hxxps://gofile[.]io/d/5gwM4TFO

Analysis

user interaction
yes
max time kernel
235s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/5gwM4TFO
Sample260908-sj38tsshle

Score

8^/10

discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
287	4620	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
1368	Among Us.exe
1008	XboxInstaller.exe
856	Among Us.exe
3796	Among Us.exe

Loads dropped DLL 9 IoCs

pid	Process
1368	Among Us.exe
1368	Among Us.exe
1368	Among Us.exe
856	Among Us.exe
856	Among Us.exe
856	Among Us.exe
3796	Among Us.exe
3796	Among Us.exe
3796	Among Us.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	api.gofile.io
36	api.gofile.io
50	api.gofile.io

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	XboxInstaller.exe
File opened (read-only)	\??\J:	XboxInstaller.exe
File opened (read-only)	\??\O:	XboxInstaller.exe
File opened (read-only)	\??\P:	XboxInstaller.exe
File opened (read-only)	\??\Q:	XboxInstaller.exe
File opened (read-only)	\??\R:	XboxInstaller.exe
File opened (read-only)	\??\E:	XboxInstaller.exe
File opened (read-only)	\??\H:	XboxInstaller.exe
File opened (read-only)	\??\L:	XboxInstaller.exe
File opened (read-only)	\??\X:	XboxInstaller.exe
File opened (read-only)	\??\Y:	XboxInstaller.exe
File opened (read-only)	\??\Z:	XboxInstaller.exe
File opened (read-only)	\??\A:	XboxInstaller.exe
File opened (read-only)	\??\N:	XboxInstaller.exe
File opened (read-only)	\??\S:	XboxInstaller.exe
File opened (read-only)	\??\T:	XboxInstaller.exe
File opened (read-only)	\??\U:	XboxInstaller.exe
File opened (read-only)	\??\B:	XboxInstaller.exe
File opened (read-only)	\??\G:	XboxInstaller.exe
File opened (read-only)	\??\K:	XboxInstaller.exe
File opened (read-only)	\??\M:	XboxInstaller.exe
File opened (read-only)	\??\V:	XboxInstaller.exe
File opened (read-only)	\??\W:	XboxInstaller.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4516	GameBarPresenceWriter.exe
5032	GameBarPresenceWriter.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XboxInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4620	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333538311455699"	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{5F5D8AA0-7591-4D1D-BC04-444D397B7DB2}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C16BE966-41CE-47F9-8718-367A2B57D4FA}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BDAABAC4-BE23-4A15-9264-3C3096745F9E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
980	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3940	7zG.exe
Token: 35	3940	7zG.exe
Token: SeSecurityPrivilege	3940	7zG.exe
Token: SeSecurityPrivilege	3940	7zG.exe
Token: SeShutdownPrivilege	1008	XboxInstaller.exe
Token: SeCreatePagefilePrivilege	1008	XboxInstaller.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
3940	7zG.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3584	OpenWith.exe
2980	OpenWith.exe
3692	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 5000	4760	msedge.exe	87
PID 4760 wrote to memory of 4620	4760	msedge.exe	88
PID 4760 wrote to memory of 4036	4760	msedge.exe	90
PID 4760 wrote to memory of 4036	4760	msedge.exe	90
PID 4760 wrote to memory of 4380	4760	msedge.exe	89
PID 4760 wrote to memory of 4380	4760	msedge.exe	89
PID 4760 wrote to memory of 4380	4760	msedge.exe	89
PID 4760 wrote to memory of 2932	4760	msedge.exe	93
PID 4760 wrote to memory of 2612	4760	msedge.exe	92
PID 4760 wrote to memory of 2612	4760	msedge.exe	92
PID 4760 wrote to memory of 2612	4760	msedge.exe	92
PID 4760 wrote to memory of 2932	4760	msedge.exe	93
PID 4760 wrote to memory of 2932	4760	msedge.exe	93
PID 4760 wrote to memory of 3792	4760	msedge.exe	95
PID 4760 wrote to memory of 3792	4760	msedge.exe	95
PID 4760 wrote to memory of 3792	4760	msedge.exe	95
PID 4760 wrote to memory of 2840	4760	msedge.exe	94
PID 4760 wrote to memory of 2840	4760	msedge.exe	94
PID 4760 wrote to memory of 2840	4760	msedge.exe	94
PID 4760 wrote to memory of 4664	4760	msedge.exe	100
PID 4760 wrote to memory of 4664	4760	msedge.exe	100
PID 4760 wrote to memory of 4880	4760	msedge.exe	99
PID 4760 wrote to memory of 4880	4760	msedge.exe	99
PID 4760 wrote to memory of 3404	4760	msedge.exe	102
PID 4760 wrote to memory of 4308	4760	msedge.exe	104
PID 4760 wrote to memory of 4308	4760	msedge.exe	104
PID 4760 wrote to memory of 636	4760	msedge.exe	105
PID 4760 wrote to memory of 636	4760	msedge.exe	105
PID 4760 wrote to memory of 636	4760	msedge.exe	105
PID 4760 wrote to memory of 3364	4760	msedge.exe	108
PID 4760 wrote to memory of 3364	4760	msedge.exe	108
PID 4760 wrote to memory of 3364	4760	msedge.exe	108
PID 4760 wrote to memory of 3812	4760	msedge.exe	111
PID 4760 wrote to memory of 2748	4760	msedge.exe	112
PID 4760 wrote to memory of 1368	4760	msedge.exe	113
PID 4760 wrote to memory of 2128	4760	msedge.exe	119
PID 4760 wrote to memory of 2128	4760	msedge.exe	119
PID 4760 wrote to memory of 4048	4760	msedge.exe	122
PID 4760 wrote to memory of 4964	4760	msedge.exe	127
PID 4760 wrote to memory of 3888	4760	msedge.exe	131
PID 4760 wrote to memory of 3888	4760	msedge.exe	131
PID 4760 wrote to memory of 392	4760	msedge.exe	135
PID 4760 wrote to memory of 392	4760	msedge.exe	135
PID 4760 wrote to memory of 392	4760	msedge.exe	135
PID 4760 wrote to memory of 4908	4760	msedge.exe	136
PID 4760 wrote to memory of 4908	4760	msedge.exe	136
PID 4760 wrote to memory of 4312	4760	msedge.exe	137
PID 4760 wrote to memory of 4312	4760	msedge.exe	137
PID 4760 wrote to memory of 4312	4760	msedge.exe	137
PID 4760 wrote to memory of 1004	4760	msedge.exe	138
PID 4760 wrote to memory of 1004	4760	msedge.exe	138
PID 4760 wrote to memory of 1004	4760	msedge.exe	138
PID 4760 wrote to memory of 4920	4760	msedge.exe	139
PID 4760 wrote to memory of 4920	4760	msedge.exe	139
PID 4760 wrote to memory of 4920	4760	msedge.exe	139
PID 4760 wrote to memory of 4336	4760	msedge.exe	140
PID 4760 wrote to memory of 4336	4760	msedge.exe	140
PID 4760 wrote to memory of 4336	4760	msedge.exe	140
PID 4760 wrote to memory of 1428	4760	msedge.exe	141
PID 4760 wrote to memory of 1428	4760	msedge.exe	141
PID 4760 wrote to memory of 1428	4760	msedge.exe	141
PID 4760 wrote to memory of 4584	4760	msedge.exe	142
PID 4760 wrote to memory of 4584	4760	msedge.exe	142
PID 4760 wrote to memory of 4584	4760	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/5gwM4TFO
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffd51a5c188,0x7ffd51a5c194,0x7ffd51a5c1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,5464066632710257737,6870364404894867276,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,13468113908745816666,11238880815987016251,262144 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,17335639982149775867,3646109770398912308,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13173558502024690493,741007396446806913,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8259135447180701058,9435886530645948406,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,7334886604969532480,5418704147516620175,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,17683722907887391224,17496152293042580128,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,10643846564050147910,14775666617400333548,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,9535744676901067250,3521193966115664486,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13736872691025658234,16739735994459484143,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13736872691025658234,16739735994459484143,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2022129026804625989,11775254242582747971,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6348,i,10892172115617965121,17565395413818527948,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4180,i,17022490536492996292,6131141402808479383,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15598408703343866112,18278950859583609723,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,15777241154573187454,9133022763286250138,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15281030733795894790,7973788064467641860,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,9320755494626360871,6237378494175593340,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5904302756817613051,7493142321124165956,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6320,i,12061127084784069387,16995934468957152730,262144 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11668912543032062828,9036004909580507599,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5332,i,3919655241773891051,1888304509279439619,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,192011220490696177,5072992929028914932,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3740,i,1397039274162094925,273005649105804956,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7112,i,13604764753406773963,13012175860342940052,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7240,i,12110244508745815142,18112214276759957209,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7032,i,14819853829723063653,1759819872151167073,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7656,i,7603584440190195274,18090328215294966564,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7756,i,6937303544177763277,8778378770318237988,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6964,i,15917870890315476920,1649902921645170472,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,911327090774031514,2240437438006590260,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,15715252903852647237,14311537549103278251,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,4324269217075378186,1565650989599215220,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4300,i,15310383689068021920,13331923938998646389,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7404,i,16484080685208809354,14939756520056885713,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7124,i,10861707837849474735,5189381182965230451,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8156,i,4405587547824687050,6704176064994942993,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7272,i,3122513279924009230,12306567426947566265,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=1544 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7104,i,17406024440394227166,10810074174017559712,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8216,i,582801323643314338,1317989983283508807,2097152 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8448,i,5449280000373628680,4288634009844143697,524288 --field-trial-handle=2348,i,8131769797090242528,5844374676859191709,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:8
  2⤵
  PID:4560
- C:\Users\Admin\Downloads\XboxInstaller.exe
  "C:\Users\Admin\Downloads\XboxInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4384

