hxxps://itch[.]io/e/44010735/thepeccato-published-the-choicer-voicer-051-free

Analysis

user interaction
yes
max time kernel
899s
max time network
801s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://itch.io/e/44010735/thepeccato-published-the-choicer-voicer-051-free
Sample260808-pf9dwser8v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3788	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306650592341332"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{628B46AE-6484-4BDA-B328-8CAEEB1385D5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2156	1036	msedge.exe	85
PID 1036 wrote to memory of 3788	1036	msedge.exe	86
PID 1036 wrote to memory of 5100	1036	msedge.exe	87
PID 1036 wrote to memory of 5100	1036	msedge.exe	87
PID 1036 wrote to memory of 5100	1036	msedge.exe	87
PID 1036 wrote to memory of 5092	1036	msedge.exe	89
PID 1036 wrote to memory of 5092	1036	msedge.exe	89
PID 1036 wrote to memory of 336	1036	msedge.exe	90
PID 1036 wrote to memory of 336	1036	msedge.exe	90
PID 1036 wrote to memory of 336	1036	msedge.exe	90
PID 1036 wrote to memory of 1052	1036	msedge.exe	91
PID 1036 wrote to memory of 1052	1036	msedge.exe	91
PID 1036 wrote to memory of 1052	1036	msedge.exe	91
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2004	1036	msedge.exe	92
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 2252	1036	msedge.exe	93
PID 1036 wrote to memory of 4604	1036	msedge.exe	96
PID 1036 wrote to memory of 4604	1036	msedge.exe	96
PID 1036 wrote to memory of 4604	1036	msedge.exe	96
PID 1036 wrote to memory of 3992	1036	msedge.exe	98
PID 1036 wrote to memory of 3992	1036	msedge.exe	98
PID 1036 wrote to memory of 3992	1036	msedge.exe	98
PID 1036 wrote to memory of 4712	1036	msedge.exe	100
PID 1036 wrote to memory of 3088	1036	msedge.exe	101
PID 1036 wrote to memory of 4712	1036	msedge.exe	100
PID 1036 wrote to memory of 3088	1036	msedge.exe	101
PID 1036 wrote to memory of 3460	1036	msedge.exe	103
PID 1036 wrote to memory of 4960	1036	msedge.exe	111
PID 1036 wrote to memory of 2260	1036	msedge.exe	112
PID 1036 wrote to memory of 3492	1036	msedge.exe	113
PID 1036 wrote to memory of 2820	1036	msedge.exe	120
PID 1036 wrote to memory of 2820	1036	msedge.exe	120
PID 1036 wrote to memory of 5064	1036	msedge.exe	121
PID 1036 wrote to memory of 5064	1036	msedge.exe	121
PID 1036 wrote to memory of 2492	1036	msedge.exe	122
PID 1036 wrote to memory of 2696	1036	msedge.exe	123
PID 1036 wrote to memory of 2696	1036	msedge.exe	123
PID 1036 wrote to memory of 2884	1036	msedge.exe	124
PID 1036 wrote to memory of 2884	1036	msedge.exe	124
PID 1036 wrote to memory of 1956	1036	msedge.exe	125
PID 1036 wrote to memory of 1956	1036	msedge.exe	125
PID 1036 wrote to memory of 908	1036	msedge.exe	126
PID 1036 wrote to memory of 908	1036	msedge.exe	126
PID 1036 wrote to memory of 700	1036	msedge.exe	127
PID 1036 wrote to memory of 700	1036	msedge.exe	127
PID 1036 wrote to memory of 2420	1036	msedge.exe	130
PID 1036 wrote to memory of 2420	1036	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://itch.io/e/44010735/thepeccato-published-the-choicer-voicer-051-free
