30a0f6eac31bae29836012a11f77e31ef3801b10d
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmstz:KYbaKYIK6+EKji2qEAKdmez
TLSH
T181912659363A0252383D2858B2AB86375F423A637018E46F3FB950E55F6AF121CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f529.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f529.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35f666d05745b62a3b5870178031383173aa93dc69345d9ecf894248023124ef
MD5 a9ac2809e79f0d7b1008f7d612efe4c9
SHA1 de7f58ab657ff0a63f39d7d9b082c2e839e0c467
SHA512 a4284cc42c22b826a4d27b242a398efa44d6a38ea4b1f508982718ee00e309bb2440494705f8d4b0d14c652416f4f58bc3a5bfe0d78776b8fc1949d41efbc3dc
SSDEEP 192:tONr6JkRtQmiUyPDW+RN0OmheR2h3gR5U6:tONr6UrMW+RN0OKFmU6
TLSH
T14C02F935AD386C7B9EF26E09B98B27175FA4207BE9856F80DAD41F0C01D765C230A876
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3e0eeed4da60df1d89ca5e51b4a955c3f2f755d168c097fb1a8eeecf141d45b9
MD5 24b3aa48e399fee5e90eea217ac1b5c1
SHA1 d4e165ca964d260e69de2ef3637a550882ffcb51
SHA512 29d99cb843ca5a3b158feb3467f9b7fce32b4ca09697433a1795edec3b3a2a86086259814418b55ee9f4533cd1aa3bd03c99cdd430bef97bd65ff93947f70bc1
SSDEEP 384:uZcIxsNTen/b/jRVRN0OKq9ao+HBbsoHoG:MxzP3H0OB9aog9H1
TLSH
T11E828D726C38ACB75EF69105FA8735174FB88067A6C82F8091D86F1C05DA6DD130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 09ac80bbe458aa99e47fba98fba3f41756297e748736e50afae33693432dd198
MD5 7666f5b53c431fa87ae0431d5e80390a
SHA1 223915d999f5906d79b9cedad530cb803c08654f
SHA512 60f7741e4d80e883cad2042bb53ca27560b4e57c40cf0fe9b2fbb60ae4c1fd32219aad3a849df947bfb7b8d1bb67a0fc872ce99ab8c72c0e06672b013870f51c
SSDEEP 384:0ZcIhsNTHn/bTjRVRN0OKq9ao+HBbsoHoG:yh0z3H0OB9aog9H1
TLSH
T198829D726C389CB75EF69105FA8735074FB88067A6C86F9091D8AF1C05DA6DD130FE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93b1bc95589936f8cd0fe635db13b365ac4bc619301a7979a76696af67a8db27
MD5 2dbfe9c5209b71a6f6dbe20f84fee22d
SHA1 af4fe6aaca533c8ef5cf6e5e165ff3fcc86f4d46
SHA512 f2d2904deb3abe5cb516d2221b8daf0d0930db903a82cbc5fb6c392a5bf1df9513e9608779741a9d34b36055ee64e6c38e9b003d2843b2b2bc03e28b7d8534e2
SSDEEP 192:iONu6JkRIQmiUyhDj+RN0OmheRnX9jVcGqixU6:iONu6UoUj+RN0OKq9KoU6
TLSH
T15E120B36A938AC775EE36544F58732175EA5513BEA896F80D1D82F0C01EFA9C230ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2bbbda78c24643dc28ecc9fa17c656ef421456e3573994e872042a974897387c
MD5 a76b6f7b33e6bcac31e07817fc37ab1e
SHA1 c6b2f5536d9e64697b9287a2194a858f0822cec6
SHA512 ce4db04b83158ecfe4b73ea4909f5d547132ed27398a35301c61adde58f016fb709eb67c3bd28737adf7cf5afeedf797bdd388f8b4fd8c0a03d2adce49502792
SSDEEP 384:FiFiZcIWsNt8TUNTUlIlen/b/DRVRN0OKq9To+HBbsoHoG:MFQWIwg8n3H0OB9Tog9H1
TLSH
T1F3C229F258D79876D9AE4743E77E2D034EBCC067B5846A50B3885A0CCC961BFD30AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3b30e08-064e-447f-853a-c736a7ba6c8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a3b30e08-064e-447f-853a-c736a7ba6c8b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d2ff9d96613c48d6112816f605eaa5fd8609e5cb0ef9242fdc14a3f843f2e4f6
MD5 804f5291630b1bf263a9ad4448d8bea3
SHA1 877ad1e06ff65bd2ea9bbd6d418b8e0fdd1fb2fc
SHA512 ecf740fdbbfab7e59bd3fc9cfaa3d2ac48462ef0dfd5d18abd362375aa0a8c614564f4e268d1ae870a366b8c63d98c2eee98f6a8d0f795c2c8f0158463f63468
TLSH
T188412C5CBAE91108B3B76E46AFF6A8AD447F78772E46945E10010E4F0A23B41C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