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Among.Us.Gamdie.com\" -spe -an -ai#7zMap32686:100:7zEvent13909
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Read Me - How to Run.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:980

C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe
"C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4516

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4264

C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe
"C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3356

C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe
"C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2cfe0e512fe66762495535e6076a96bb4e6ed6f34c98c4a7f8df941ef3c8c17c
MD5 5c148bcc6fa502a2fee964c0dd6afdfc
SHA1 9199b6a7ccde16500ea75a0020ab5db0df5569d4
SHA512 4631fdc4ed2e6e278c330749a012433d939adf4beecbd21c6f7a1cb60fe9640888daa64ec4b81642fafbb45e59921d422ffcb8d6579eb20f08c08622b263623c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T113B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22df140cf27633bb5a5cfb41856accaa97390f0e68ea50ce283a05244e70c75e
MD5 8309d4388bf9ad61f64efb2cff858a46
SHA1 5d506ca1d6f3121b4913ac8dd94595ef742deb8f
SHA512 c96144f89130652cb71678e2400de8c4bfd6104eb4607c508a56a32ccdaf7e724e084d306bf7a01138b4da19f98f2e33e355a539958acc257501ad3d4835f6fd
TLSH
T1F0D023207E7DB5D1E1271038E513474032DD55F63547520BF550451E5D7A4C393DE9D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