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13772826086768423940,15157285483408165703,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,11618090438754630492,697383252234468532,262144 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,13023168916464519458,12538998232664251960,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14685434244696923508,10827707465557924399,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,12330067035143503590,15772246200413269751,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,15579495448081625823,17347855471250477094,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4881013294355513904,8963640580191290634,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,15424011765518583375,7429450192400045632,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3656,i,1566928944238683950,13069252904707729439,2097152 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15896739990226889715,6103191112483336661,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,13085545568817477568,2207960958659911657,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17219806990128874402,10853728119942047495,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17219806990128874402,10853728119942047495,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5845117127306165989,17327623221239338026,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,1687347526027235227,9282339510543511198,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,16855402650555371541,9032280345373724019,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,1491277831493583110,10591713231921253358,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,8733065816310865538,13625777825313904358,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,17157621550926280049,15066042077533895054,262144 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4300989636618438822,16135319616356680257,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,12167173168612997691,17990814036162013404,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7675954704466122551,11758897090325098230,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,8408721809043614295,17000210357497631718,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,283298200272741636,3948550335857844017,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16268437805616521388,2806658420382602344,524288 --field-trial-handle=2232,i,4927497388657424479,111902854159930225,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7e464f80-8e96-43cd-aafc-5dd3565c04d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e464f80-8e96-43cd-aafc-5dd3565c04d2.tmp
Size 19KB
SHA256 9f6b157fd62eab6a17100685677f2d38f6a90131c765450e2166e858d27e3185
MD5 b4bbbc4e1f9093c2f018911f5c252f06
SHA1 32b7f22000d9548250e2f1096afe7ace3049e21f
SHA512 528a987a5b109812f8bc14f97cc9104e0a300b34b9293786a230c5041f92318c43a7ad294ab0e8980e7708c8c0669cba0d7b7a53a659dd308c2ccb7f1f1f9a5d
SSDEEP 384:VZcIhsNLnZr5g4a9ndQcMPknTKwBODNZOCjKDx:thoghRG/knewBKZOcK
TLSH
T152928C706C7C6C775EE3E505F94735078EF88073EAD92B54D6EDAB1D00EA6A81306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d772b34fc6df7244ba1e69d8044c464734fe8b52ecceba46e9e3a0028224c3e5
MD5 b5ae2e0aa973d4fbcac650cd42e4e553
SHA1 41ea313a1ad4fd6916c71a7440272fbb527b682d
SHA512 d1846f8ff76b943e5accb04ba3fc063f344b89a8e36b78cacdd41df811cc105289856661a072413d0ac0539897545f87ba1b1c1e1180e2fca1c6cf501aa3a376
TLSH
T12AE020C614C5C39F9904654F6258930CCAD4360FA6C7AE4F1704CCC5314208066C3DF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 abdea63b3d5f80224bb906300fb8223e5a5018f2da9f9927a35f898a5114d2a4
MD5 48c5b9094b9f5122b0e4dddfc115022e
SHA1 a196a4e36065462f63351bde9ea5e68f536c9ec7
SHA512 773cb3c3399811983b99640539a5a0ce178dfed8d7a0c3c5741643cbab1d5814923a9bb720d9d568028f81488334a59301b1c471bba7449ea5ae14c78167aa98
TLSH
T19BE020F415C4C65DF940648B6678538C53C1364A97CDF90F5F0084CD7002480F793AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0f1e26d76b524663be6e7358ae052b541870639f4738d97880dfb58348dbc0d0
MD5 3580c9b08816a41d5f451a2969392f1d
SHA1 f45fb3a8d0148a14d6edafb2f72e542362d09a5f
