hxxps://gofile[.]io/d/PtHrTE

Analysis

user interaction
yes
max time kernel
122s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/PtHrTE
Sample260720-st3eaaev3q

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
67	api.gofile.io
23	api.gofile.io
24	api.gofile.io
27	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290347642231222"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	TheChoicerVoicer_0-5-1 stable compatibility.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{E6B41F42-CEE1-427D-900B-A527FEA63E44}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	TheChoicerVoicer_0-5-1 stable.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	TheChoicerVoicer_0-5-1 stable compatibility.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5276	TheChoicerVoicer_0-5-1 stable.exe
5276	TheChoicerVoicer_0-5-1 stable.exe
2260	TheChoicerVoicer_0-5-1 stable compatibility.exe
1800	TheChoicerVoicer_0-5-1 stable compatibility.exe
1800	TheChoicerVoicer_0-5-1 stable compatibility.exe
2260	TheChoicerVoicer_0-5-1 stable compatibility.exe
1800	TheChoicerVoicer_0-5-1 stable compatibility.exe
2260	TheChoicerVoicer_0-5-1 stable compatibility.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1824	2844	msedge.exe	86
PID 2844 wrote to memory of 1804	2844	msedge.exe	87
PID 2844 wrote to memory of 4264	2844	msedge.exe	88
PID 2844 wrote to memory of 4264	2844	msedge.exe	88
PID 2844 wrote to memory of 4264	2844	msedge.exe	88
PID 2844 wrote to memory of 812	2844	msedge.exe	89
PID 2844 wrote to memory of 812	2844	msedge.exe	89
PID 2844 wrote to memory of 1632	2844	msedge.exe	91
PID 2844 wrote to memory of 1632	2844	msedge.exe	91
PID 2844 wrote to memory of 1632	2844	msedge.exe	91
PID 2844 wrote to memory of 2072	2844	msedge.exe	92
PID 2844 wrote to memory of 2072	2844	msedge.exe	92
PID 2844 wrote to memory of 2072	2844	msedge.exe	92
PID 2844 wrote to memory of 1988	2844	msedge.exe	93
PID 2844 wrote to memory of 1604	2844	msedge.exe	94
PID 2844 wrote to memory of 1988	2844	msedge.exe	93
PID 2844 wrote to memory of 1988	2844	msedge.exe	93
PID 2844 wrote to memory of 1604	2844	msedge.exe	94
PID 2844 wrote to memory of 1604	2844	msedge.exe	94
PID 2844 wrote to memory of 888	2844	msedge.exe	96
PID 2844 wrote to memory of 888	2844	msedge.exe	96
PID 2844 wrote to memory of 888	2844	msedge.exe	96
PID 2844 wrote to memory of 4980	2844	msedge.exe	99
PID 2844 wrote to memory of 1500	2844	msedge.exe	100
PID 2844 wrote to memory of 4980	2844	msedge.exe	99
PID 2844 wrote to memory of 1500	2844	msedge.exe	100
PID 2844 wrote to memory of 932	2844	msedge.exe	102
PID 2844 wrote to memory of 2872	2844	msedge.exe	115
PID 2844 wrote to memory of 2872	2844	msedge.exe	115
PID 2844 wrote to memory of 2872	2844	msedge.exe	115
PID 2844 wrote to memory of 3172	2844	msedge.exe	119
PID 2844 wrote to memory of 4412	2844	msedge.exe	120
PID 2844 wrote to memory of 3628	2844	msedge.exe	121
PID 2844 wrote to memory of 5412	2844	msedge.exe	122
PID 2844 wrote to memory of 5412	2844	msedge.exe	122
PID 2844 wrote to memory of 5412	2844	msedge.exe	122
PID 2844 wrote to memory of 5480	2844	msedge.exe	123
PID 2844 wrote to memory of 5488	2844	msedge.exe	124
PID 2844 wrote to memory of 5480	2844	msedge.exe	123
PID 2844 wrote to memory of 5488	2844	msedge.exe	124
PID 2844 wrote to memory of 5488	2844	msedge.exe	124
PID 2844 wrote to memory of 5816	2844	msedge.exe	125
PID 2844 wrote to memory of 5816	2844	msedge.exe	125
PID 2844 wrote to memory of 5816	2844	msedge.exe	125
PID 2844 wrote to memory of 6044	2844	msedge.exe	126
PID 2844 wrote to memory of 6044	2844	msedge.exe	126
PID 2844 wrote to memory of 6132	2844	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/PtHrTE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd9d7fc188,0x7ffd9d7fc194,0x7ffd9d7fc1a0
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,7653235270372627469,14923716259129086154,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,4910383904486994618,380013461974668806,262144 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,17231794842453224741,4146651912873065350,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15451510241200810923,15886635407688250438,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1238316682851860351,1726730647719617471,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1068176926167034997,1357059776738759666,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5554690122501276484,16301566149004121430,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,10662993625315555227,11956581668962304859,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,10318751098930970295,12145402936566954930,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,17006293861654601243,17927303414772744647,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,9114429101688280630,7614845247438562518,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,9114429101688280630,7614845247438562518,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4368,i,6196065709986861487,12745185385203598513,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6261345186288166917,7338845305163505532,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7737431705890531517,3054032526899452042,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,13653334435797505628,10027998793027243926,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2868,i,2242850101591547499,15123400846286645043,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14762323119674557404,1711667608443903911,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6220,i,9405723312232470386,3940718721787845606,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6184,i,7181563957449728830,11717620750853897313,2097152 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17550367398500062331,3259484940720299245,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,12539380282019044827,9307018234053381573,524288 --field-trial-handle=2316,i,1807595723997329279,6232875906167162641,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5720