8e3ad72f-65ec-47ae-b8c5-4a3bd9937697.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e3ad72f-65ec-47ae-b8c5-4a3bd9937697.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 842e5f9bbd63e211b498546e34ad286dc3e420cb8f74a768bdc299bd6915969a
MD5 2f5feae826ce22b7736ef4fdda750d6b
SHA1 31825b867d6cb0e2b0922df810783e8e11f55410
SHA512 374b65f9a74c7de8f2a8a9a5af2c46e087fc07a329202ecf7de7840b96ce8716a15eb5a529a969979cc2119d2916b89fb88babd5b812363dedc181e73f4cabcc
TLSH
T10DE0D85B328ECBD4464A95CE807E6F944996FF5BE58C9F5A330572CC2D16010474F4A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 196KB
SHA256 bd7cdccac3524ca643acef4a9a1fd25984ed7673a69212d16b87958ee9dc41fa
MD5 d0818f7e68853948e37f2aa564b838d1
SHA1 feb7e45b50b12d6329df779d8e680fd733389176
SHA512 03ed2c044b043f5531fe73f74b2476a1e0fc6ed79e2021db73731e15681d7436fe287ea31912d84a2591d6c32f7767ac93b7abae41cd169ee68d237bfb57194a
SSDEEP 6144:1I4vFVyzkZ1hqk5fbWTQJG2IfGJkS7J4JYBPq:1hvFN4kJhs7m7J4eNq
TLSH
T189142309B24619BA160068AA047D9CA41D35DB1D0AC10D2274CFFA74BBD73B56BFC6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e6
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e7
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e8
Size 43KB
SHA256 14ef713f8c26bb48eb58aee7291d24bfec7fe04461af055f0c9ad63a298c5a93
MD5 e7f31b312430a58beebf02569971cecc
SHA1 6a36445d1f2bd9ded564f13fb047b896f1ada7db
SHA512 f069e3981fc381c27bb2f3c1a36251142fce8661d614f92058b9418def9a950323957fc9df7453bb671b7639869542656cce9df96e0b45e6e12a6637ebc6e1d8
SSDEEP 768:3CZ1Qapm3DP4Q8Ag1BGBa0p/PE+4dxquLkDOBFwQ4aUjnlxGR/Yy:SZ6a43DP4RbGBa0VPE+pWkDOBFwQAjne
TLSH
T154130200E0F0CE82941B5C8A0D78948A7B210AD49EB5737486E8DFF7C51BDB8C6DB05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c4d0c238be50b411ad278e82d1b2211325ed0d02b2676b241c7013a49cdf5957
MD5 c09f7e91b236b1a5e569b856c46f24fe
SHA1 4f11ad34d013aa73480b254b740844a7a37d4aa4
SHA512 11f1717cb0c00e441b51aaccb8e186e00802257abe7ecfcd60754e1f5479d125d4236a44e09ae744e4472196208dc0ffdb04d5daab0a57906f71920312b35ddb
SSDEEP 96:fOKZ69yGS7bAEt8je8WTXeLZteFTef/th:fO5g9fTeLH4YFh
TLSH
T1E5B1C735028A0091C759A1B5FFF32202B77292FBFE8FAD668476F97C9903749453A84D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 0566c086b017be3cb27e0aeb41c89e058695448613d6cc87e165f59ccc0120a1
MD5 7f168cca9d10ba19a092f19a01c17bbb
SHA1 7552739a5c8ee3e3b3f040c5091647f7cf55f0bb
SHA512 f74a4bbc559e891170277533ab389200716fb205f2ccc762fe4e281221b142b03f74ffaa35940758fd63a36ed6f5317c848eaece43d05ba8e25765f3802a7600
SSDEEP 384:HDKPCJNBPEMzuExR8Cy5utBYNLjv9rpntnlkyR:HKfQtuJd
TLSH
T1654264B5029E0384EF1810B5FAE36E42B77106D7FAABAF6B40A4FE3C5907789346545C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bd21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd21.TMP
Size 3KB
SHA256 cfe0cf412c76094ee6860e5e21f7a0006d625f9bce36d1c4fa1a455c434132c8
MD5 4ecfd44dbd67b95aee63cfaa736f1bfa
SHA1 e6362d23143e2f1f6e34e8c8a2f28cc2b5aaaf0d
SHA512 490b7447693dc82e6e81d57a77e6397c3c7d578442d3aafbb4af257d38cacf1eff963a05cc05dcace5012a631545ec61db291872fad024afb00ed7803f392797
TLSH
T1B2812D35028E0091C75EA2BAFFC10300F772A2EBFF97AD76C4A2997C980375C890AC45
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c669f7010bc0fedfd6a365ea03dc9b07886eb91805c23d355a9922b048995f54
MD5 b91364b3e8619b9a451ab649fb16f7f2
SHA1 3cfc7a2b89b1380e50eafe4fff2f15ee5ad04d7a
SHA512 6de1e9e3e7d85120e0f1a8f88312d22c1ed154246b96652e302b87694fbd7f8de4eeb18baa317352ce4357eb51a889291996db80ead51ea6433d654e6b531467
SSDEEP 3:MsEllllkEthXllkl2zELva:/M/xT02zA
TLSH
T1394404047FD00445C544107C4017C3500370DD110511F75335D3DC33DCCD5C07C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 35b64e9ea470a2898c9cc78b7ccb33e613d47858cec3a3e20d292c91453a54f6
MD5 9d358e50bfe627173f252b2dab9ebd12
SHA1 a88b19fa6f107edf5bfb7349c2981ebacf19ee72
SHA512 7f3111491986ab58c779e228b7dab717fe21f5441578232360c453ea79842e07b006b493814a21871cec6cb214d363370aa5e82dc34d5cfa657825e96cf82aad
SSDEEP 192:D9U8SNmix6SA1SPhJVz8Dyk752tjTY2GqfhIAikR0pZfvEKm1/BUcv0L8ZG3:D9U8SNmix6SA1SPhJVz8Dyk752tjTY20
TLSH