SHA512 c7878003c37de129fcd894734dd2748b566c78c1225c51071c3eece293c8bd2271b7d6bc639db158492e35c4419c91d4108e4a234bf0f4c9f0eb1d20d8d28848
TLSH
T104E026E518CAC26EAA48A49F617C630CC6C1B65B9ACAB91F5B0485993003580A783DB8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8b8d71e4145187d459fbca50ab9cca4867004d6ee4c0a2e82d50188cdd984d95
MD5 e61e7b6f846f6b3b88735561791bce13
SHA1 f9ba36e5ebba6d1d7ba31925448b93dfeca0c626
SHA512 2ea43cddd29f922e68ca6320c4e6d0d726fef40cc8d220045f1b27abd6356cb00272bbfb0ef9ec1de929f6928949d9cd90a4f4bf67df2cd7ac92cd1392bbbd53
TLSH
T15571284C0122DCD1E3E256F1C4F2F245B4B1B66F7B779AA12670C9BC6509F726369C0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f25a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f25a.TMP
Size 3KB
SHA256 5119b76e79511beeefc5108769dd419a301a6922fd8fd2889d4bd1f8466a186f
MD5 b20ca897b9089987c3f24fe967177d5c
SHA1 8bc684604f07bfccbc99c849edcb114f17d34c19
SHA512 89c47fa79ae323bb426461c79662f46a1f53d8635e4ed23bc964bbcf6164e90c72d1c7b29c615c5dd9361a3cc288804a5b8554cc50d99da653a7dd4cf099b678
TLSH
T10571274C0112CCD1E3E256F1C0F2F245B8B1B26F7B779AA22274C5BC6519F726769C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c7266ab547b6a96c293efeb064672fbe7eb89c9d2aef2fb97b1fefcb64bf038
MD5 e1de848b958891165d08e35bd073f4c0
SHA1 ce1fd28d930f6262d100f363414987d9326805fd
SHA512 93828a915d0a92d022b7c6b10f4814e70e4cc3c40c0415c2ddc0df6f030d0f293d5ca1cb0eebd3fa27efeb5e6d542a5357683fbe979fabaa9c7871cc0774a42f
TLSH
T18631AAF7C7F4856ECA0156F0AA156F2BCE2D055A43AC3C1989D4EF1B93E28B5E20094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 917bb074853a0beab523e4b6dc0a49099ddcb1afe67110c6681efaf1d3646801
MD5 a552e0d76ab88b9974b9b8b288588dcd
SHA1 3ff6acc70c367e45c76e802092f5d68e11dc5ba0
SHA512 25accce893a8961ac599d5df1848ec6514480cd3c22f85f5b3efcc4794e5f136d6e5df09cea23cdb3d5769609c5451d6fb18568c950b20a0e9ed1f1154c291b2
TLSH
T1A2319BF7C7F4856ECA0156F0AA14AF2BDE2D055A436C3C1989D4AF1BD3E24A1E241A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3e1a45598a910e21b3e8cdff5d252f4f0acb7fc8a247e149020ddb35d778569b
MD5 d18f1097e2729477d6b19e4c46816e6f
SHA1 f89aa62b9d85b5526cbc5f73c8baa282f7699969
SHA512 16c200484eaf7fa92c5da67065e0b1b7d9a3d74d3d9016f7435cfec8cb43966556990fd4b3bfbd3a438cb62f96eb7f8a97e277bf02ec1bc3831681b1a8f35613
SSDEEP 192:sxZLRtyM/jK1Ml8Mkq/flsNH9oIdpHMlIHW6+WNE7w/YLmB2gIgrJ:sxZL7Mq/flsNH9ZhHbf/D9
TLSH
T15652E8216A346D77CCDBD209BA56BB53D6F50473A2900E54AEFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 478faca77c4f660e57651a6b421e75a76a90385bae368723763cdd497bd1553f
MD5 b6d790c926c9856cd7676fa49019614b
SHA1 184d33565a4a13cb272e15162c5636cebf931074
SHA512 1c9f28f994ff101c2fb999a310074e8575c841ce1a6a7afa196372b377dac06a0fcaf69d312f537f14d2547cd24a1585112945b1653919abb01a1c8eeca66fff
SSDEEP 192:sxZLRtyM/jK1Ml8UQlkq/flsgHVoIdpdMlIHW6+WNE7w/YLktogIg5+J:sxZL7quq/flsgHVZzHbf/FQ
TLSH
T13962E7216E345D7BCCD7D20DBA56BB53E6F91433A1900E549AFC9A1C04E2BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c93e1f59cf228f51a55ce1c23c85b5d20955911c7580be02fb0b40d79dbce4eb
MD5 ab8621019d32f989ffc5802e26c6bea2
SHA1 1d2488e452c374b50cf001cc721ed68c7f5adb90
SHA512 75c1443a11668cf86fe41c2b6827ad0d31bc63dafa4c52fed0ae1c8ca4ab30f153d41c6e39298db238eeb2ae0f0039bbd9cff19b3367173d3a30a90cd27ad9b4
SSDEEP 768:WUs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN9roTM:WUs6pD1WvxzWju1jahILIsN2TM
TLSH
T106D2EA3B680CCB7E4F841E5CAC2AAF966DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fe1854b600a7405fd54c07af0c389bc3487537aad9487ccdff06d6e49d33c173
MD5 eb70a0dc57e6ed1c1fa811ddb667e4d0
SHA1 6b9233a810a5fbb221d9a70c864bccb1954cb28a
SHA512 29c4be5b7312476118b96dacdd971ccc237c5fb8231733b16f8cb443d3fcbb014845fec31ae9f95e5ecd28dd26bef4fe626448557fa4721c7cbe2ed11f6f3a3f