C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable.exe
"C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5276

C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable compatibility.exe
"C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable compatibility.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable compatibility.exe
"C:\Users\Admin\Downloads\TheChoicerVoicer 0.5.1 (Windows)\TheChoicerVoicer_0-5-1 stable compatibility.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d3ca5565bfd8ab10860d03315f2ee4327f2e6a4dcf1219b32465e0db0e288ac7
MD5 21c0dfd7dbf400841a63a604bf7883fd
SHA1 f10e84940c26071616517fc62a1d1c2f27a2f91f
SHA512 29ba4110d467518ef2c6d25fc519e53cfe464e9ea4e10bcef9cc02bc6f1dce68041115d1eac5a7c9e5a86c9d497145638017244cbede90d69d8a25c2e801b039
SSDEEP 48:eQELv2NyFuYcpW6nBgSLtFHfNstq+scILNQnWfBkSiQ8lIOORiicVS53n3S:M7+WgpDnBRFlso8ILN2SiQ8llTVI3S
TLSH
T17C81C7C506418151E36912B3D6F096DC37F1A0F0CEB7AD8592468A7DA9BB731C917B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a28242fc110dd5b279b9d727dc11f39f5bfbd47d5aea14bca95f4ed5391d6ae4
MD5 285fdae8b156e97d5e0d1f0a6d78e535
SHA1 e1c0da1493bf76b95ae52cc74c4896760c3cbf18
SHA512 a720500a01b38e3d9d279e4ae0bd29fbebefac01a7184f86ded7e9e09d629ad41f91b598a3e248b248ac32487306e35600385ad85fa898814369279b080e4a3c
SSDEEP 48:8tjnvjNyFuYNpWInQLtFHfNstq+PMoNAnWfBDSOQ8sHOjRiiZoP53nrL:MjvJWRphnMFlsovoN9SOQ8suHo9rL
TLSH
T1FE81C5C706A14151E3A19573D6F03ED836B2A1F0CE378E859246A57DE9BB732C82774C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5887b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5887b9.TMP
Size 3KB
SHA256 bce97c2f2017dc8f691415c0761603b3d7c136c07be818df9547472235320316
MD5 5ec9225601f82eaa310b7843f371cb85
SHA1 64e3828b09a0c9ce2332326e74807e45b773bdba
SHA512 d0024d43775e69467880dfd12a307ccb32c47e3b55b9ba35a27a17af15271649d1778c054473b704ba341e32a84218910fdcd48326a4ab53f512de4c4455d4d6
TLSH
T11761D7C506820541E7611173C6F01AC836B1B0E5CE378EC5D286987E9AFB732CD2BB4C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e1ea7c1f24575096465933efdf5b096077159a3b32c5745b2f5ab102b8ce511f
MD5 147e721e9d5aafba8d36d39f4d6d8e4f
SHA1 1f127612bb3314571ce8f82d7e6366a182deada2
SHA512 b73b4b844479be89632922500ec12aea9e018366d079babd2e640e9abf5e3f68f24f834d64f083dc5accf050bd8b1b8f756ddfa1971d75cf89a2d2e920ac3b81
SSDEEP 3:MsEllllkEthXllkl2zE/ljBJ/t:/M/xT02ziJ/t
TLSH
T12D440405FFC04407C5101330C051D7503370D410071357C334F514335CC57404C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e29bc5feb1153e9e4dd92478cb4319eee5e1d1f4aaa85312dc374d4b946a67a9
MD5 cef774cc883a565b38f377db2891fe2f
SHA1 76949fdffeb48e32a14d16c29defbd6eb25462a0
SHA512 dca552ec0df2cbd466df0f224ed0a5e1c5ef0d0affa9f81146fd7388d96461ec774f1e699944cb5c9949d3f6b161df04478f51b0b01c0b8a4f3f861f11ea4fff
TLSH
T1A8519AF3C3E8916D8D2156F4AA14AE2BCE5C1426832C7A798AD4AE17A3F3931D10574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3cec12d06f2c81254d88800913e458e589c8c71ff3d7a0b2bf54c3b509da9fbe
MD5 30d827c50a2876802b9722ddd6cf6146
SHA1 ed6bb0e74a688602d05bff5c283d73efc2db3811
SHA512 4e34012ab364245defdf3d716823772f7e6cabcf410eed8e5a0aadaf716fa36122f0060d65ca7ae69aad4c09564e09e9c88088e61f2ca9611443f625f7061917
SSDEEP 192:sxZLRhyM/jK1Ml8MkR/fAs/lsSIdpjlUHW6+WNeNr/Ywpy7XIgrJ:sxZL7MR/fAs/lsbSHbY/89
TLSH
T15352F916AA349D7BCCDBD209BA55BB53D6F91472D2901E44A9FCCA0C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 15ca0d3f544d59cfe669345ed34d9e683d22858a42e85580d262e0aeb0c80639
MD5 e8bb3cc0cd64c0f5b1135a5e30fe2f51
SHA1 a628d6a3a7405d741beb3fa990ab5dc416e8714a
SHA512 2897fac77350269cc75977449d4680c63e1e7683829b31fdd9329f5806c850449d2aef6f5bec49f7782f6f9af09fec7d1eab5864dcab586e937c72d3b1bf1cf8
SSDEEP 192:sxZLRhyM/jK1Ml8i9R/fAsyWpVYlerIdpRlvHW6+WNxDVrZYIoCUpIgbHJ:sxZL7dR/fAsyWvYle0DHbHZG1
TLSH
T1D862C616AA345D7BCCDBD209BA55BF53E6F9142292901E449AFCCE0C05E6BED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc512a39ae66ff2b2fceeed28d752f365b16a7ba675144d0e8dd181e1bacca85
MD5 a112e4db9530c6c393e30a1074b1a331
SHA1 701c2fc23b8b912a2e462de9a8265d30e6b46a08
SHA512 7a5ca8ea05896f08cf93e4466f790e332912fa6cf35207baec2e925332f712a17e15f47afd9d33cb95685ffe647b4af336188d6cb58cfaf6487af1dfc77d07aa
SSDEEP 192:sxZLRhyM/jK1Ml8M9R/fAsAleKIdpjlvHW6+WNeBXXYwxo7XIg5HJ:sxZL71R/fAsAleD9HboXub
TLSH
T18E52E816AA345D77CCDBD209BA45BF53E6F9547292901E44AAFCCA0C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1c79ced5c5b4423094a85d301b53c53dbc47d39a83e4dccc074f1597234a2733
MD5 9c38928ae998ad29f8f4766c5470cecd
SHA1 18b37e419c0190aa035bfd03e81aaa2c6712379a
SHA512 f00881838fcd1543a9e4431d054cb9d813fae69e2306fea46e5564f4aa8fc4733320f550abaebb40a146de7650d5978f98819000e8cbe65795b77a298edb0c9b
SSDEEP 768:KD4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dprohUcwa9:KD4jeXmWvmKLEu1jacPLZQdCZJ
TLSH