NUDIST TOWN (STRONG NUDITY) HDR.mp4

Path C:\Users\Admin\Downloads\NUDIST TOWN (STRONG NUDITY) HDR.mp4
Size 33.3MB
SHA256 3540b24b144d5cb34cd6afe33296ea0db3552520bd35cc1bea1420608775e5e9
MD5 dd974aec25dc83894b0d1ac1c8106dba
SHA1 bc289bb4d6ab5c97f2f6e3333b18596052584fe4
SHA512 ea77b2c8fb1ac052013d8805e4d392742d9ef6ddb4371577ff9691961caff71c7a985f2d5aea22284e1b814c615da461fbca4292536dd34b0fe2fd2c9761d5e8
SSDEEP 786432:E/Z6YxpXikXNTmydhC8aZiGway24XNFKJuvC7ui:E/Z64likc0hkiA4XLvCyi
TLSH
T14577338A9B72B00BDF78863291E547047672C62967C7DBCB7A46B74A2C23BD13F190D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-366-0x00007FFBE7C40000-0x00007FFBE7C51000-memory.dmp

Download

memory/1752-331-0x00007FFBE8340000-0x00007FFBE86D0000-memory.dmp

Download

memory/1752-372-0x00007FFBE7990000-0x00007FFBE7A28000-memory.dmp

Download

memory/1752-367-0x00007FFBE7A30000-0x00007FFBE7C3B000-memory.dmp

Download

memory/1752-374-0x00007FFBE7910000-0x00007FFBE7935000-memory.dmp

Download

memory/1752-365-0x00007FFBE7C60000-0x00007FFBE7C71000-memory.dmp

Download

memory/1752-364-0x00007FFBE7C80000-0x00007FFBE7C9A000-memory.dmp

Download

memory/1752-363-0x00007FFBE7CA0000-0x00007FFBE7CCD000-memory.dmp

Download

memory/1752-362-0x00007FFBE7CD0000-0x00007FFBE7CF6000-memory.dmp

Download

memory/1752-361-0x00007FFBE7D00000-0x00007FFBE7D18000-memory.dmp

Download

memory/1752-360-0x00007FFBE7D20000-0x00007FFBE7D4F000-memory.dmp

Download

memory/1752-359-0x00007FFBE7D50000-0x00007FFBE7D91000-memory.dmp

Download

memory/1752-358-0x00007FFBE7DA0000-0x00007FFBE7E83000-memory.dmp

Download

memory/1752-336-0x00007FFBE7E90000-0x00007FFBE7F78000-memory.dmp

Download

memory/1752-375-0x00007FFBE7860000-0x00007FFBE790B000-memory.dmp

Download

memory/1752-335-0x00007FFBE7F80000-0x00007FFBE8216000-memory.dmp

Download

memory/1752-334-0x00007FFBE8220000-0x00007FFBE82F2000-memory.dmp

Download

memory/1752-333-0x00007FFBE8300000-0x00007FFBE8311000-memory.dmp

Download

memory/1752-332-0x00007FFBE8320000-0x00007FFBE8334000-memory.dmp

Download

memory/1752-373-0x00007FFBE7940000-0x00007FFBE798F000-memory.dmp

Download

memory/1752-330-0x00007FFBE86D0000-0x00007FFBE86FB000-memory.dmp

Download

memory/1752-329-0x00007FFBE9DF0000-0x00007FFBE9E12000-memory.dmp

Download

memory/1752-328-0x00007FFBE9740000-0x00007FFBE9759000-memory.dmp

Download

memory/1752-327-0x00007FFBE9980000-0x00007FFBE9991000-memory.dmp

Download

memory/1752-326-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download

memory/1752-325-0x00007FFBE99A0000-0x00007FFBE99D4000-memory.dmp

Download

memory/1752-320-0x00007FF729CF0000-0x00007FF729DE8000-memory.dmp

Download

memory/1752-381-0x00007FFBDDEE0000-0x00007FFBDE125000-memory.dmp

Download

memory/1752-376-0x00007FFBE7840000-0x00007FFBE785B000-memory.dmp

Download

memory/1752-377-0x00007FFBE7820000-0x00007FFBE7832000-memory.dmp

Download

memory/1752-378-0x0000025477A10000-0x0000025477A40000-memory.dmp

Download

memory/1752-379-0x0000025479730000-0x0000025479742000-memory.dmp

Download

memory/1752-380-0x0000025479760000-0x0000025479A60000-memory.dmp

Download

memory/1752-531-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download

memory/1752-749-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download

memory/1752-395-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download

memory/1752-716-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download

memory/1752-925-0x00007FFBE8700000-0x00007FFBE89B6000-memory.dmp

Download