TLSH
T152E06FBB2EA32830EDABE3E3283090B10641382CC800BC0F686AAAC354B03113802C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 48544753ce682f9beef1cb7eb057e272c0c982f9ad97623e64ba11732ea4fbbb
MD5 f26ff5454932ae9926377409e8712533
SHA1 3399298c1cc130d217dc406ced8f169b2700ea73
SHA512 34f551b30970f5307a56121a54cc0a7f47d46e8e323dfab33607119653fbfca72d4cfb51c35b3beaeb7bdb905a2343f9ebba822c9c7e3cca1a6fcd81e3950d78
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkCatm68EB:ii9J3aJxLatm68EB
TLSH
T1E8E1F41232BB02523D3E691D935987676F427AA33418E42B37AC10B21E66E344DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d63943b0-0029-4f0e-8def-ce1b96a89430.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d63943b0-0029-4f0e-8def-ce1b96a89430.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c9c3e5197dc67787ce63efb0c67562036a50f12badff28ddb09a1b53a42fa953
MD5 c463b3e4778b725a34585d5a83584d3c
SHA1 2e7ba27ee1df322a8c1d92a6e24057c4ea7e6a42
SHA512 4b93cd505afd1f22db7db10ec2d8a6d7279910edb2e18f9a407e3eb288469c187d02d56d7ae49454780d422f8ed3352bf6586c11b1903a9822a28cbb9ac17ed4
SSDEEP 384:bZcIzsNL7Zr5g4a9ndQcMPknTKwBODNZOCjKDx:Dz0ghRG/knewBKZOcK
TLSH
T1D3926B716C7C6C765DE3E505F94736078EF880B3EAC92F54D6EDAB1D00EA6A81306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f4f8c0a97a1be652ece82dff164374025359e2f4c07c73d4ef34d9cc39f240d7
MD5 dea0ee1788f39e3939d1187391c4a306
SHA1 059036d756c66b6d95e4c309bb1b0cf9d5028be8
SHA512 94ad5cc718ac3ec76d263eaa150bb659af5f4f4bc4eaa77df10eaca1807032c37fc3b81e01bd6f826f57c4e93cb9b4f1e71b2aaa4ae03578aa3292121c6812f0
SSDEEP 384:fiFGZcI/psNV8TUNTUlIlqZrmg4a9ndQcMOknTKwBODNZOCjKDx:qFUxQwgzghRG+knewBKZOcK
TLSH
T190D219F148DB5836D9AE9707A77E2D078EBCC063F5952A50B398991CCCA61BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 441538e737d4847da3c70be215bbc3557aebac1806a8501732f87425d9c8ae59
MD5 a03b9df30a5ebf92b00cf06825b11ef6
SHA1 9469dbe2c5b7df393303431d247ac374c3f64f4d
SHA512 cc728b2bc692dbe4c62895fb4cd6940fb9ca8775dd01cd41b9ace4091c12e18b2e906edaaf7e15e3e88388f452c859e846f48de905baf777dd9f76079dbe1214
SSDEEP 192:qONa6O7+3hQmiUyDHGttb0h+FdPougGGCU6:qONa61cGt9ndQwtU6
TLSH
T19902E8396C786CB78EF2AD46F6873B175FA4113BE9962B80D6E85E1C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0fbaf6753a8d9a92cf868f2d87ca10c1366b5dbf686f51c1b170e7fcb0ea8730
MD5 75020efac8afc978c2ee93943844275e
SHA1 bfbef06384843d5d894dcf92708cd1e4551de093
SHA512 f22ee40e7392f8a93248b17a6bc2ffa1e0200ad8af3973d5840c0cf7b3c50e5d7590dc2c710f4997861452192de70eb68a25e44b840328418e5877a187714b7a
SSDEEP 384:AZcIzsNLqZr5g4a9ndQcMPknTKwBODNZOCjKDx:+zfghRG/knewBKZOcK
TLSH
T11F926B716C7C6C765DE3E505F94735078EF88073EAC92F54D6EDAB1D00EA6A82306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0f867570e70c50ac2289e4f969ff1f0317310d33ac56133511ad870f73f8ac55
MD5 1a4e387966f210f73d98c14b9d0fa0c3
SHA1 353d006878340f851b572722b15e5f049d1737be
SHA512 6d533c8d59937e4a09e52ddacf2f574bbf58cb23803402ea7c3db972cd52b1936e90f03824da28ff57e4c3d1ffc18d22e09617c44ddbc5b8d3bc4249727ceb10
SSDEEP 192:LONO6O7+33QmiUy+Hzttb0h+FdPoYRh2vdcNdrqRTU6:LONO6Xrzt9ndQcMikU6
TLSH
T19E1209356C68AC775EE3A445F58735138FA5416BEE8A3F80D6EC5E1C00EF66C234681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff0c3906de42b48f19bc6bbaaf8536d8f26daad69b395307bc2fa8ab74964da9
MD5 692f1f3287a94880202404efd5cb6906
SHA1 9bc9cd6f29efed26f6084776a0c4d850b1516924
SHA512 22f72a9d63812f0991c7dd517c8bbd1daf49d5ba57d016c05dfdffe75bd6c00ae77ae131cf84e2191ef2b7781002321120d4551691132f621e4c37de8efe76fd
TLSH
T16D412B69B6F91148B3B7AE569BF6B96D487B7D771E07C49D00110E4F0A22B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download