T190029CF3C3F5426EDA2192F0EA156F1BCE5C0512436C786AC5E4AE17A3F2471E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7067abdf42eef4a4ee003eb3cc6d82bb71e1eff09e302385d5e72b2761472f84
MD5 fbef28aff94217086204524cba0c4ed9
SHA1 4d2bd608daa212ee0c26eb73202a249eaab12dbc
SHA512 3eff4a7343752582f97bfec2f42770decb243322024ca3f5a7a4b7e2c2637c953c0fe5fcce0b0d58ab5adbcba84a0a4135213ad8a8c9bb5d3b5d9f1e69d837ff
TLSH
T19F41DFF3C3E8916D8D2156F4AF14AE2BCD1C0516832C393A8AD4AE07A3E3831D10565F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 caec92f669900646c96ae57839932a6b1455e7ae2dee1a003d7b1156ae67001c
MD5 7d4f77ea0cf09c6977d73aa49b3c692d
SHA1 47f493d0502e6d4691689ddf4d5ab476a65b51cc
SHA512 131ba0340971f626890f53e027581ffcd199cd22168fc714d012bef37604f478c12cf8cd6b086e13cc9bece8e645324febdb7912656d4097dfd7b67b3910034e
TLSH
T11D41C1F3C3E8916D8D2156F4AE14AE2BCD5C1116832C79398AD4AE07E3E3572D10575F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bd525c947725a0a3edbaabf6e8931d9fa685239d0d0649f981db7c90c60f7870
MD5 aad267c5980a5c704183a81b7b33fcac
SHA1 69fa1d5fcc5e577f8ed193fc5eb1cde7973033a3
SHA512 f46be1be19f37381a785024c2744438a5113f9ec715bd593e54700fd000a4e5d82588c70747b6b17ad8a5c17937e3bb7c8cbcadbe14022358841a695f0d0ea5b
TLSH
T191D0233327053176567C3DC27055EC4FC33A20310401DDE410D0585C853556D5557341
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5abe11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5abe11.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 5aa1b546f5bda1e4b16116619344795d548ac367dc3d950415a6f7af7234a393
MD5 da2f82021b54c1bb30ff19d2c4a8066b
SHA1 5f45b60e4331d2b312e8c9a2b1f64ff7381081f3
SHA512 b1f45178cf6512b0d935224ea5434bf0793b99f83913a199bb860a0af63390d6ccac08c448e942736cace415aaeb8a252b6db016cbe0ff14834614bdf4286a41
SSDEEP 384:sxZ1zqAmWs/fCsPWvFjPIVmKHbun2pVX82v/6ug3+3J:s9OAmWs/ftYFjg7Hbvpd6T+5
TLSH
T11F92E642652089B7CCDBC519FD31BF56E6F824639D914E48AAFCC91C04EA6FD2613C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b2aa4d1e59de122623213a0ab31bfca0966d721ace0a01304d37d7e6001fd564
MD5 5eb153076d1ffbed244edbbefecc6a21
SHA1 d632f5b076eb8d3dd81a4305e5fff17b0ea295b1
SHA512 1a2217695178931436988fab21e47216b498b7bad16aa29523fb9612dbb0d7ca56bf7ab656176136b5118d8cb02c9edb98ca638fb4bc5b148219a00ac8c721de
SSDEEP 192:sxZgRFyM/jK1Ml8UQHWPs/fCssKKHBldp4ZlHHW6+WNesCkYv/YztINIuIg5hJ:sxZgzq2Ps/fCssjbeHbAr/kUN
TLSH
T19F52D852AA345A77CCDBD209FA41BF53D6F55472A2940E44AAFCCA1C04E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 c2618b5f34e490ff5bf8f6cf4780a5b78d08b5451d868ceae21a459dd979ec8f
MD5 53a0e1fb6713b8783be31d62ae844e38
SHA1 4a13fb141f490c3e42db94e83a7c97f3eb90ac02
SHA512 66b369184ff1ea4c1680cd7083877007480bb43c026ff6c5f409bdfd5bcbefbce47aed32731497cc576e4c6bbd8e7a7f62c05baf1b098b9f253be4cd71510a1e
SSDEEP 384:sxZ1zqUmWs/fCssjwIVmCHbkr8/mU63+3J:s9OUmWs/fmjPXHbBmX+5
TLSH
T1E892E742A6208977CCDBD519BD31BF52E6F814639D904E4CAAFCC91C04E7AFD261382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8b51e23f915e58484d0b42cbe2b10d205bf94a8dc1a94ba49dab3e4a3bd8ea2e
MD5 1ce84df9367922190e2562d49130004a
SHA1 25443f83a5e2aa26263f9c8370a0c300e0b59763
SHA512 7efe39a2b346ef7ce0cf155a3db1050af34dc33d08c9f32922cdb842f6975d1328a58a73dbc2faf8c48b1b51d5af01c3c99dd98f4b46d630acd878db053d281b
SSDEEP 192:sxZgRFyM/jK1Ml8M9s/fCsAkKHBIdpjlHHW6+WNe1i/YzZyIuIgrJ:sxZgz1s/fCsAlKpHbh/x9
TLSH
T17842D851AA34697BCCCBD209FA45BF53D6F55472A2900E44AAFCDA1C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10f212e0d6062f42e5f69a4b7770ec585b35e527dde215e0469a26dc65595a1b
MD5 0b761ebf8f694aed085433db3e97c090
SHA1 a970af59877729dbc847cc85572e5db8e3fff1ef
SHA512 e65423866b1a15184f488bcd86bc77e19d98aec5361691b738fdc9aebc81f55b9ba618734dd9ddc3658f9623cc26a7cfa17e93ff625642155c1924e5c86019b0
SSDEEP 192:sxZgRFyM/jK1Ml8UQH9s/fCssKKHBIdpRlHHW6+WNeI+FYzdINIuIg5hJ:sxZgzqds/fCssjKzHb4FwUN
TLSH
T11052C751AA345977CCDBD209FA41BF53D6F56472A2940E44AAFCCA1C05E7AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b1582c27658a6ef3616f43d52afa686f0ce16a114c360edaa835c7f5e5610108
MD5 237e8a2c01e9450a19890603fc7e8a7e
SHA1 3f11ad83cdbf20d84de29cdc1563702e024621ea
SHA512 0ab3a9c96228057d2c5159034d51c1caf43d756316dc11643e0ba8492649606f3450d74e16ac1f898808a39974549ac2e6e4bf0309563af4c07fe242995dd279