T19ED20A3B280CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 495143b6c6b3383946f41361bc205f1d625fcbd6e95dc4ea63d406142e4440b9
MD5 59a23f62d0f172edca2bd003521a61ed
SHA1 bd1d12b094e555b83fe5eba92c6f24784383ddb8
SHA512 ec3de869736bdcca7ab8ef3a16eca6f96b3d05cd674f592f7dfeff31361c3e27088bbab27bd2fabacbc79da7baae34709456278c154e8ccb75517673b7126c10
SSDEEP 48:KIdItKmIoXyJWI3KvqwaidGS84EkU4PPIPakKeBmkkKy0tv8y5yAQtcwmOO+z:KIdKKmIyaWEKvq0viK8QKRQtcwmOO+z
TLSH
T1C091A24171FB06023DBD29189664C65B57927163305CA92B3BF814B28FAEE261CFCBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8a42a63-ec8b-403c-8ae6-d3635ea2a0ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a8a42a63-ec8b-403c-8ae6-d3635ea2a0ee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 31999aa0277ca2a4b04d2ebbec2d4f3db91b974ac7be708c433e6d8c55c13cd3
MD5 387b9e7d306cfa07ce7bbecf65d38159
SHA1 4e3d94e5f1fa8ef120e78c9621e39bcdace1603e
SHA512 887d346c1f2b6295a0d2adc3dc5e7b3e0fdf58716b264bbf2c524a790338026434e6f01de16e8b8d15e93822dc35ee2cafdb123d58250cd948f2363d0b5e7af2
SSDEEP 384:NtNn/s3n9SfsNq/Dm6rWf+c8sJ8Xl+2eF+7OObjI9G6w7V:Nj+9UhG72llQ+729MV
TLSH
T167929D36AC289D774DD2D695F04B36275EF8517B97C63F88D2ECAF0C04CAAAC1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 27a233bb83a9459ffa2d77139158413df73526b32e9d62c4bf040011e30a5850
MD5 6db5e02fe5ad8ccba863b53ee8d117b6
SHA1 62c14beaf93bc4da9dd677c7ae5f113610c67dfb
SHA512 43d8509810fb2905f585c517aa0313e41973d74a01e91c5de79a0ec7347a3f1bc432205ac63b49eceb15470d64b3a34006556eb44949d6321ae984186b357307
SSDEEP 384:SiF1tNn/s3n9StrsNy8TUNTUlIlcDm46Wf+c8sJ8Xl+2gF+7OObjI9G6w7V:ZF1j+9WHwgnG72llO+729MV
TLSH
T15EC23AF658D78936C99E8B43B33E2D124EFCC167B5856A84B3D85A0CCC861BFC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7b5955705f5544bc1f6cfa0211a7655fc31662e0b92397a2bf64b95bf4c0de8b
MD5 f3ac33a618050a9e1c31b0b9ddfa1883
SHA1 7a8eda06342cee1ae1bc09b02752a7fab5513625
SHA512 2aab9b98904053d29a0d158386b748454ca7af111125de52e403e70cce2f9f3f928b251e9fbb11e504d2dfc848e0d640b2254254bcecfca7bf0cc08f9ecc12e6
SSDEEP 384:SiF+tNn/s3n9StwsNd8TUNTUlIlQDmPRWf+c8sJ8Xl+2jF1TvKrSBtZ/sZqKkBq3:ZF+j+91qwgBG72llRtiSyZqtq29MV
TLSH
T1E8F28EE284D78DB6C49D8BC7A37EAD0659BCC137B5495658B3E86A2CEC4B4BFC301810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6f28e5486f8484476ff452a821a2e280675cc4a5b83030368eca4b5dcc37fc8
MD5 1254f5c090ffd7ba73c1035537ec2683
SHA1 630a4e141b4bd16adaed4a8b21a08178550615b9
SHA512 e9936ae7dc3e4f6d50d4d8da75507843955f3ceebc07d371b59b10cd92bbf8d0826d65318cc20fb4383b93a877d60ebff0f8c442b7e39893ae118ec74e31a5b4
SSDEEP 192:EONC6hZ0QmiUy76pc/+jVKjzorDoJmt5wOZ+kUU6:EONC6oxpu+c8sJmc2+BU6
TLSH
T15C02D8356C686C778EE2AE45F48727235FE4212BEA956F84D6F85B1C00C779C2342836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 996cb11d1a9e3498f94dd1ad6924307ea821e77557b63795fd4a12ce2f742047
MD5 9f0243bdc74caba38395fc69349a525d
SHA1 4aeabf78362553eb46f1d27ceac99ef50c6394ad
SHA512 926581021e789f65716c548302ec9584d86ec674571c19bb877e7da37daecc3440903a097dda35eb8f7feee5d10fa2f4d798f79a9629599ac4160c9dfd0fda73
SSDEEP 192:eON76hZjQmiUym6Cc/+jVKjzorDoJ8Xl+2b5cOq+1qGU6:eON76hSCu+c8sJ8Xl+2G9+7U6
TLSH
T10D12FB36A868AC675DD2AA91F48731135EE45127EFC67F94D6EC1F1C00DF6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 16166bc963cc26f167f5324c5c6254b6cc9b783cd06e75dd73e03745685eed71
MD5 00ca5c9ed0a6b12ad97e50679c586da1
SHA1 507b73bd94fdfdb87c81594a43493577dbedd586
SHA512 f952eed466c4d06a940b7b0afb980eb7915fd04ddfaf4424ea29493604cfc703a3689134c4b5414ebe4b5b2a61b4068d7e38871c21e1c273be98bc8a95f923de
SSDEEP 384:+tNn/s3n9SfsNqcDm6WWf+c8sJ8Xl+2eF+7OObjI9G6w7V:+j+9U1G72llQ+729MV
TLSH
T118928D3668289D774DD2D695F04B36275EF8517B97CA3F88D2ECAF0C05CAAAC1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4bbd575e3abedd0cf4ab2608969999dfc185316d5f4e24d61209f99138f19008
MD5 b4d23b425eaf853761285a39238d1cfc
SHA1 8898c4de2132715bbdbf07f2bd28eb59a80ca5b9
SHA512 2c61cc9e0ba39bd2c2194cec0efba7f52638f22dda3704a92406d73885b3e86db11cd0c5b78d67cdea73a838a63c88f2097f625afa0b1f71fd08c112e13bac09
SSDEEP 384:+tNn/s3n9STsNqcDm4WWf+c8sJ8Xl+2eF+7OObjI9G6w7V:+j+9Q/G72llQ+729MV
TLSH
T13D928C3668289D774DD2D695F04B36275EF8516BD7C93F84E1ECAF0C05CBAAC1306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1680d1cb-dd80-4c20-b81a-6dc720c50f21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1680d1cb-dd80-4c20-b81a-6dc720c50f21.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 61e21e55e3c622b8e322f7c7653e20cab078e083bf8cddf7d9608834c61c3691
MD5 fb84f176edbf238133cd56fa722af325
SHA1 885ee6bb82624abc60640674f0ba3352f51a4781
SHA512 dee9590470695e922b24b22d28449937cef075d314c0ba6e243fbbd1061a196b67e38bcb9cfac775217b49b80e19b1435aa7e770f0d71d1fba2d45f392f5f6bf
TLSH
T123411A58BAFA1048F3B7BE566BF6A86D447FB8772E06D05D00110D4E0A36B44D872B37
MD5 SHA1 SHA512 TLSH

Submit Download

ChoicerVoicerTutorialPack1.txt

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\game\packs_voice\The Choicer Voicer Tutorial Pack\ChoicerVoicerTutorialPack1.txt
Size 32B
SHA256 6b1552d280e9c7c79e40aa844589933b8708cbad50d5a6de7f1e619552eb2cc6
MD5 d28888da078e008fd7e4ecdd86168cfe
SHA1 26837ad83ed187281cada96634c7c6b23b12a15e
SHA512 ffba4edca2f65ad0e72ca7be6c4aaab397434fc4f897d2543fe479a6b3e04ac4cb5e4be5749f30c34bcee5b16cc72a7b87687672b5460ecb239f095e7bc79950
MD5 SHA1 SHA512

Submit Download

_author.txt

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\game\packs_voice\The Choicer Voicer Tutorial Pack\_author.txt
Size 9B
SHA256 82fb5b767fccc8b94e6ed27916114f531dbc85f7cb39149ef3e3c7f3ee726c20
MD5 d73406dffe6231b46fab7d254de82628
SHA1 831851506230a67ecb6428eef49ece68a67a1626
SHA512 d6a67b3a81d92b92e2e9288e644aac2de3de509e3c3bc59b0a9f5158b49c1db7732b40b74c25c390e8efe807f4b7996418ed38d0f32b76b27a6ab966a286867f
MD5 SHA1 SHA512

Submit Download

_subtitle.txt

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\game\packs_voice\The Choicer Voicer Tutorial Pack\_subtitle.txt
Size 65B
SHA256 6964c686565d561d34aee6c2b9930e651c462798cd2f98cd68f497c7c3ef4608
MD5 0324c67bf4f5a9c8e81d37df63fc4fe4
SHA1 1587bca4ba1a1a5cee508253c00f39e5db8a9136
SHA512 3990623b86e3e9e4c57c2266afbcd2f3802c1d87badfe0a7f69dff56e5d6a084d660f1a3cb94a1cbee86cbf2269562e6a7cb3daf88356fc2d758121f13e4e060
TLSH
T18EA022030BC803000C8A8C82BC80C0A30F0EC0CC880A20000E0202200300088020882A
MD5 SHA1 SHA512 TLSH