SSDEEP 768:JwW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjoroIii3Y5:JwW7kf0Wvqidau1jaa5LA3jTh5
TLSH
T1D9D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 a098da6cd61b5c5e4faba07431ec829f5fd4b488113037d5a7c8c082d98dbfcc
MD5 707fc19222d0a4a9cfde63a5cc4bfe2e
SHA1 dd527b74f03894278174850f55b48582891c0577
SHA512 3cb22a45093be9b7def900ae1ab2ab4864d347aa0439068e881e49929d0af030d7e158eb19ddf9ddb00011af2a00fe86853e48abd59a95df7f4085601dfbae95
TLSH
T1323141488E90C9AFE9A840B215F7B4E5737089CD5361A7A3583C32317E137592A4B0EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 c9aa1c8e4e9b1eb5bd70ace8898518f26f7c2fb2ee1ca12283e21189e1427285
MD5 6f704202369e8d4734977186fb620dfd
SHA1 465fbc0bba0e760febc93ce9f57a069e1ea5392e
SHA512 b15517a89b77e8a51ae13052b18cf434dfa983378caa65bd1acbc93945b3f52d64afea342ad99f2cd961ca68bd4c97c28514f5038153aa1b35eb8d2ea1efe78f
TLSH
T1F751C90E0C430B6AEEAC657218B61846373975DC23941D27B5FE8135F8D3728AD4C6BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6b5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5a6b5e.TMP
Size 1KB
SHA256 b330e36257ee9534dfa94ad1aa6c2030c4d39233bcc11cdc1de4ef1169e7855f
MD5 d40706204718823fac8952c6fc19016e
SHA1 d0437c226c4f8c82c63bd1bf9cca15906ec685fd
SHA512 9cd00f47b419d9f23fadb924e880ef5e036ef405d844abbf736b10715ba4bd86333592bac8840bf97c7fc77e50017baa307b426bd82bb96ffd97a210a40ef0f5
TLSH
T1D931634A4A90491BF88450770AA2B4B8733588409322B3D3A47C1239AE71B8E2A4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 4dd8e8bdf92a3bfa2d7133fbdaef5d1e51835d64ac699a613be29936a06728e9
MD5 44846a97a1eaa514b1f70d9b5f2d0431
SHA1 d50c04b64b52456ce1a227cd77f4eb908ef20371
SHA512 e2f4d700f4837fc261ebee03f6e305e3c1ad15e09dc94fa3332f6fbd1ab9b2b034246fa931fed269c05ca935381ae42545b83abda36f93d3f4815b266d8daca1
TLSH
T1D8A00210AB88001AD05A52B6795783511351DC903581530768910544CC53690CD8184D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 af1e68be83d6050c06ccf2d571cb51fb73d5824ce7b03404def1458fc1a7f6f6
MD5 bbb49129a05c7e1c884b1d92587f9e80
SHA1 f87c4e86c761de1cb9ca56b96bcdd486937baea0
SHA512 ac75cf793a1e90889204d4b9321b7406cf96ca2e1d1e2f3d30923158e4adaf8440ba1b6aa20a3e9a89e9abfb2483ccce5a49e08c2694eb6c98d09a81833fb356
TLSH
T1F8A0026917C08525C406A6B22DE703916355DD11031217C742985784CD64A4D8D4564E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 63acc3d7bcd92922f1394248329655daf64503b56f2bc1d984d431478bbcfdaf
MD5 67dd29cc7153cee47c65982db1cef2c7
SHA1 255879c8c2b1707744345fbc80346b69ca091a84
SHA512 736e47af9ca3bec4157cfece44e9cebcaf9ca4443e4aa5ce7ea9b6082ed811ae16113ab3410630e20365e25fb62c12b5c3c9ce3b81aead2b03111c2820643d1d
TLSH
T1BBE068BB2DFB1820ACAF87C538B055A0818539189500EC4E312BA29770F2351240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 70e4c2698f40f706ec010b48d74f00a2502d1fb2a5dee074213ea11c6de66e42
MD5 f2269e7b672e1927337866629b5586cf
SHA1 23bf4172da553a5818b14ac1a89b9f14076ef8fd
SHA512 a25ab6ebac3f51a248655612dcca3f83732226a51846ef205eb5e9cebd54a9f3066863ed9c95ac89a3c560145c62344e496f8ed7cc93faca6d9c85d503da5eb6
TLSH
T182A002169D559559C04246F490E602D8621088DA06152729E7ECF5988D522415192214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac238.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac238.TMP
Size 48B
SHA256 9e12d3dde61fef7e9714e96d1eb39d930a180a367c695dc3a3614b1cfc4de5df
MD5 d7201723bfcd26a7d6c9271f5a7dc566
SHA1 bddfea87b7f2e8901549908367857917be7f43e3
SHA512 ed34b408e0bb64c7cc05ab885e25e3e91eee412c0f01e774168d5ee8d3b3252cbb293023522c2edb3ba4d6b291fa38c640459e7c7d6ca136688e83d8ff97beff
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8b79761f493dcb8999a8b3c752092158556786955fbb0958c2da44481af4161a
MD5 f9d677cb5a876c2011cbcde5da08ff34
SHA1 fb78022afcb06fe998a2bf4cea94c5ba0661b124
SHA512 796104b82a909d206b1bae001036f5f2746673405cee2c376df1646c3b800ff4632f608f2f585a51a1b842df156c731dcb3250a7ec7bef60e4cc9bc73e3b6dca
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBarfIC:KIbCKcba0K/qmOVGKmcVfSK0c
TLSH
T117912043743E4613387D2808A6B5866A4E42769334A9A8FF7BB800A51F37E150DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