Submit Download

save.json

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\game\saves\save.json
Size 3KB
SHA256 0e76cdc8c0ed1c25b75a08d736ac9187bbf5d2fa7830217259b7113dc776ff87
MD5 174a949fc27e944a1841c3e26c5b2dc6
SHA1 170b5af929c24719b0711f02cc9563618f86e558
SHA512 54183c1e209561e20410cdc874d2305ef876e70dc60fe24a0c5bde68d7f977806a11498e351961246c7f5f36dd1d8352128870f4df8b4f0e45c3d222b554a40f
TLSH
T14271A917CA3D51BB05E19A6C9D6FDAC2456C014388693EEFED35292D130D2B320F6BE2
MD5 SHA1 SHA512 TLSH

Submit Download

fa7b62523470356194bdf709eb2639ab149a07cc.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\CanvasShaderGLES3\8af6f774ca840b65fef0fed71602ef100ba24af90bd9bb621aa2fcf3fa81aff9\fa7b62523470356194bdf709eb2639ab149a07cc.cache
Size 26KB
SHA256 efad629bccb93a187cb5b7cea89e3c28c554a2ab95b961c451bc7c17245353c0
MD5 6afd6d61244fcc86a3a2ac7248669def
SHA1 329edc230c4f423bc8bd63cd048979a6dfaba164
SHA512 be29eed8cde96dfeeab440cec84d98a2f6890abab4edcbacdf31876e3ba66281f35869161bd8d02e197bb747f13a77798ab5c4882e8aa79c3d31fc042d573350
SSDEEP 192:zj/7OnBKvUj1+8/ELNKx/BB+L/4xeFkfqqjPQEVHmjggU+BvmF0W0gTPJG6K8Evy:X7K+KJBB+DlPRa06bWeRBKp/Y2Mm
TLSH
T15BC26341B6A2C526CD2E613C8C87CA40F338D8E60CD2D74B768C670E1F6716A5B97BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa7b62523470356194bdf709eb2639ab149a07cc.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\CopyShaderGLES3\17c222f7a024bfdae87cda52425529ecddb66c00d4579dec6501810038493f32\fa7b62523470356194bdf709eb2639ab149a07cc.cache
Size 96KB
SHA256 e67f9568585550b4d05a2784c5e3e2931b2ec9182e0d3718418f76784e3a3239
MD5 356cd32e6a229d76c98694249f7156f9
SHA1 94cd1088010759cb0ac73af76ce7e7844b27c765
SHA512 1e47d438f600032af5faa79b9edb6fb53e61422bfb66b903b1c5832057c3bac4960caac241a47b20ef770c9b6175a73c0f50b6fba8b14a11b63197642a63885e
SSDEEP 768:D56rSPzRx6r5xbS36rdkr6xB5xSBN6OB5x9az6XSPNA6I8d55Eotdwxzt/6R5xDy:kOziDb75rxVSeOV9t65Bf5FMJ
TLSH
T16BA33F127A518412CE2EB53C4D868B49633CECE64DD5871BB44CB71E0F731AA5BA3EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0Y99tygskfXoRjWCWcRAxnPhbmE=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\0Y99tygskfXoRjWCWcRAxnPhbmE=.cache
Size 4KB
SHA256 b2b46f69f70bc9b98e921982a0c61fb56925e285d814b12dabcb6befb83a8864
MD5 47e5750f225aea5022dfbe24236f0f7a
SHA1 1c3dcbe097487c2672f13a99fbd5c2f773fd03cb
SHA512 41a38aa3baa833ea74e80cb7cf54efd4a7cc92f49fef2822879d075eaeedb956417b279bff736c4b9f4294800605f7aea44497cbac337cb937d3efa973733e31
SSDEEP 96:vtM5pFxeZnOzQmgblTren8EvvBYHtIK1Xa1SHaXmbMao:G5rxE+QmgblTr27vgtIKAS6Xv
TLSH
T118A19FEA8D562CEB90A44A7F0A28120516DA4FEFF40D12019D79C06DFF6171E89DF5DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2GOddCii112uyHneWLyLxOIj3ac=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\2GOddCii112uyHneWLyLxOIj3ac=.cache
Size 2KB
SHA256 7787abde3d444891ffea75b4748175affb877fbd6c8b38e09be7c27c7f7aea51
MD5 aff5b670412713c2fbb1c6ee6f5a7a1e
SHA1 278829426c8207ff91365fbd12ff72b6bd93a08c
SHA512 d5af0276c281f527b6357bd2ca345a3f10ee59e66e680d686ea4987a9c4e5b35cfb55a1e301ab3b5263d392cd0ca8d7ccce296184fa78512dfdb628b2d44192f
TLSH
T1F8517EF4822AF0CAAD8473B06D54304571248E8FC76C173996C2638957A47F9C7DE847
MD5 SHA1 SHA512 TLSH

Submit Download

31U4SAc8eDLSt7T__8RdsmSgDik=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\31U4SAc8eDLSt7T__8RdsmSgDik=.cache
Size 2KB
SHA256 fb5c664881f8e47310b1b1c39b2584a6b44904bf2cc3ed891050e72759c82ad2
MD5 7ba48f877e283222f396e39de8ac60d0
SHA1 255b396a3725ecff3949ae125cc39dc299735b03
SHA512 e2b916d840bcf33be9328b3361cec8c16d3217a22a00d79a43f31983cbb96fcfcbccdf4352fbdae662d863379997b4eddab5bede2f43c8dbbda055ac32c70de8
TLSH
T195514C1407341D12189E7D2F4A141AA56C6FD9EE9CA1FCC94DE5FE0CD18961FFE08151
MD5 SHA1 SHA512 TLSH

Submit Download

4RGk3sx620rf3Q6wYPBHUO4SNMQ=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\4RGk3sx620rf3Q6wYPBHUO4SNMQ=.cache
Size 6KB
SHA256 0e438205bc265adbd30c6db6e6ad1542bea9b337bd5e906c0757b71bf7b28786
MD5 0d7c16a21c3467fa5a169433807f62a2
SHA1 da4acca479f4ef5b1940f2ae6b23200dc8410272
SHA512 c2884ae006f926f992e4bb236baf07b91bf648cee753002545fc69a514533e2b0ef61a07d6513caa6e20151591caba38b1e1f9e6d3931db92d27e225be740b71
SSDEEP 192:n4N5TzI2Z7bpD+2jNgKKmzGm8XGLYnwyx:gEqbUK+WUwW
TLSH
T125D16E4AD790D14492D0BFF90551DBC1023B4B49F8DBCAC21948FE459BD56B21A3F3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AWRzrqPgfrpSEzPKTRGyeWHZeD4=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\AWRzrqPgfrpSEzPKTRGyeWHZeD4=.cache
Size 2KB
SHA256 0fc7bad0d30b5b8280e85a86a947a34131c856d27c686131156866ec9cf62f11
MD5 9c33874104e7044eb400e58fc1a9a133
SHA1 2ff036c106cfc51fe3da9537c608f9817046a95e
SHA512 271253d792bbd40868e6bbd856c8df92c089abc643acdf2075324a25ce84bfe8f94ba2cb36f75aee3113036744aa4259da2decd45ecbdc6649df391c33b9bb04
TLSH
T12A412B02BBF12C0D69FA9426BC70A36410EB98AD0850F615E7D62CB5D5B3DB484872B2
MD5 SHA1 SHA512 TLSH

Submit Download

HcoNFT0Wlcj2LtFaI0LhMsvPJqg=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\HcoNFT0Wlcj2LtFaI0LhMsvPJqg=.cache
Size 2KB
SHA256 51fbbe1fb9b11d7764c01174aec70e24e9b49a2b66a0b1f1c6de00ae040b3523
MD5 5fe98378c815c1fb1ff7ff0115fb9bcc
SHA1 afe222504b1848b69008312bf620f6466265d3c0
SHA512 aa324b10705eaeac3dff76b7a79536fce191adf59b638fd7c721ff8f4d20b76b610a64c873e456323eb6f3241baeadb46a8c67417eef5ea9ae3414ae61113a64
TLSH
T18F412BA49D799A3362748C36E50C7166B9C874DEF19047344B864DC45C40B294DA0A6C
MD5 SHA1 SHA512 TLSH

Submit Download

IDF7Mj7UR_QedmBbdnDkO+6nlhY=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\IDF7Mj7UR_QedmBbdnDkO+6nlhY=.cache
Size 1KB
SHA256 acbe6a6b8afdb784f1d45b867febedc97ab82e888e153e793fb1b9fa4831faa0
MD5 64e79332645fb4e5c06d78e792aaf16c
SHA1 415906c2f8fccb70edac25f66dbc4e436a7b8591
SHA512 49e085767566d46d89a32f566e1bd574a466e2329e8e48cac413dcddddea57475d8ef5ecce098da0d51e91f9b4727003afefac6a4652936ffc2d0441793c877c
TLSH
T1124119A01FEDA5E1807BA9153F3568AC1E8C68106EDECA66E3F79C6340A0919C22042E
MD5 SHA1 SHA512 TLSH

Submit Download

Is+FB+I7GGP8O5r15+XoOIyTP6g=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\Is+FB+I7GGP8O5r15+XoOIyTP6g=.cache
Size 5KB
SHA256 740ed7f52c4891c5575ebbb0b4221feaf372924c7c126b7a53c292a0369bc6d8
MD5 6dccd5c9460434ec1c84fe8bcc1d239c
SHA1 121113e56c758dcf5ac1384cf46c585238a11092
SHA512 25afd5e1e9a2892148f6a3e19a95418f1b4c09d99e9fb21d48d6fdd1571d9e72594b34e31a9f1acd168dad67e606a180f22cefa5921827703af5ef8b50e5209f
SSDEEP 96:lmShUMbAkDyKdH6mCduH+PrpPM+pToaeROhQ0yHKLVD+/q6F3dWtUoyp:xhUMn+WOduePJMgTpeROhfyHm96FNWqH
TLSH
T16AB1AE2A2A48C08F58D77FEAC14801E4408C46CB6FC507D9F44927FDC8EDFB448A9266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LqZbd5f+4vvYXim5DASk3DC44xg=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\LqZbd5f+4vvYXim5DASk3DC44xg=.cache
Size 1KB
SHA256 59c46f0734069dc1bc3067bdfb68003ea8cb42fa3cd2219483f986ff99ac2473
MD5 db2846e658fc693abea7cf24bb8498f3
SHA1 6dce6f339d35202c382b921000ec619c4e4c7d9a
SHA512 f5f0a686a99580022d6d9c11bf0404173be342cc2b0dd3897acf9701777e90984f675f35d6867ac752bcc1294d053f9911924ddf37f3a4f6132d71179173cf73
TLSH
T172310A21DD046B35A095F1EC200882D4A3F6FA1A42A8A52D2BEA64301605A9459867F3
MD5 SHA1 SHA512 TLSH