786e8e24-5e75-4b4e-aba1-4222a59c4887.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\786e8e24-5e75-4b4e-aba1-4222a59c4887.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f8b5924ed0cc2587ea95e1a20dcd6b45210977c066e7b2a0ef6ebc4d03125028
MD5 f9359c2f3991ac7a6d218daf7c4d4cce
SHA1 7a4231402d988d994b33ec388458ef25d00fe126
SHA512 f433d0c3a6bf96b63184ec626e9a1de6829a5825cd7ddc5d247b0c0f7dc96e18accaa08ad58bddc073257c2fdba94426fdb2517e2e5ae0299d51c09e94e31108
SSDEEP 384:XZcIhsNmZclcbQBV3dMjCEJr127sa+VY+lfo0:fhQlckd6h1Khgzf
TLSH
T1BA828D716C745C7BA8A7A291F84636035FF89077A7C96E54A6EDEF0C00DA7981303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f3fa391cab532aa3147b688ba01ab6e858b1453879ddab2362335104933b3f5c
MD5 1d738ba2658300d59dca6977a3df1037
SHA1 aecc999ef02539f948a9eefbd9f86036941b8290
SHA512 d2df6c0589ef7e51d245ffedf55b7fff8674f5a205ee585536f8518c78ff77ed131f3be1ad869a13d20b28c2374e0d6c5426b8d69b49f4db58b4944def0f2e7e
SSDEEP 384:oiFSZcIwsNS8TUNTUlIRtTGlcbHszp3dMjCEJrLhIvpVSB1sDS5sFx9THmIsa+Vj:zFgwrwg6lc8R6hLkTSUFx9Dthgzf
TLSH
T14CF23BE188D64CB6D4AD97C7973DAD0229BCC137B4889918B3F4A52DEC5B5BFC302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f16710ffb3e8ea90bfde5f4a6e83a864987fd0230cca83a091637727b8baab24
MD5 34c4f1f98ba33e8334b80cda2a699e89
SHA1 87c87ce4edb8da2436d127701cbd63aa68d21dfb
SHA512 6fd8340458a5e921fbbd0687dd86d5bb51c418033ad0b3844a14cad76a30717bd8430db6cdbb84b56a30787239bc117c3a516dabee9b23589b96eef993fdbfd1
SSDEEP 192:MONt64BAQmiUyD1dRW5GBPKnn+FdGN9Q1aD1T8U6:MONt6eAgNWMdMRl8U6
TLSH
T1BD02F835AC792C7B9EB2AE45F48637176FD8103BE6955F54E6E82B0C009765C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ecd61f5bddaf40de0982c04829344c9127e3d9f8e8fc682ccb5631007fb867c0
MD5 2ac640f86af97b4402f9892cfe3095d2
SHA1 85094a8052c50f0d94fc11ea3434f3e6c56ecc14
SHA512 e176f1bcabcb577e321ec68f50a1f1941c3eb3df251eea0187935f54afd56ce1957535211741b5e0b14921032f789efe9a43ed6711ea938467f5fe061c7d8337
SSDEEP 384:oiFLZcI4sNl8TUNTUlIltclcbZAV3dMjCEJra27sa+VY+lfo0:zFT4+wgglc+d6haKhgzf
TLSH
T1BDC21AF248D7887AD86E5743E77D2E025EBCC067B585A950B3D89A0CCC961BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 08664d69d3b9f8bd8051d6bb71494e3cadab175956442048c88d120e7870ced2
MD5 5b4f4e047b830aaf3c1048408bd2865b
SHA1 1f586eac011bf4fd4ef415cb04734eeaa00a0a4f
SHA512 b86ce6a2d7c7142850a5314d3c65064c6bf9be8764eaeb9e2249c383ea17e69be95d88326420f13bf2099d4c2ce815555c699b26b9ff2b11f37741e68e14f41d
SSDEEP 384:oiFPZcI4sNl8TUNTUlIltTJlcbVsJp3dMjCEJrQ27sa+VY+lfo0:zFH4+wgxlc+R6hQKhgzf
TLSH
T157C209F248D7887AE96E5743E77D2E025EBCC067B584A950B3D89A0CCC961BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ed620bab76d680eb46185969faa10861755a886469d99f31b77dd6d0ed87dd9e
MD5 4519a56964a37438a6f2eecb7705341d
SHA1 7f58788759389256b4b9a8438977aa3c9367032f
SHA512 fbd0948900388cc8533224e5a244c942f943fa9f401b649deb741c7f5aefdf2159b1c608cab64518b6eb660d76b7f8f57e33dc0f4d75b807c911c2035817770b
SSDEEP 384:iZcIhsNmCclcbQBV3dMjCEJr127sa+VY+lfo0:Qhblckd6h1Khgzf
TLSH
T197828E715C745C7BA8B7A291F84636035FF89077A7C96E54A6EDEB0C00DA7981307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c71cd199f386ba09f963fd7a5bfb473b903ea6dc209e0a046ee4c88420bbd29e
MD5 3c053f305c0b6d7b425dee6d1cfcf3cd
SHA1 7bca119c83b2345eb37b9c5114a0e42727e5c872
SHA512 adcf1b724312c1be4645695d52c40a8ce20b999036230b1231fab6eaf27d098a6d202bb3cb87e0ea5a50ed0ab7a6184a531d6fa44af6b4711478b41191032d4f
SSDEEP 384:oiF0ZcIwsNO8TUNTUlIRtTGlcbzs/p3dMjCEJrQ27sa+VY+lfo0:zFywbwg6lcmR6hQKhgzf
TLSH
T198C209F248D7887AE96E5743E77D2E025EBCC067B584A950B3D89A0CCC961BFD306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eca4c629f49888f2f9de209b21bbd037facbdf71a8bacdafccc58df427dc438a
MD5 d213dbaa080a3db02dadb19086207820
SHA1 23925d8711f5438d82c98876f9a2c4ddee9ad799
SHA512 a3088684abd8839a6d7d6f7110948229ba805b457a8968963aa936414336e5e35b45bfe07bbc7106440fc1da4cae6799e4e1b5425d9d18975b4aab0a283654a1
SSDEEP 384:oiFiZcI4sNm8TUNTUlIlZclcbZAV3dMjCEJrG27sa+VY+lfo0:zFQ4/wgwlc+d6hGKhgzf
TLSH
T1A5C21AF248D7887AD9AE5743E77D2E025EBCC067B585A950B3D89A0CCC961BFD306C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6bf1687c0f364f79c6f778b4dab33fd9573749a5548c71e4f8c71e651b11c846
MD5 14f3510f6d4d9f0cd7d5223d86f40797
SHA1 a7a94beaea0a924d40d5f0c23be33f01646375b5
SHA512 ca494922691d7b27889a15da10cd85a4908c4e6a752d8fba1a6111a79fbeece330bb8e3b5efb6aab842166634525881de46533089a8f7433db0bda39cde11fc5
SSDEEP 192:KONP64BKQmiUyGdRn5GBPKnn+FdGN9Q8XFC1SJr4WwiqW7U6:KONP6eGrnMdMjCEJre27U6
TLSH
T173121A36ACB46C6B5DA2B591F48736075EE44137FBC96F90F2EC6A1C01EB66C2306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bf220caa10bb9af08231f6f0886b9f5411495c69d2a6f5ad272a0cc521d72375
MD5 284511569c502fbe5639bfc797c17d24
SHA1 ca40395703589e0ba7aa03ad6792bd89d8ae3253
SHA512 576a9ba31805a8c5694d4c6e904f4cc206e03607dd5ff6a66aad8428e293669f960481c5a8f404494e0d610989c481d2d3501ef4467ade1c2b6829d7c9c7a04c
TLSH
T114E00103571095BEC53C03314DE71B323BE6C07902F6034B5A6816584C673812FB0FD4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0632d781a01bd31f7ce71313e88e18b30376aebb5cfd2c92d3e5b2b00cbace86
MD5 4a422cd3fb34dfa11a28029fbab1a5f7
SHA1 d292e73524a29062944b6f67eae04f7e4e6c377b
SHA512 aa8fab20ef2a1e458e45863dc8f4d4ba34f75db212f44ba49a556656db38cc31721d2c6028906d6ddf65fdd63d561b0b820bca474c33604e3589c4c1cea4a93c
TLSH
T102E002021310449EC538033108C3173037E3C02502750347595405544C173812F507D4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7ce1eb5205c47fdb79dd22630f606da78fd094af428c909b850966b021c3a44e
MD5 2a1b3b25411dac9f06f7af0ae08d1fca
SHA1 c041c422c7e7e2a32cf5c84184211f1c52877e7b
SHA512 ec293d20e9ce25b0ab2cb2c468a1c3dfd8d24562a48fffd6d9d534b03316e4db9f5a233990a8075728da24a6ddae38f988f202200b0343a3f16304b33e77635e
TLSH
T1E1E00103131045AEC53C03310983173127E3C03502F5034B5D5405544C172812F60B94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a8abd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a8abd.TMP
Size 392B
SHA256 a82aa94b33e3af96d4b8b20bc594607b6470e41bfc333673776bf1ec8be635c9
MD5 0a9fc1de2dc2b074db004f925e6d261f
SHA1 b67ebba9c10aa84a74c1107248af2ebb4bebb01b
SHA512 85ccadf6b7eb08a33ea7fae00439ad18baa846e2a38ed76ab58f9633904bd83b036c2395f8bffeeac8e9e50e71b9afe2c3332382cdcc67670ed0ebde57952a9f
MD5 SHA1 SHA512

Submit Download

ab855c92-a2d0-4816-8fd6-c1274c158555.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab855c92-a2d0-4816-8fd6-c1274c158555.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 c9bfdd6ce5d1c38643a1294a2082b6af768cc7ffe1e97891cefae9f6aa47e3f0
MD5 e62d2d33792cef60c03fd5d2783438c4
SHA1 28646fe803e48450bfe0dbeeaec6201acd0fef4c
SHA512 97207b9584be43868ad288e9921aaa1bc4ed9b08f3e32dbf5536f381e684fe0d9cbd4188db70e2249bee2b6b180f3cfc85cf784b69e6b8b003a55e61af27b9d9
SSDEEP 768:O7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPN:s9tQeoVYocxYCutFCiKt
TLSH
T10EC40E37A470A098DB3C35B1E2AD6B8CBD72641A12E006421F74B57F7A337D8DA0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 57c141cee9aa6651553d0b10429e06dc25832fd73ec1c8d2ae0b4c6401b885a0
MD5 c84f65b2ab5b6c932ab7ca5a6bcf104a
SHA1 78a08cb9a00015db8731025a1365bcee16113d91
SHA512 09178d459c8b6c2505177318cfaf47728c4b87938d2d9019141fc126b8e7fb43796038e178ba73811d5f81c86a975693ae4c7d9b610c0e530afde5d80b7a7330
TLSH
T153412858B6F91108B3B77E5AABF7A86D087EBD372F17C55E10110E8F0A22A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Among Us.exe

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\Among Us.exe
Size 651KB
SHA256 209d0cda85a2f86a46b6f3f97843dfee86d18259c987708376f6e1bf87d208e3
MD5 b90b3d839872ae022e37a87b9636081c
SHA1 d3ee59ea8493a4f36a5acffafd42ea85a1928a9c
SHA512 6af2adb57de70224bbec93d8ea76112edba5f192bfd56af610afe3607a179c6c3d0a468e6959c8a71bf8f27b4a341f6a1ebefe631fb18451c244c5264a1ecb65
SSDEEP 3072:SQJ/VdFgIW9mYucJ/OD8JlsI9TTItTukyyj0+5snQw:7/7FG9mpcJ/OD8WYkV5sn9
TLSH
T166E412EB3E68098FD251147FCC718A63895B6C696B058D4D75B33BAE4C204357EB2A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnlineFix.ini

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\OnlineFix.ini
Size 886B
SHA256 c0c14b56e87df121979f6d0bdaaea8a95f272c638964767530984d6c35ba0524
MD5 9a7e00b58bc11655d39c34473b60601c
SHA1 b5ab23c19b7f2cd4fa0e8cd275fcaaaf842d5918
SHA512 7df685ef608f61fbd4044b704e5d5f3f919c2c27523f07a5817e2abaa3346cc73fdee79290ff100c27cb35177265ae9a962f5e78b9ae471e04a258ff7ebc053a
TLSH
T1811196D053013A9156A8687C8BB44499B1FF210603715A1A30DCEBC4A47A38DFE49024
MD5 SHA1 SHA512 TLSH

Submit Download

OnlineFix64.dll

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\OnlineFix64.dll
Size 9.0MB
SHA256 b62151144eb4fea88e744d34073dc49b5dcd1b73d0267f96a7be08cb1f15b80b
MD5 6b5495a04f191706e9ba83df5ed885f6
SHA1 1aba8b6477603e7ed80955c5a6cd9ae46f53a352
SHA512 e7549000d7c6a88a92f5edbd86952007d0b5f242e5ccc32f387a8c0334f2ffee24f1655eac2807c9429868ed940d00814f08d2db3408f2240cff7232f76e6324
SSDEEP 196608:HTLd/HHnwhX2bSKFvzW0O6KG6n1y4U/ewaMKMu7ZLBx:H1PHK2tFvzrOPJ1y4ZwJKM
TLSH
T1D3A6124526C4E7BCD4C24538354612D970D0AD9D84FDCA49BBCB6823B6A0EEF116ABF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\UnityPlayer.dll
Size 29.3MB
SHA256 889d912da7a6897c469253a810eaa7682d12d0e3f2432f61f879f4152714af95
MD5 e6556b475f949c2e94d35425ed5bc00b
SHA1 7f543918458a795842c7a38a457a44c1cd0fc7ae
SHA512 5694d5c98f2bb326c54081e8e082073f7b9777c8c8c0f3d0e9de2810580e5f18f2f507c965d1f7a54dabc477ad29179954a9a85c91b543f35781b7a729e23037
SSDEEP 393216:Evy2ILJHr6HkCI7l3YxHJNzLxTc/tZ2TUtu7We02YF9:E6J7lyta1x/F9
TLSH
T164679DA6B2B800D4D47BD078D65BA90BFBB1344A033086EB52E149956F73BF11ABF750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlllist.txt

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\dlllist.txt
Size 15B
SHA256 fc0befb4aae4b7f0eeb1c398fccea03cc795590e09db6628974520091fcfc516
MD5 d7fd711e5e5f73da110115ce98beca0b
SHA1 a04719d38bec9a97b8f098cf29bc863006c43a33
SHA512 e96b14c280a83d4a0d5eca3ce6af8ea5ef679feaa6b70c2775ace90c4ab54682c74d620a681ae3bc09baa534ae643dc7551b8b650f7d84658f38a8934448af87
MD5 SHA1 SHA512

Submit Download

winmm.dll

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Among Us\winmm.dll
Size 512KB
SHA256 ba37009eef6c041bc6d0a271c13679fb9e14a005bd7e038cee596cd4064cf8b3
MD5 e59aac558d9f9c5d1312ac24d09c51d5
SHA1 2f11c4b00f5f92d4466348f9501aa657c9bf6fa7
SHA512 1c3b357074d62d5ca11c92d71ffdacb4a7e3d6fb17cbd4b489e5bea0032cea43650a6809388e98e4b98256b477c6b5dbd8fd2c7f4e3e08af00ef68e0ed4406d0
SSDEEP 12288:XQxOD9ZC0WKOy8zMtJKpBmpMgBNwQuQmMzWq0hNwnoAZwl:XQxOD9ZFKpB+N7JmMzWq0hNwnBZ
TLSH
T1DBB47C19A2A843B8E577E178C897460AE7B17486233196DF43F046AE1F277F11A3F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Read Me - How to Run.txt

Path C:\Users\Admin\Downloads\Among.Us.Gamdie.com\Read Me - How to Run.txt
Size 625B
SHA256 8abcd61f34ba4af4c61d9dc10127a150b50e2f167f29173042024c71d93bf69c
MD5 1ecca4fe789555596d7d24ba819a010b
SHA1 11adb6d74bd7ef7b678c1cb63ff24166653c2bdc
SHA512 9ae9fe0bf4bccac234b47f63f9f08ae954c43c53c431ce004c42d3dd18051d5f2a2eed245171e7a1e5c8cd564e14995864ff77cdc02a15e350361f8bc729f227
TLSH
T19CF078AF6E87E37257A0C3A8321F25C0FB0A8148F22E88527E1A425D17585D6977D4AE
MD5 SHA1 SHA512 TLSH

Submit Download

XboxInstaller.exe.crdownload

Path C:\Users\Admin\Downloads\XboxInstaller.exe.crdownload
Size 13.4MB
SHA256 ba30ea16cd8fbd9209d40ae193206ad00f042d100524cf310982c33369325ca2
MD5 33c9518c086d0cca4a636bc86728485e
SHA1 2420ad25e243ab8905b49f60fe7fb96590661f50
SHA512 6c2c470607b88e7cd79411b7a645b395cee3306a23e6ba50b8ac57f7d5529a1b350c34e19da69aeb1ffade44d5187b4a1ef209a53d21a83e9e35add10fc7867d
SSDEEP 49152:W/XzWTJmbjeHLKLpyNpaQ+69tPvGUmskDXs4Awd9CBqcUiInvlT2hPnXiwzYJ33S:W/EmGrKL2pllzP+UNkEARmzY1C
TLSH
T103E6A5784809DA85C372D7049EA9F8886D35F80164F974D8A36E83FF94BEE74DA39407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-2629-0x00007FFD50860000-0x00007FFD516C2000-memory.dmp

Download

memory/1008-2476-0x00000000168A0000-0x00000000168C2000-memory.dmp

Download

memory/1008-2447-0x0000000006490000-0x00000000064B6000-memory.dmp

Download

memory/1008-2446-0x0000000000810000-0x000000000157A000-memory.dmp

Download

memory/1008-2477-0x00000000160C0000-0x00000000160C8000-memory.dmp

Download

memory/1008-2449-0x0000000006470000-0x000000000647A000-memory.dmp

Download

memory/1008-2448-0x0000000006460000-0x0000000006468000-memory.dmp

Download

memory/1008-2461-0x000000000BAA0000-0x000000000BAAE000-memory.dmp

Download

memory/1008-2460-0x000000000BCA0000-0x000000000BCD8000-memory.dmp

Download

memory/1368-631-0x00007FFD4B550000-0x00007FFD4C3B2000-memory.dmp

Download

memory/3796-2636-0x00007FFD50860000-0x00007FFD516C2000-memory.dmp

Download