Submit Download

SUVppPvAEyTCiYjgnYTGG33Jj8M=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\SUVppPvAEyTCiYjgnYTGG33Jj8M=.cache
Size 2KB
SHA256 e78476d971cf4f47c2fbedff0e5b56a064d1f405271047e5f93a80a444a606bb
MD5 f88241fc62ae2cd250e67399afcd931c
SHA1 cf1b887ae02c2774d4d0f45bc5e089cf19390b21
SHA512 6a3bf2b44fc3606bb739ac56e3438dcb200a9cf19eb374ec4e18dc5b149126ea4ea2194497d84fb6696a75fea83219157c6af0f2d9d10c840a90bd786913517d
TLSH
T1CF413C7948BCA932E36D61BD59BE824A800432078D1BBE52498F25A4A445FD3E92F454
MD5 SHA1 SHA512 TLSH

Submit Download

T6YKxQmci+vxGibQ4e5uF3W9LYQ=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\T6YKxQmci+vxGibQ4e5uF3W9LYQ=.cache
Size 2KB
SHA256 6ae95c664971d488be85512b074164c6559942e230c685dc4da9edaf7aee3c06
MD5 788c1fabfd809a6e351fe77954bbae71
SHA1 ed34ce79bb0ed7404ff85c430497bee70641666b
SHA512 ee0d2291e190d318561df543634a9e378ff38239c14d17c3607d6922fc7d37b202743198d85854bf11f2eb526d07b0bc88e205d2a4cd3747cb42af7f2895126a
TLSH
T1FA413836D00A82E2EDB29B772940558ED8A2D797DD87592571800A7BB5E10CC4182EE7
MD5 SHA1 SHA512 TLSH

Submit Download

UTUDRJUCG_MP1rt5KqJNl+Oq9iI=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\UTUDRJUCG_MP1rt5KqJNl+Oq9iI=.cache
Size 2KB
SHA256 cf882bdf956594c1778062a79d1633938cf00348f012768d31ef844ebc4f64a0
MD5 e9135f7a5b5d64291cdd9f57a12e18aa
SHA1 96227cc40895e734e05324c8590d1d194003ceab
SHA512 2cef003c5d7bf3dfbabe9781af26f7b515c862584555e623cc24b8f20e2aa1753fe9c6c58430fb5cd8d7a0381d3f93905626647d09466bdc4afc95ababba9385
TLSH
T13E513A1627E9747232617DABC079406E6E42D408FEC1253B322D939E00A6A5481F1CE8
MD5 SHA1 SHA512 TLSH

Submit Download

VTTpoBVADtNTMpehwCJhJeiLx6Y=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\VTTpoBVADtNTMpehwCJhJeiLx6Y=.cache
Size 26KB
SHA256 96adeb82c2b4221e180d643ed9ecf704101845f70f9a3aa65129cd9e9937a05b
MD5 49b51ad0387e07b9b4430191999b904e
SHA1 15fb8aa98d5c1324260f64443a123c592b95a557
SHA512 7339975f49ee568c5aeef1dffb92105612e75c623ddce37cb6b772df07841e63a49ffd4fbffd08b1a65b3069dd9f5232866d9058fcba179334a0c03751bbe1c3
SSDEEP 768:/QjINQp/5pVEve5/ng2MUtp3rzx69pZUSn:/HNQpBp2mngXUtZrzWX
TLSH
T127C2CF4646DAC1D4B2D04C2804BC1E75FA7A9D7F7ED1E0D20257AF920CEA8A3197B585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pGJ1hersiwH7MchJQGkGes7dGMs=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\pGJ1hersiwH7MchJQGkGes7dGMs=.cache
Size 26KB
SHA256 beba0edfff87eeb502a37b3785f0e1cebbee4ba025008bc66ccfc166990377d9
MD5 e7c0a6f2224d8e57bf86ff160c83028d
SHA1 a0bc4f2b0fdf3de5ada9a2034e0017abb7aabf51
SHA512 307f9e5c87b64931a3ca9fa2ee1c96ba257cde6bab13cb6712da6b5b761589f75610e8fd7e25fa10a6ea7f4dc01702f043a275f3c5ad852def369da92f05da39
SSDEEP 768:P3Ic0mjWRMMMMMMMMMEjZLqPqrM4eFej06XIK3J:vL4MMMMMMMMMm7mFejn4K3J
TLSH
T1A9C2CF1E0BFFDEEC1A130C9F09643EF3BF76A8EC2093647AA425515BA8C072645745DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r1baZ_3IP5C4nfL_HuPo7Pt+eNc=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\r1baZ_3IP5C4nfL_HuPo7Pt+eNc=.cache
Size 4KB
SHA256 ed1e5e2f4011925ee9fc71b0c759176b295cf041f1a47a304942cfcbdd70967f
MD5 549771ca4b8e17970fcf5984b5cf0aa6
SHA1 5af591a032af65895c89efa49b82a2b67d96da3d
SHA512 45d6142dc70992099e6868c469a1eb84d5f0977326f3884b5dbbe72a6f09d7f20656ee0e36a86d78a7a3dd6af207fe491168caf81bcd21d80b41deac279133ca
SSDEEP 96:EMQxlMJLNBJqQH65nt5xgw94c2XOpBw5uryE7dlQLquoQX5Q3LFF563:UleNBfIt5xPVdvFt7kLbAFm
TLSH
T158918F1AFC73537A55170CE89091D56F431ACDDFE4752C2B000E76ABF8A8A36F612505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfzmioTdFkJkE2nRywnfNft_Bls=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\sfzmioTdFkJkE2nRywnfNft_Bls=.cache
Size 2KB
SHA256 53475dc8434bcb5548efc83e369e5cc8f5942eeb27452faea97aea802c88987a
MD5 91ef07f21bc64045e8fed6fb62b2756b
SHA1 89504ac13075f5c8657f4080e0f91aab750802cf
SHA512 fc05698d875e24c84c31db2487054b1ef3f63f373379137ed1df6106ac5bccfc75cbd4e7551dc2f2e6018a9c4d4612a0d9bb44f1b798dd205b64598dc09c3e09
TLSH
T189413C81A16D3D9F00BAD5D6A7D16CA41E701A6D2D58FF6B363D74FFAC2042F2520760
MD5 SHA1 SHA512 TLSH

Submit Download

vpwVTI0e_p_Flhm2vXBI1SXaUaY=.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\EGL\vpwVTI0e_p_Flhm2vXBI1SXaUaY=.cache
Size 2KB
SHA256 a6b32ab3bb8d6a5b333f22965d9111cf8e8a02430570d4e10299a20ad645c228
MD5 d2fa9e8ff83b8fed1a2e54ff882b32ea
SHA1 9dc0810d9a8562f27607ec028fcd131a8f411770
SHA512 18a9daa6aacbcfae2a6b44510fe1ac16676f409180bea583e2aee49849a4de5073a800dcbd5d42aae95e6e3cf855e0b70a666b9850defa74daf8601bfde1059e
TLSH
T1DC415B02EE47FCF4AC3CD2F09896619508A8553C4E44F64A542B14AABF7C8DBE9A411F
MD5 SHA1 SHA512 TLSH

Submit Download

fa7b62523470356194bdf709eb2639ab149a07cc.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\FeedShaderGLES3\7584c1b3134a73b9da717c4bd08eea81d6cff128955578cd583cc7f1c9b588bb\fa7b62523470356194bdf709eb2639ab149a07cc.cache
Size 7KB
SHA256 5423183a13fd1f82e7ec4991a0689402409790cff6a7b2c7b1a727ece79fb08f
MD5 a1e0613f8b0f8a3877c489f6531900a3
SHA1 371a2de8cc233ca51c982875b067cf8ef41de953
SHA512 e0c467340be9d94df8dd34594a4389c2e9ed422690d652354da1f4c540cf11c6fe4dec991785005b0f0407e430731a0d153187b1947df4c2eed5849796c6a188
SSDEEP 96:ApRSUeh1N1QxEMyR48HXF1RgiESxKp0+c0/A7V5PKzlq3FDvLKG9:z1N+xEMyRhXF1RgUEp04SVB3FDv1
TLSH
T1EFF11D116B418112CF2AB53C4D868B06637CECD75D99971BB44C771E0F731AA5EA2EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa7b62523470356194bdf709eb2639ab149a07cc.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\PostShaderGLES3\207e56b566a6db292db2504d44070cc4cfcbba09791ba1de3a93122351c923e2\fa7b62523470356194bdf709eb2639ab149a07cc.cache
Size 15KB
SHA256 12311181a00538bb362dbb70a3cfdb2e5451e10dcebe81df882ed4597d7372ca
MD5 6459e7f90cbe4821ef9d972bb7927948
SHA1 882930539cb5a43a37807a8d3f8297c67090f519
SHA512 88e6a4662ccfe24bbccc0300db927300e137658ed168fd4c7deb4e4662aad53abd18291c0436365dd55aa22cbb87ba7259b0d701f24f41004eae2a1e6397c7e8
SSDEEP 192:lxxgX1N+xEMyRqXFG/RgUEp0gzX5vQMFIenh2VM0SVB3FiuYF6RjMpnX0FMUPtn8:U3v6RzX5BBh2VbSVJ8I
TLSH
T14972FD46B781C533CF1EA33D8DC6C7187338FCA16DF68347798DA6190E6316A0A529D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa7b62523470356194bdf709eb2639ab149a07cc.cache

Path C:\Users\Admin\AppData\Roaming\YeahMaybe\ChoicerVoicer\shader_cache\SceneShaderGLES3\a6b5efc0770736e46142b71563a20b08977d87a411b262d6fc82f50942c0ea69\fa7b62523470356194bdf709eb2639ab149a07cc.cache
Size 398KB
SHA256 9ca717883df8c45271c1550a9becba0ebe91d302a499bfc75a95658bd57192e8
MD5 21345b156df9f569aaff48734c2f2626
SHA1 5455ebedf40dc3c72a8297576e3a695ede8c0101
SHA512 e079362d2e8df767c0e50d61e33d73ed52b0a691911b524dc6fa80c29e25ca1f7ff44c3db8d90e24d77db277e023be97cd5d0d17f3df0d913d19e9676279f789
SSDEEP 1536:REN8PGdLc5QjmRGVvArHRSn5mXM9aKtEN8PGdLc5QjmRGzJMHRtn5mXM9aKoGEfp:KePGyAvxAjePGyAvVbGtG
TLSH
T11884A002B729F471F41E117FB486CAD3173854D86CE9330524A863AF2DA61AB56F398F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5276-691-0x00007FF6EEF10000-0x00007FF6F4D68000-memory.dmp

Download

memory/5276-679-0x00007FF6EEF10000-0x00007FF6F4D68000-memory.dmp

Download

memory/5276-605-0x0000023A30BE0000-0x0000023A30BE1000-memory.dmp

Download

memory/5276-606-0x0000023A30BE0000-0x0000023A30BE1000-memory.dmp

Download

memory/5276-607-0x0000023A30BE0000-0x0000023A30BE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads