f7fbe45b707fcc317630ff1692f96a89412796f32ce643455722a2670d8b9826

Analysis

user interaction
yes
max time kernel
689s
max time network
691s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WavePad Audio Editor Software Express Edition Installer.exe
Size 1.1MB
Sample260421-jch5msa16m
SHA256 f7fbe45b707fcc317630ff1692f96a89412796f32ce643455722a2670d8b9826
MD5 d915afab7d8c063aedb87570fc986c25
SHA1 62182b8957f1636951f1d027d2391206d6b842b1
SHA512 4e2799ef2046b1e5b8f6a8397588d8b006dd93c432e7232020f375640a522da3be68426f3f8c95d9b763e0b0c61d8e8ba7887a2c33100aac68a959f98e178c5c
SSDEEP 24576:TtyhsrF+2DR7BWYpLDo44ZUdm2BWmp+jRF:Tks7V/m8T9AP
TLSH
T14C454A9127FC0539F7B70B79BD7A68610A36BC395502E69F098D252D18F2B1688F2337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
145	1196	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WavePad Audio Editor Software Express Edition Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WavePad Audio Editor Software Express Edition Installer.exe

Drops file in Program Files directory 43 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_851442606\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1360534860\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_969706222\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_969706222\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_637160229\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1936441270\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1699823247\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_847266265\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_623535072\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_623535072\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1212802544\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1212802544\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1360534860\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_435071604\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_969706222\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_969706222\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_435071604\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_637160229\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1936441270\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_435071604\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1360534860\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1212802544\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1212802544\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1559433628\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1699823247\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_435071604\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1559433628\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_847266265\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\autofill_bypass_cache_forms.json	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4764	WavePad Audio Editor Software Express Edition Installer.exe
6080	Autoruns64.exe

Loads dropped DLL 5 IoCs

pid	Process
4820	WavePad Audio Editor Software Express Edition Installer.exe
4820	WavePad Audio Editor Software Express Edition Installer.exe
4764	WavePad Audio Editor Software Express Edition Installer.exe
4764	WavePad Audio Editor Software Express Edition Installer.exe
4816	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wavepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wavepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wavepad.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1196	msedge.exe
5916	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212303089044820"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{FE24C1EE-9488-4ED1-A8A7-79C2C7C33019}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	wavepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Autoruns64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Autoruns64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Autoruns64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	Autoruns64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	Autoruns64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	Autoruns64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4632	msedge.exe
4632	msedge.exe
4252	chrome.exe
4252	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2232	wavepad.exe
6080	Autoruns64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	WavePad Audio Editor Software Express Edition Installer.exe
Token: SeDebugPrivilege	4764	WavePad Audio Editor Software Express Edition Installer.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeRestorePrivilege	3468	7zG.exe
Token: 35	3468	7zG.exe
Token: SeSecurityPrivilege	3468	7zG.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeSecurityPrivilege	3468	7zG.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
3468	7zG.exe
2232	wavepad.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6080	Autoruns64.exe
6080	Autoruns64.exe
2232	wavepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4816	4820	WavePad Audio Editor Software Express Edition Installer.exe	90
PID 4816 wrote to memory of 2472	4816	msedge.exe	91
PID 4816 wrote to memory of 1196	4816	msedge.exe	92
PID 4816 wrote to memory of 4576	4816	msedge.exe	93
PID 4816 wrote to memory of 4576	4816	msedge.exe	93
PID 4816 wrote to memory of 4576	4816	msedge.exe	93
PID 4816 wrote to memory of 4388	4816	msedge.exe	94
PID 4816 wrote to memory of 4388	4816	msedge.exe	94
PID 4816 wrote to memory of 3812	4816	msedge.exe	95
PID 4816 wrote to memory of 3812	4816	msedge.exe	95
PID 4816 wrote to memory of 3812	4816	msedge.exe	95
PID 4816 wrote to memory of 5108	4816	msedge.exe	96
PID 4816 wrote to memory of 5108	4816	msedge.exe	96
PID 4816 wrote to memory of 5108	4816	msedge.exe	96
PID 4816 wrote to memory of 2304	4816	msedge.exe	98
PID 4816 wrote to memory of 2024	4816	msedge.exe	99
PID 4816 wrote to memory of 2304	4816	msedge.exe	98
PID 4816 wrote to memory of 2304	4816	msedge.exe	98
PID 4816 wrote to memory of 2024	4816	msedge.exe	99
PID 4816 wrote to memory of 2024	4816	msedge.exe	99
PID 4816 wrote to memory of 2112	4816	msedge.exe	102
PID 4816 wrote to memory of 2112	4816	msedge.exe	102
PID 4816 wrote to memory of 2412	4816	msedge.exe	103
PID 4816 wrote to memory of 2412	4816	msedge.exe	103
PID 4816 wrote to memory of 1736	4816	msedge.exe	106
PID 4816 wrote to memory of 1736	4816	msedge.exe	106
PID 4816 wrote to memory of 1736	4816	msedge.exe	106
PID 4816 wrote to memory of 4232	4816	msedge.exe	107
PID 4816 wrote to memory of 5088	4816	msedge.exe	108
PID 4816 wrote to memory of 4232	4816	msedge.exe	107
PID 4816 wrote to memory of 5088	4816	msedge.exe	108
PID 4816 wrote to memory of 840	4816	msedge.exe	111
PID 4816 wrote to memory of 4764	4816	msedge.exe	112
PID 4816 wrote to memory of 4764	4816	msedge.exe	112
PID 4816 wrote to memory of 3992	4816	msedge.exe	114
PID 4816 wrote to memory of 3992	4816	msedge.exe	114
PID 4816 wrote to memory of 3992	4816	msedge.exe	114
PID 4816 wrote to memory of 1356	4816	msedge.exe	115
PID 4816 wrote to memory of 3992	4816	msedge.exe	114
PID 4816 wrote to memory of 1356	4816	msedge.exe	115
PID 4816 wrote to memory of 3844	4816	msedge.exe	116
PID 4816 wrote to memory of 3844	4816	msedge.exe	116
PID 4816 wrote to memory of 3992	4816	msedge.exe	117
PID 4816 wrote to memory of 3992	4816	msedge.exe	117
PID 4816 wrote to memory of 4164	4816	msedge.exe	118
PID 4816 wrote to memory of 4164	4816	msedge.exe	118
PID 4816 wrote to memory of 4164	4816	msedge.exe	118
PID 4816 wrote to memory of 4296	4816	msedge.exe	119
PID 4816 wrote to memory of 4960	4816	msedge.exe	125
PID 4816 wrote to memory of 1696	4816	msedge.exe	126
PID 4816 wrote to memory of 2340	4816	msedge.exe	127
PID 4816 wrote to memory of 5140	4816	msedge.exe	130
PID 4816 wrote to memory of 5140	4816	msedge.exe	130
PID 4252 wrote to memory of 4768	4252	chrome.exe	132
PID 4252 wrote to memory of 5884	4252	chrome.exe	133
PID 4252 wrote to memory of 5884	4252	chrome.exe	133
PID 4252 wrote to memory of 5916	4252	chrome.exe	134
PID 4252 wrote to memory of 6060	4252	chrome.exe	135
PID 4252 wrote to memory of 6060	4252	chrome.exe	135
PID 4252 wrote to memory of 6112	4252	chrome.exe	137
PID 4252 wrote to memory of 6124	4252	chrome.exe	138
PID 4252 wrote to memory of 6112	4252	chrome.exe	137
PID 4252 wrote to memory of 6124	4252	chrome.exe	138
PID 4252 wrote to memory of 5476	4252	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WavePad Audio Editor Software Express Edition Installer.exe
"C:\Users\Admin\AppData\Local\Temp\WavePad Audio Editor Software Express Edition Installer.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9P0KQX1Z0WM2?ocid=&referrer=psi
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff83892c188,0x7ff83892c194,0x7ff83892c1a0
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,763593908961727217,11840308668473557807,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4468685221334744612,4627224596720911567,262144 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,14480564707214395347,13260922983565117136,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13284898752769365308,743544494202626741,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2824093971210505095,7489894603218180256,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,15476233455995904040,5581527665862759604,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10436184338083041155,14167257539750888121,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,12929763850289462821,524449964260786760,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,9954716647563578148,7629876906155044543,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5428,i,10851520592927722896,16359391859106599054,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,10156959601559763858,12934703304893373694,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,1321105034028727224,5592234508708122179,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,4530560733705553812,15859816080884974513,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,4530560733705553812,15859816080884974513,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3920488361882202101,5125520094222923137,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,8301037000024228403,1727497139133588324,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,14017084667896839867,15013440569407604852,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,15708494869306873787,8706720121514912303,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4692473589229181118,8049093194256871294,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,17491078291782236392,4999318167146821262,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6260,i,980199582201336011,794864080884656517,2097152 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1971647453377639416,9736966574127488612,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,6993662008143311848,6466066845518927456,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,12166415270198125413,5555414672809686292,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,6294916098259208165,18140250450113848046,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,15240470331513854045,2788382215676691579,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8537282744541906539,1387282802199742611,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,16445574569025717603,3532191815488205784,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2628,i,6994473996351873210,13188659226018104353,262144 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,14825409647900986919,16916126834540159226,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,17509332308349983495,5989154728699631752,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14129274915116503311,4160450969050480288,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,6166260271922520969,11598746854357416410,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,3626794333232908665,2780088673094027950,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,14925802706793294085,18394804397970260977,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,5291945197331963933,13706070607826483939,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,8829072782669116671,4545436880849542687,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,15347204430001595453,9726863925234680252,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,13873482452970638028,7367936895923090106,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,3877877868291630413,7279776948117080627,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16579942689359414691,13627737411063877704,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,3453641718068012656,12351222728687679623,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11289182728977802146,11203071142438966951,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,6305891015705962811,13377886555812673559,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1652,i,13999644046977622643,18027500162663826215,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,2533458746794382781,7426318754268423315,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,8897045149343725141,17962962617358921118,524288 --field-trial-handle=2316,i,9020129478291140182,7381048094993780906,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:204

C:\Users\Admin\Downloads\WavePad Audio Editor Software Express Edition Installer.exe
"C:\Users\Admin\Downloads\WavePad Audio Editor Software Express Edition Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84254c728,0x7ff84254c734,0x7ff84254c740
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,915320669025987604,7568782227839832470,262144 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14532137178935318344,10773515361759782977,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,18340697748498013552,13334182353646209197,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5533245098295572412,6706693532106844068,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,17999768107042269970,17939713632516162690,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,16736583705256166740,1697932641068310169,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,8426153151969009464,1865673861286345700,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,9158064492687433492,13370255067051805644,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,14338512100530170882,2941865903369719920,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3428,i,5333159446194065824,6882674802031634137,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5924,i,12185895983581982765,10230352655787476688,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6040,i,3904586934240521505,12754456464923640813,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5544,i,16263723942266545780,3679037125336154532,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5792,i,13744704320775447532,8541125480246352695,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,18002096185899320670,4030885149291368298,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,15729684150312313183,10448528170144234396,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,4329805401326202864,380732059345826109,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,8982234435458904999,17273924272394356899,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4876,i,9649543713756391831,17218347746843953111,262144 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,16641829255686230764,11511720764947036908,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6188,i,2222102752094529042,666808901567075408,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6320,i,16563505164495406586,9869679156149350717,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6304,i,4242417007532915244,15771319526763738078,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6616,i,13663339936823534926,15236773747126464817,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3128,i,6132722029546192855,1102261564659840559,2097152 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,16082291938458132564,16835894894872711315,524288 --field-trial-handle=2092,i,4806846760065934625,3613996486581475368,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5536

C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe
"C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2232
- C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe
  "C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe" -exe WPTestSoundSourceOpenProcess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6084
- - C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe
    "C:\Program Files\WindowsApps\NCHSoftware.WavePadAudioEditorFree_20.3.9.0_x86__7kedsbyvzns34\wavepad.exe" -exe DirectXAudioDecoding
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Autoruns\" -ad -an -ai#7zMap17163:78:7zEvent22067
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3468

C:\Users\Admin\Downloads\Autoruns\Autoruns64.exe
"C:\Users\Admin\Downloads\Autoruns\Autoruns64.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x248 0x4b0
1⤵
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1212802544\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1360534860\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1559433628\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1699823247\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_188063609\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_1936441270\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_39063262\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_435071604\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
TLSH
T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_464938468\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_623535072\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_637160229\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_847266265\manifest.json
Size 165B
SHA256 605fad4274a41aa5139f0339fd3f0ca2483c9507cad75df8269c01c0d75aeb4d
MD5 6573c73b7ed1c6cbcf46c46f495e2b7d
SHA1 73e3c97a7c2503dce8ffd2c7c03a632471ec5afe
SHA512 e9bcf833d116faa47e992283af2aa3cefe7af97aca508cb1676794fe1562def41b43c254f7d8c06652b17bcb72854c0df1129c282148959420df606ee4f2e8a0
TLSH
T199C0801294011D7419CE47150D5CE3889723D716298070154BD7C21CDC3DC8B68F3B5D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_851442606\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4816_969706222\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F
Size 313B
SHA256 fb34076d04b25332b7f2b03dad5e5e1ae0dc67ad1a7ffc0a03fce7dacd83a073
MD5 5cec3ef41814f6e95876c1f84ca0139b
SHA1 330c43d4b79c57a22b1c5f03efd20d02516f6041
SHA512 b15ba8da592f2198a2a47c5468aadf105451a932dcf3863c8ca9620c913a8bbfc9d12542445d0b0079fe00db8c7f5b2941df02192b07114e3b45dd6654e95204
TLSH
T153E07D82F2F72CC73DB2886094F64F6A781104C300CBE83C3830999404DB6742253001
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_D84AA834FA79E192D6B55D4ECAAD497F
Size 400B
SHA256 09fb96bef74b9851ea14e9460a165757ccda7c09090f496c04052680ee4cfe06
MD5 f78ff2d52ffbde06ae252d2ae38cd779
SHA1 6aa9255bbbe625c17bbc266788e6f89efd4a8a94
SHA512 d3ed4059d6f677ea2c4c9221fc0cd26779d10a4a3749c2c5d760a5a714fe88a3119b7e2e2e0160702d949b0e4505db7a046c40078bd8eb6874088124c1bf07f8
TLSH
T1B2E0262077FA022CF1F0B67685D6D9758E2DE1220894C7B503D0048EBE12B40BC22AB1
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ee22c5015a5146ae1218b503c55628572032b4d34badf8bd5297a7c73af36459
MD5 011fbb59a80ef3015326c31f6220a69f
SHA1 2249032570fae700651bf58deeeb95414e346954
SHA512 c0819d8c79e173081a22ebde9d9d420d7ef3e8a87d6d7498c5ebe11ccd47665ba2ea5faba07cd34a49395fb0f4b578e3f1a98dbcc14837ca996e7a61d9f416e1
TLSH
T1DCE0E5AAC835DC2B09F947586155078EEB41231A2B90850B7A3E820C8FB4676068286C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 39eb5ba5803ab833e1669d5c6330c782d90fed2f3aef1af30ba195e51035e334
MD5 1a3c29a35dc44ce7262409c538561ea6
SHA1 a90883ad48829613368e9f934a4c22992bebe6ce
SHA512 a42885957cabb187f59a0acd1d6f7b4b050c53a62fbbf62e5697b0b9359eb49e655ceeb17d20ec33c8060e3be87037e124c0c7b7cebad9db4b0b46d9b331cf6d
TLSH
T1A941D804A9B4C631FF75CCB4ACE46955B3B4B80248030EE640ECF0BC86A23F4D61AB63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 1c56910aa5343fb3112ee7431d97ed5a572badeb06fc1a0a9d66c1d582aba4a2
MD5 82d61a7bbfb96cd83b863981ccd43065
SHA1 eb50704ddbfabe1adb5dd380639ffa812891a166
SHA512 4d536f5e19f4e488d0bf5744a4a429d493ab2109ccd0eb9c3b7c2126f1330448bf33b8c1f93be8f799059202dc5e5292fc486af17f76b030fad6f131ec3acbd4
TLSH
T149014604AEF0EA25CFB14EF0A8F0AC65E1540C021EC3173B41F851B45BB32F90B52670
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f6d45b0d2c39e52f5ff4de514c4cce20a8781d1cd1fffa662502ad8bf412c1a4
MD5 3d90066320f0a31c96e8bcb068895618
SHA1 de6a777a60d94c16d51968d0b683433d6c8210bb
SHA512 a85bc4b44e6c598e6a7296495b6f56a691d004b38ce12a048c06386d3ec96ee21cadb8bfe2203c4aeefcb235af8770e46ead506a503a85a4e996441184283afd
SSDEEP 192:D0uZitxwlAlraIaODEdPHSZquU5bNI5CaoTHpHX:D0uZitxwlAlraIaODEdPHSZquU5bNI5A
TLSH
T1FED199F783A4C56DC91196F4DB15AF2FCE290624032C3C6689D4AE5793E3872E21175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 511c7fec88fa518e7cf0391f34e069658494125cd9e97be8a398c6a7624dead7
MD5 c60c1548a41fb8c2fe5ad88abedc6b48
SHA1 493918220c038c41cf09fbb7f39506e11cb1d3d8
SHA512 4154017b13887a3ea5badeb955b3f03228c7586e80a441ceae8e49aaf8be9b302d27471210782bdff0fe677010e09041f8d4c7c3f23fc446dd965b01fee29979
SSDEEP 192:DqB3Z8dEaIaODPYPHmORuU5MNI5CaoTlM:DqB3Z8dEaIaODPYPHmORuU5MNI5CaoTW
TLSH
T19BD18BF7C3E4C52DC91196F4AB14AF2FCE2D0A24431C3C6689D4AE5B97E2872E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 011c98842cd0e8dca5e9b56d1f12add6d5c1bec098da4a5f57f36d5f84f057d1
MD5 fad6004ad1d8a5a61be4d72c97392aa8
SHA1 11edfaaad4b5857a8419d3bee37f280b508e96bd
SHA512 f70ddf2af6438d317e1ce2843771f9c75cdacde0df5ec4ba22b6ee70e4fb1b21b98929af8827cbfa29abd0110452ead62c024a53f5a36562dd93b453d508a431
TLSH
T17F316D93D6BEF857603C496B1D0DBC0D2DBAA43152C168F8DE6BC17C74D44E31B164A6
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6a1af8d8f68f2fcf83d58bded12e70b88a9dfe904c57fc334c32163d960f15c6
MD5 468b775b9e157ef15e08b417e8f4c4be
SHA1 23877e94ed4a0c7c7f15804703bf10f86ab86509
SHA512 64d607545408e411777e8c2b20831632205bf56e34d425b880d30a244fcb915f3355aeebbe1987904bc93af2d92c728b8bd538e3b97a6d35f7e568616d7752f4
SSDEEP 192:VRdcBzw+x6/8Cfv7CMpUPRpishgZNwa93Hsb+WNlLNsKwBbA0nDewKef2SBgdX63:VRdmzw3B3xMXSxweWIe+2SBiX6Wxg
TLSH
T14562C76FA910693B9CE7C319F952B72BD7F11026A1D51D84EBFC8A2C14EB5CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 45dd761e08e13eee42d664433fc45d085f81c767ee22aabf1a1ab1b136ab5379
MD5 01ed51714d73bcb41d71d0130dbe41b8
SHA1 efb5d37f8c47267c456fff601ef98f4f667d764f
SHA512 1e3a26580f2928ee21fcf01e0eda0191852c030d586d62ac5bdb3c0a08ad07085d3c4afb24ebb759d8e31d1ba968fa8548c1365d8974de8868e40cab8e7ae04c
SSDEEP 192:HRscBzw+x6/8r6v7CMpUPRpifgZN493Hsb+WNlLNsmF4bA2oKef2SBgdX6WXVyI6:HRsmzw3UWxMXAxwjL222SBiX6Wxe
TLSH
T1F552E82EE910693B5CEBD319F9617B2BD7F1102261D51E84EBFC8A2C14EB5CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 32b4d5e9c99c5de75a731391f8f63993ceeeee1fe43f91f3453ccc41be718ffb
MD5 89106747df8f99b1ecc8dabd252a4394
SHA1 dea3ca32f92e01f76d6edf16d28545d5037d7a7c
SHA512 e297a336eafde1100088a8e6bb8a93e8a20235d547f65699be4dc719fd5a5d8d97de93f5e6f25c236aab47922d34c4dde43f427378f8f764ca9d757bf9e43662
SSDEEP 192:HRdcBzgWx6/8r6v7CMpAPRp2fgu93Hsb+WNnmF4bA2MKef2SBgdX6WKVyIsnAUg8:HRdmzgfUWxUXGxwML2y2SBiX6WK8
TLSH
T1B052D92EE914693B5CEBC319F9617B2BD7F5102261D51E84EBFC8A2C14EB5CD211B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cda3e7e2cbbe5329c19b9e6a08561dfab7eac53dd325a54d841d0c017030a9c7
MD5 90e21fc5762cb9d9013341c5904cdbcd
SHA1 7b8e1c2d4875dc323803ee1615a8f51cf6050ff4
SHA512 ae794e812b1cf2e8bba1895e180b45c3dcb4118e7da40961288d9f930ecd9e9e841b7301dda3181850c5f900d67d76684576873b406557ed89cb25c7342eda5f
SSDEEP 192:HRdcBzwWx6/8r6v7CMpAPRp2fgZN493Hsb+WNlLNsmF4bA2MKef2SBgdX6WKVyII:HRdmzwfUWxUXkxwjL2y2SBiX6WK8
TLSH
T10052EA2EE920693B5CEBC319F961772BD7F5102261D51E84EBFC8A2C10EB5CD211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d4e4fa3c7b2c2bd5b4e4e3e761d4d9b038869ed2c9942ecdff93d879c5130c00
MD5 d675e0aeafbf83be9b97e7b5c987f504
SHA1 d2df64d5ab779a29fb9b3b63e4dc147d12991e6b
SHA512 1dfc4551308734fe2949c56b3bb5864811dfb618a8e01add067a483b1ca3f74a7cce319c4b84471dd8bcfee76ba30b3e715dd54557611d5fb84d535c45e623c0
SSDEEP 192:VRdcBzw+x6/8C6v7CMpUPRpishgZNwa93Hsb+WNlLNsKwBbA05X2eKef2SBgdX6B:VRdmzw3BWxMXSxweWS2M2SBiX6Wxe
TLSH
T13C62B62FE920693B5CEAC319F952B72BD7F11026A1D51D84EBFC8A2C14EB5CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 65c8f2672c7d6e13d0393bc4bd97e2be44a2998b06b4541440dc1e6bd51a80d1
MD5 e124263a9b8446ad6782b4d96d4ca96e
SHA1 6cb33f7fa8234ece65a727eff940008f971f23fb
SHA512 818a600f0dad21023a7b0ed8158645b4e1e4070d275ffcb769a262b90571dcc3e0179f4adc28e6732ce2a83676c1092b6ef169dafffaf51b35589f2d5d7ea227
SSDEEP 192:HRdcBzw+x6/8r6v7CMpUPRpifgZN493Hsb+WNlLNsmF4bA2oKef2SBgdX6WXVyI6:HRdmzw3UWxMXAxwjL222SBiX6Wxe
TLSH
T19252E92EE910693B5CEBD319F9617B2BD7F5102261D51E84EBFC8A2C14EB5CD221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 5f455ab0a8dc7fc52aae228fc459aa2b5ac8b5bd627a45207076c7b85b374ceb
MD5 e4bbc337cbb1054a6dd4cc0fbc7e5313
SHA1 0f8f143f78b54188a294b1e8197705244d4ac1d0
SHA512 f2791cbf86097ec9721b7da8f1234040883c6441b161f9b70d6257f60d8e3a5b5566839a92638fac768966b3bff8b8cd89af24dd85df6163af084204c1388318
TLSH
T1E7C01251C102E032C01603F81D93989D72ACDF39CB090388A3E06D3BFC35611C2252B5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e0f25869fb7e6c910c0cc404b0dc463d7b02fb2cbeb339d70dc9896d27e0bdd7
MD5 c3d08c04d105bb5ee61d8844935270c1
SHA1 ce7504c653dbf11c26be1db53c50341e7f5d2a5b
SHA512 9c148ac032013e44d80bdc0e5916c011d974096cc684a10ea4c4720177113fc8b29e75f42c7678930f26c00ae58733f68ec4c061d711ba8f748063cdff8b3a4e
TLSH
T1F4B0125180029652C02303F411820C887514BF148B062705D3E06DB2982A1918028160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595663.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595663.TMP
Size 96B
SHA256 5df498097b1a1bae2a2a7305f32b5c3ebc44a5ee5cc75734cc541d00b8937c2f
MD5 fee9fc083f2f95f531df711ace144924
SHA1 5c1fd408aa57e7696de00cb95be3b029f1e1e757
SHA512 6009d7ff23915a49c79b21bdd368029c9470ed03672bf575d4ce13bab92b12d411cc8a74a168536afd79c94a49f8f8f5d23523eb13977795edfe169aa1947552
TLSH
T144B00265C503A226C0A603F0299995D87161EF29CB031226E2E11EBBEC65A6546256B4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 92f50fda475ebd809ae2be2ce801adf545b4359a848e103ff20952595289574d
MD5 5ca0c7e049565fb1771ae79d5d82c4d3
SHA1 f9a2db73b4ed70a5bcdb5ade4dcd6983bcf78e35
SHA512 8a351124bb8f7508b4a1b97d339f57bcd10a34ffc0db9d0a01049a41001cb603f865d9f7026fee37595ebd0eb712a04cfabce8ea81eda3090a32c0f8ff587913
SSDEEP 6144:78W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEER:31WcLsrOjuGdF2R
TLSH
T1B7141277CB5689F3A5BC0A5131EEA80DCC23039970BD5A94A18C7B8D90D93C83B63D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 92b5d83250762d2918cfff4495f87e8594711a476143c07245e80eeebafe22c7
MD5 40666dfe930ca9cf58dfbf67cfc30c36
SHA1 6ec06ec3a94b320451f3ff30974346f37c75fac3
SHA512 4c124a676c6f455f06d13f198677dfd587cba9dbda62e2d572456ab5b04c1b49c15dc18da1efac820f5333aabbf59071b59e61f7b09e8ef09a5d5743cab7af43
SSDEEP 1536:ip/2cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:a23Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1EE9312BA8E2646E7997D4A8176AD7909CE12530D705FB9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b81c23a339aec6fd57ed5b6fa8fb0602e518204877f6325351457abe7f48bd7c
MD5 37ef3109ef20b6c5654edaafc66cb1dc
SHA1 918105a31a0933356037160e186041e3c84c326d
SHA512 5113ebf165e0b9018353445262f2aecc9ac3cc1de3ab6d16d3019b2b0fc4ceab1671b2429701a3d953ebb01297db442e205d5d442afa0a8d6d0f5c94b879769e
SSDEEP 6144:6P8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEER:w1WcLsrOjuGdF2R
TLSH
T1D614137BCB5749F399BC0E5131EAB80D8C635399A07D9998B08C3B8D90DD2883F63975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 074aac0a940aeec362d19841b22a3121015108c1f937708a28682cc34362ea46
MD5 66adcfa9a540e9b3381d5d5e6e153c20
SHA1 7713f1163649fb625a916bbcaaceecafc8f19aec
SHA512 991d858767ca0247b810552f27048d6ca09168014099025724d242ae282600ced11c6fa08548684cb05e3bbee9dace88806d58e753b8da271dc42ae8db6a866b
SSDEEP 6144:Y8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEER:c1WcLsrOjuGdF2R
TLSH
T1C7141277CB5649F3A5BC0A5135EEA80DCC23039970BD5A94A18C7B8D94D93C83B63D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 cdc8a715281381b1025c7ceadb495f360707c109b9ced5993b3b577d5b8e47cf
MD5 5b8764c3459d46a1033b935da78b133d
SHA1 16ec7216b8881280b2b62981424a76fcc8fe0c30
SHA512 e017b0215cc854000b4b8344fec7d1994ad51eedb544cb2158ee4e541308878f1c28b847781cc656be5f4a51c6054057b88bc848bc772d7e335d2566e6d92e04
SSDEEP 6144:LP8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEER:f1WcLsrOjuGdF2R
TLSH
T12914137BCB5749F299BC0E5131EAB80D8C625399607D9A98B08C3B8D90DD2883F63975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 5dc8d0e1d14ba21fefe29837ac15403e0c8a9625f29c7a2a219811c4d645e07e
MD5 d174b6ec444fc6211d46a0391fa0730a
SHA1 b7c60f7bd3fca34147e15b51392ccdc8e8a18cf8
SHA512 3d8ecc9091fd491d7e37d005265ffa3b0b87d673cef392a5d3521095f81d598d549f138a6a1bd4a9d6276eaf87fcadd76748cba5baa983c3466f5a505b395356
SSDEEP 6144:TP8W/NgGUIuuZ1Ww7m+LsVrOk0HOGm/SFyEER:X1WcLsrOjuGdF2R
TLSH
T17114137BCB5749F399BC0E5131EAB80D8C635399A07D9998B08C3B8D90DD2883F63975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WavePad Audio Editor Software Express Edition Installer.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WavePad Audio Editor Software Express Edition Installer.exe.log
Size 3KB
SHA256 2d06b3f98af8002aea91129fb3072d3dcc2e02b7fca4f882241afb449ba86a9b
MD5 2f6ca9826e96c0db3380ffad931b0a49
SHA1 b0feb4d1e3ac9d7ae5ec9a07545f779e284ffb31
SHA512 db786f88257642f2837009126148d97bc4b808b1d86fee91328ba9527a13162f758166654648ae8d1ce0ba2b8d080be6acfc8c0b6d8ddf7aa3da0f661140b469
TLSH
T10971FD2121B160D98E622F661C6D2AC863FB831D7E545F58B9A5215EED3600BDF231F2
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 fc412330da5cfcf88c323e4b30c1af943d0d4dc6cbdd3b55e549f877db5223c5
MD5 2e2f1f15c82fc5af5b2fc6a7bfce3873
SHA1 7109db832cd8473733dfe9e5c0c5b236d64b491c
SHA512 d0e40b2663172ade8b328eb4c17e9f8c05a90cb0d8ab0cf1559d0663b96c03a605472f5544fce3f77427e61738e079f7bf615edce3f910fa3de784ab1e40ae0a
SSDEEP 192:RjAcGWWZZZZZZZZZZZZZZ33333333333333Uh:RjAcGWWZZZZZZZZZZZZZZ3333333333A
TLSH
T119E18852C3D4C3EA8B1551CA8EA8635E0071370DFBECD908079C89EE748E4DFF5A9698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 7c81af3c99d4b85b67497248174ecfd5309ae27e33762fd88f4ffdbc7f91cd88
MD5 03433bc3c438a44f9afbe1f0fda9ca6e
SHA1 ce17b8c3c5babd6e683d15e8aec1ca3c0a7c1922
SHA512 332b69ce566de9cb254a428cac62a5880a06554a735f5a70c074fc6eb71fd3a64b038dc01921149382d4ad5bdbd6b428e1dece5d584eaae7d537b02a527e0f00
TLSH
T173E0DF7886C4C1F856479A87C6ACB61C4404731EB7ACD8DF3215B4ACB801422732F4B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 3270f2224a07328ad52a0a1875a6c3c546f598d7b06779ea8c73bf4795f53ea4
MD5 355848bdf7b20fe41d5cf7116bafd013
SHA1 922638e910380927a2a082ba561f141990db8157
SHA512 46c5b9c5dfdebca901bb404f11f506ae1ff55b35e31dc0b07a82f0cae43bddda0ecb3f8b86250c2a1fabf03704007b992eefa1f023afa98c239c9573b67c9bff
SSDEEP 192:2joFP3PDEeezmmQQQJCC7YYYYuuuu1cbrrsBOtSLO:2joFP3PDEeezmmQQQJCC7YYYYuuuu1cb
TLSH
T19FE1575382D4CBEA9B0660CA8EA4625C0479370DFBFCD90D079CCDDD304E49AB5F6691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 937feafcab1488ed48ef8c0051c0b96e93b70419fb5a5985a10654e1f4a2da4d
MD5 706ed7a80e41d17e0e1f6795861ed8f4
SHA1 911e3192434317e830f90e8bf700b699bd820175
SHA512 4bc06affe76b3171b1de287e4b2cdae6d4d7d29b96d15fef7e52dddf2a8824fdede4da5094118a3ca634efee96a0958341e0c57ad65a27e00454e4a2ab34ea49
SSDEEP 96:TcEFqf7eORzN/4HBKfBQ6gJauprKHZO2Qu3:jofSOR5qBKpQ6gJBBSgrU
TLSH
T1CBA10A488CA7CF28F7F0BAF2FDF23065B976C718118B9F1835F1A4BD5211B606890850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c512f35b611d17c70a5ad0638a852366d825f89dc5169e3c9d309496ec53ccb7
MD5 c44af38500510df45d3a5a99c71b2f50
SHA1 3fa22e9453a50e5ba6c752c5ed70626e845f6d80
SHA512 84ecdca105e8bd0b70b547403658b34f08e6e09acabe5bd5ef824693ad3c747888a699d0f0fc76a381730ce354db38514a0ee715a3b0f5a88285f3401e5a8617
TLSH
T15A618CF783B4856EDA1196F0AA18AE2FDE2C0615431C7C6989E4EE17D7E3472E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5912eeb218f18083513407a0102f2874242316d7005af4ffc8b17ccabf9552a
MD5 09dc575c5f4669ba8d0b8eb9292f6f77
SHA1 38dc7a85f5ead93fb7c7f4db90345b14acb3afc0
SHA512 bc8dd9b808daed17c9420df1f6e40265c6088acc571508ab9215b3c720dce27bdf7fa79505bb848a87272fba0cfb891a3353043ba3365fb437bdf8f687add19d
TLSH
T1D4618CF743B0856EDA1196F0AA18EE2FDF2C0115435C7C698AE4EE27D7E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f1bd50fc6dae46fe71531ed7a1215a82df0ddbb56eee31d69005212b15cf14bd
MD5 d1aa46ef450934606646d3b49108c729
SHA1 2d9f6463bc291cd5ab6921d348c1e016be736e67
SHA512 4025c31a07eeb741ab8fe1c54809a9c5d24b2b1f3900c16678513378beca2c6f6e477bc89aeb018e9027ccc7372d9e34e9590dd5c209d31a7fd52d74b419864d
SSDEEP 192:sxZ+RcyM//K1Ml8Mid/fpsgWWQzTxGpIdpwAHW6+WNtlV/Q7H8JxzRdIg4J:sxZ+iqd/fpsgWZzTQiRHbp/fc
TLSH
T1F552D81AEA349977CCCBD309B555BB63D6F91522D2900D44AAFCDA0C04E6BED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9697836f4be7880ee42e9800153f6985719897238d90d28f468691f6c91f2e7f
MD5 7832c0a6604c36a82e4500a25dcd4e64
SHA1 9cb579f92db414d1b266aa39238691123e6b0b58
SHA512 d29fa0cc5680fa3ac484237be47cc49e108904265a76e355d80326e8a84d48f295874367f33c38d567b39c642405a13ca48b666481c13477f9bef91c8395ed4e
SSDEEP 192:sxZ+RcyM//K1Ml8UQumd/fpsRdWQzTxGpIdp6AHW6+WNtoPXQ7H8J0aPLdIg5wJ:sxZ+KqLd/fpsRdZzTQi7HbqXqIO
TLSH
T1C662C91AEA345977CCDBD309B555BB67D6F90562D2900E44AAFCCB1C04E6AED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dca4b2b87d1a76b67a53d9212044afb62ce0034c6043fce7e5c2e7cef9ec0651
MD5 07045429c6c594141a0b201d01fa8568
SHA1 28d2721a70811dee0f6f0c9014e3696c43fd43cb
SHA512 ee581a7ff1ecdf4e9eb2d3db170a4ae32d496f3b7083cd5b0b2553061561bec9917c27daa55a9f84f709b7e5460f6e03ac648ef75a662c7eb6f2d21cd61303d2
SSDEEP 192:sxZ+RcyM//K1Ml8Mzd/fpsRWWQzTxGpIdpwAHW6+WNtoPXQ7H8JAzRdIg5OJ:sxZ+iLd/fpsRWZzTQiRHbqX8A
TLSH
T19B52D91AEA345977CCCBD309B555BB67D6F90562D2900D44AAFC8B1C04E6BED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d37796ca39d0f92a72201184f56315990df1b9daa5fdf039f0ab1500c17724b9
MD5 aa8b44495a4e8b63f4671e138b787b39
SHA1 0de09e89753795a46a64899c3673ac6fdbe50b58
SHA512 96091bd0fcfbb05377fb9215a25f7c7888db392299c3041950babbf2a21c08359f4f4e33c23369974b66f933526fa8e188d367ce59f43fcf61e83eb50ba9ac35
SSDEEP 192:sxZ+RcyM//K1Ml8Mmd/fpsRdWQzTxGpIdpwAHW6+WNtoPXQ7H8JZaARdIg5wJ:sxZ+Kud/fpsRdZzTQiRHbqXDlO
TLSH
T10162C91AEA345977CCDBD309B555BB63D6F90562D2900D44AAFCCB1C04E6AED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 107aaec1dfa7f82dd03e645122f7de887d974682523a6b42c8d8b5a802380fd7
MD5 3858128f04e516965e6bf88bda895cd9
SHA1 f61a2fe3b592a9ffe285e8940ea36613a99d1e29
SHA512 2ba8038cdc48277c1fb46291673befcdb1031cf33f78d2a270f89cdeba8936a4b48b8697c648de7988972133b1b5850c28141c6f69e650f6e6f06acab0e0913c
SSDEEP 384:sxZ+BqLd/fpsRg66s8qMpRiYnazAW8pZS15posJWeT+fZzTQi7HbqXqkO:sGILd/f0g4Mnc7WeT+f+YHbUE
TLSH
T11FD2090A9924C8779EC35E18747DBE33D9EC00526295CEDA5AECCA0C019D5FDAB4783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 878b1b7c76f1cbf7ca2452fa0338fb53e8c314591a789cf9a949da5760034fcf
MD5 1e19908cd19fa3e2ddb5d4e3f2f43702
SHA1 9e5e7af1ad1b20b14d41b2662eeb5aafc16c74f0
SHA512 c7b126468ede99eb18daeefab8b573da4cb4df8a43b81a9a7e7d446da010a4ba847c6cafd3eeaba4960e9189bbf7c2c35895d4c5561b0f8b404ef972d87771aa
SSDEEP 768:LcQv2ul7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVi3nFLllnWh4ros:LcQv2uzEneqWve+l+u1jaP3nFLfWhDxm
TLSH
T1EDF20B3B6C0CCB7E4F804E9CEC2ABE8E6DE801CB9698895447F9445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 cae654038859745a4fea29d2f8a3fd2b0d510a06a5f315106d1f3dc05495262f
MD5 398039fa2bb9df5514ed9ade82ac614d
SHA1 85755f607ab606d7ec65f2a91b15ba6d97331372
SHA512 eb42cf4c4095b252c002a1e9301b2d0ea536b7f5ad251f01c59a88eb42a2d648553eecdc4d44965ed8bbb2eeb2623e5e3e804b20ff16508e26618900ecb3df3a
TLSH
T14651C44D9C8A8F17CD2911F158F61068333898FE1A9847073CFD9939AC8B7951CA721C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cbbf5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe5cbbf5.TMP
Size 2KB
SHA256 045e26e1724ae5c9c69dd6868313293741696fd9fc4e84b178ebc05deea28166
MD5 6f4129a553278e6c7de5ebe89328e401
SHA1 31a566bb5e5729d567c131d2b0bd4b9e959bbf36
SHA512 de15d3a5ddeb95cbe5baea56754d684974edfc68593aa3cca3175b0fabcff82a1063550b91b78af5c12a233b641228848a331665589e69ca7ab43e5e8eb275b4
TLSH
T14651C85E9C824A22CD6084B349CA2469333DB8994988AF0734FC8A33ECC76AD3D53344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5576099f6d9b99edbc8f77ebcc59b98663d26d8c6f526e795d46cf3cd967ba3b
MD5 b5c152559f8e19ef8d86141b35d5c9aa
SHA1 78b869816e557246d0b9b7d81247b87a5c0f746f
SHA512 574dd5ac343667da2113e18891eebd5b573251f875639a656f9d768b0ecd0eb59ed5cc2ada14a3ab67f6b06421c5fc7a63c5c6401eae8655718dc54d13c69b10
TLSH
T1CAE0D8BB2CE31514EC9FD3D2283154A50149B8558951EC8E54AAA6DB54F2240244AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\00632fc3-16a2-46e3-b505-16f0e723c2fd\index-dir\the-real-index
Size 72B
SHA256 952aade219da33af275f871237d442d5acdeedc3d2db91a1f50167d902cd79d4
MD5 3276f051d47b3029eb328445296b2a76
SHA1 d2cbfe06226ed61bf733b91647185386866d9254
SHA512 3e30174a7f31662c29a8d22fe528c11a0b20da7664066e3f9e3b5c1c7c16b2fc8e098687c8008de7255ccb7890ffe43f5008d211c12d8d81e4a624370fcb8b78
TLSH
T117A002349D894A01D52AC275507A458C23114EAF850313B244FA85888A505814121021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c435.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\00632fc3-16a2-46e3-b505-16f0e723c2fd\index-dir\the-real-index~RFe58c435.TMP
Size 48B
SHA256 b22bb7f54feeee17f27e2d48ad1c2a9a6632ec6dc51f87c296d702194f535784
MD5 4e14d3076942c148bd216ff2f2c882a9
SHA1 cc4b0a9b02ebea0a518aea08f61febae97545c7b
SHA512 89f10901f234973edb775ed528f2490f2dd37452baa88e67d93c9f5f53e79880dd7d37742122ebc8b8c4eba3d5767b986c81f4542de42b12544c9363dea6a101
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\94f6a08f-d22c-4780-be50-efa6545b5002\index-dir\the-real-index
Size 3KB
SHA256 9b3dcaf2e58dc9d77b2ede0dc242f036720a5d5ba7c75f29294fba9bb823c3e5
MD5 aa4fd863be6459b2f3dfa5390438a3b3
SHA1 4247b7376fdcbd02cf98dda4f097b930212364fa
SHA512 f7ef614612f5957a36e6adc8f917f056da7b4448f390f7211cf083d84e7f7b01320f7ea32dc1960e66b81a5fe04e2694d85f746ba8dfcd8228dcfad1b88b3835
TLSH
T14A61F848BD04C95AEE7C50FEAAF8968F2BAD47EC26C153BEE10DC926F1C401C4435EA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d9d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\94f6a08f-d22c-4780-be50-efa6545b5002\index-dir\the-real-index~RFe58d9d1.TMP
Size 48B
SHA256 d05c5a3fd9523a67f183e9c87d9ff99e503277fc0e18eecebed6ad81ad0cbb6c
MD5 2108f6357ac532ebb985e8b8684a8783
SHA1 19fe2ec3e056758ce885600ee54fde14b01c73fd
SHA512 96aad7d0d2929a62aa0087eae86bfae98f92ba46621026876198d0cd0fe6c8801c06980564bc209b9a43ba171b0945a8a274207a860db596e810e7c1658e13a3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 417676a21979f124575bc8350490fe5a13b5566ab05f7c62aea51f761c78d938
MD5 568fa210ce2887b40708faab94055e47
SHA1 cba705c5140a60c5496949ef417cfe5e55c0744f
SHA512 c1f5f3b32f4bad6d81f2b065c1cc140477d6fd5ef7ba1f168eb4a5d930fa7f2efe6168f3317810c7e98202e0b8bdea7cccdbe69880a83f385aa84563715d6ab0
TLSH
T1DBE0611262714712EBB518DF0595F648DC3F3E435D40CF1840C0710208BA95A4453F57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 7865b0765d1ec2eafdbe489010192374ab7e25af34eed255d43d86e784b64517
MD5 dbcd4f498e9bd852bc68a7d83487d34e
SHA1 370b793f6615fd4ed3f9aaa3257f556a8ad20c9c
SHA512 91e461747550bf711bbcd3109322d66fbbd3d2fc9834350e301a56101d3e35c9d23a3854f59c94768b298886360cc004d40087ab1eeaa3c9bf17d2cf488a5f13
TLSH
T1DDE0681763724622EF7A59DF1A96F748CC3F22439D80DE2840C0A11208BEA9A4453F5B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587625.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe587625.TMP
Size 195B
SHA256 4a7b7dec54c02ff0d1b18f35a0bb2f6f24a7d46d4bd27b0679456cf807cf6728
MD5 15787c3cb19725b40291fd6085974ff0
SHA1 71754c4803edc934f94725746fc837265f746635
SHA512 d2dc3bf5554319dd83f2a5bd39a244a7c041df318da9ece6eebe1217fa73875363d096d602c7216dfc14e794bc03396f42ba9a32a99e4b73c93bb491231986e9
TLSH
T1EBD02296413206028B6865D71E62F384CD2F2E839C80CC688888B1400CB62C64483B66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6b3b57ae4e3338c83eebb7fef6c94c5ba19f08d0bfcb4ebbc69c8269ca3c4cf9
MD5 fd316cae1589d7a449d1233c8351286c
SHA1 97828b9e22bbf57dbe8275c67a0598731bc3faf6
SHA512 b55371b8efb20e97a61863d85ff3eb642181239617046a2c5f4a3ac5d6369c57dc34f5704eafbe07a6caafa797a3a35cf911061b70753c58c341975ab76c872c
TLSH
T139A00253675C8053CD554770E8A616F43B3148191B05126246B414B4C964380431661A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c3d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c3d8.TMP
Size 48B
SHA256 bf6854b23cb950cb0a7d9133d3c0f8bbd3cf2772b3368c56158f8efd7237c96b
MD5 a544731b1902cb7c3a3b7bf7cad20f58
SHA1 0a72c7ffb47108b325aa0705bd8a3993def7a5f4
SHA512 7ab6680d0132d884a94d2d76c0596a8f75b5d2e78d313d606ab30c1d9b37cffd7f2f85039e58a7374c914cb6c9ce5b4e8d0648b901d5d7a227c1aa21f67e339f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a7b13231c45e07917c006ff5407d4feef1c8832b6aa48724659c9fc81b779a4c
MD5 97ef3efeb4bd48a7ab1788409d9680ea
SHA1 d15bf511b8012e43144857116d4b94ce24e426a1
SHA512 5be12fecfe0fafe5ba828e34075bd10fb9acf9fd541d44f7202f8c71c58837e7e26f5385df33a30b5310cb73e024a62c4360d33321f16d0cf136d9a08c34d0a3
SSDEEP 192:SnBF8bn9DDQPCDfRcIdK1davDmBWtSWIggbw3m2W7I0nO2fE+rHo:SPJTLo
TLSH
T190E13450317B06B02A3E259FA950B45E02C27B633059E56B3BB840B54F27E35EDFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.16\domain_actions.dll
Size 64KB
SHA256 cd4e81ff9db4c6b086b70b09919b9426ca1f2c05ec43c477e9ce99156be66399
MD5 4ef0ad12ffc81a3570d19817265b7197
SHA1 a70a993ad81ee36d5f719f2f046d30b397fb5191
SHA512 c270a4d32d8f10eda440ce521cce4f29544b384577548ac0e43b869d726d9cd6d1b283020ade3bd8153b0fc5f6a93bb630b7139b2c627ad0b0e3fe78bf01f212
SSDEEP 1536:ci9SEjRPuonFOxAdgxBf8pa5oMNOKVGxJeyf2Fm9vcyaZzezj:ci9IcFPgrfrxOKI3dgmuyaAf
TLSH
T16753D1988F68501BE5BA1DB0D576DF0AAC79E6A3472060CB2391FA5C1D21BD07F3671C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58febe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58febe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 93575ff7611782b6b81bb0d0c526ce66905731491e834b070f03afa37e7213e8
MD5 7d4955e4007eede8c732266ae1f3424d
SHA1 e06396e61467f2900b09538cce5f4d724a159389
SHA512 15d74981d0d856115a0dc29e852f7b0d52f2a494280e3bff4612f230d242cc482bd2f35a4fdad16d1dafd25babdf569910dfba3f55967b807289cbe6d96f00ba
SSDEEP 384:nMjccCs+Bt0S3vsN0yx35MgD/gkqXXU/AatId6klZr4f3v:KccQPsR0bXXabW6mQv
TLSH
T152826C71A8B85C3B8AE3E524F18B3B5B2EF451B797842F58E9C94B0C04C71DC170A52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 565d9e190f776f40b80cd266905b24a2516c41f394c157679c9c33c852058fe3
MD5 3df7ef9f41f1857c6f39b1f96f40d6bb
SHA1 ebbdea1a4dd9d75ad18503a8160248f148554371
SHA512 afd1e539b35f0c0b53a32d37661a9d428d0893e3225770a7fb5127588045c458b752c988427d35b5f9b4cf53adfb6e255b262c0f97cc6b0adcf2a6e515efba02
SSDEEP 384:npiFjjccCs+Bt0S3p4sN88TUNTUlIljx+FMgTDfwp/gklXXU/AatId6klZr4f3v:AFPccQK9wg4RwWSXXabW6mQv
TLSH
T162D2A4F594E7893BD9AE8743A37E2E565DBCC1A3B5885994BB840E0CCC821BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 42e60de6abea6598849fc12b082c8fee60a5af468c972f3169997da2cab5762d
MD5 082c6374ec5db7c359813976bc1fa95a
SHA1 aba14b83221a7f8c921d9f382b25dc83ff673b3f
SHA512 c4f751785573a9540f35b7473b6e6a361af46fe0a441dfbac96cb637a9ce67922837388c6bbab7fe7d07e809bb4266842a45dcec105b1396986e4f007d691739
SSDEEP 384:najccCs+Bt0S38sN0jx+5MgD/gkqXXU/AatId6klZr4f3v:UccQciR0bXXabW6mQv
TLSH
T14B826B71A8B85C3B89A3E514F1873B5B6EF450BB97842F58EAD94B0C04C71DC170A53A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef93fdab60d0dd39ad167b938bee1685363fefa00459f51d1854c87a34f5f5bb
MD5 5537d47c760459b2e80307103324cd8a
SHA1 db9ad2f5c5ff096fc1bde94f257c4c86684a8c25
SHA512 5409973630a94f92fb18e1e3b1e217d62065ab1f317aaf7b514a6828765b8e1b13b7150248ab4b96fdf5f230d21ae403e7ceb18fa8bd353bf96df00f2f5fc448
SSDEEP 192:HONd6IT05QmiUyvKcgibFF1m3kneJ4h15qRQU6:HONd6/tcgi/gkRXU6
TLSH
T1FF121A75A4BCAC2F4EA3A815B0C73B675EA51177DA897F88E6D41B0C00C329C2B0B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffeb94958ae97d61baaeb643ed0cccf934d412272543dc7d62ea3b3bdddb186c
MD5 f7deed4bf6d12e14fee81a095052d18d
SHA1 086777e6e117579932dcf02f5bb6b70c7367431a
SHA512 25b1995fef183406f5a8bb4371d6cb7a63028aaad6f1e6395fe13a96848f0db4b0fe3f530a67821a321802b6a08a52a101be74069868306e4887480ae4aa689d
SSDEEP 192:ZONm6IT0JZQmiUybKOgibFF1m3OFufeU6:ZONm6B37Ogi/g/WU6
TLSH
T1E502C935A87C686B8FB3AE49B0873B275FE5516FD6953F88D6D41B1C00C729C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety_tips.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
Size 163KB
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
TLSH
T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
Size 3KB
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
TLSH
T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
MD5 91c80c5508982eaf5438e9211fb2a52a
SHA1 78c965a36a9f74d71dd94601ae92afdbc93f5f95
SHA512 7bc90c935ea510bef580cd0117ca240de86a2985549ab9e15e6f5b819635d81825fd42e6e9a251214ac4b6e9ec2411d9c4cdedde28bc5552970d614f0053e74f
TLSH
T1251112D25D6D2AC2D1BE0F6FD08779FD40D8C216F2A8707A1854ED54423890E144187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b3dcdcd6b2e9c81c76a63ec2591bcb0f840a13f6a1a8511425a6ffaa3aaa155b
MD5 30ad726d87d43af1cf9912d4b4b17074
SHA1 9c14f14c95f9b10ad1c1a5d55f4cb7c52e107734
SHA512 b0a824de79097dff0fe4048cd4d9e870e9e09d52d4a0451bc27bcd8b01ef85c1109344f057ef73d0499de49caf6d36c15fc58c62cd0f62de8f319f6880ff40ac
TLSH
T1D12120E26D7E2AC1D0BE0EAFA08B3DFD54D8C216F1A870791848ED94523D41E144187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
MD5 2a769156fb0cdd33783892c7340dd22e
SHA1 4b7d27850b335fc293c0ac5f52ed9cf1604cb52f
SHA512 3bb6cd746bada6a1370fd3186f3c8ded4319de162f80beb35ac87e73d46ede19407f4cb1d05ec658f6072f3e42a5681f64d8b69a136afadbc7534d3074670bac
TLSH
T1801114D25C6E26C2D57E0F6F904B75ED54C8C216F258707A0C58ED94413840E144287F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 33b54581b3cd7004077c0a607bf56966799274b2c161a1665f98c099812af2dd
MD5 453d2d54f662fe69369f3218b6a4bbd4
SHA1 84cf6c3186ea8a253c25645b37c95e691fe92785
SHA512 792dad3f1799878688bff182f210f8e65747d611194a3920ff17d26eabe099c6e2155774fd8371a476ba05c5c04b33d13deacc32ef05e1a70812e03e6f03706f
TLSH
T1442111E26D6E2AC2D0BE0EAFE08739ED50D8C21AF1E8707A1858FD94523D51E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
MD5 96814d4ed361ec8de1547566e582b0de
SHA1 f9588e0a74d9790991b254bfb0650af55810f778
SHA512 bebc0e98c4485bde4609e0a92f0a27ac1e621a63e154f220c2b8c3b11bfb2d4cc2443d6274f6046d42e28b28478f719f28917112090b3cb14fb6adab24770b93
TLSH
T12401C2D25D7D36C2D57E0FAED04B75EC54C4C11AF29C71BA0C58E994523890E244283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e99505afb93835d433016fc3c7e586e3643594914a27f111da3f4057a400bab1
MD5 59d8e3d0ecf6e59eeada0a4f4aa0dedc
SHA1 6abdf5eedac2d912b955efb77ba8fc816f3178b2
SHA512 96ff81504a39e1db95126818e43c8c7691a0e5113c7c9f650c3403a99155bce734a8154817405a3fd74569a4da2f6dee7e44c113fe338ca2838a61b075ff8aef
TLSH
T1B53142E15D7D2AC1D07E0DBFB08B39FC84D8C216F5A8717A2858ED54473991E154087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f932e2485ac808efdae0f6f6b8cd67b48083a5dfde941b3a31f8d72306c93321
MD5 7f64ada0cce81aecd3f3ef6f80c3a23d
SHA1 dc44b39dc49dc3ae947ff4ed3ae41554b4dcd4f2
SHA512 d398cad5472ef9853ad983a2df98bdc49bd597c81d4b5cc8c6ed1b4de01d8ec10114dcda88c30025827fecfcf284d317b891a0cd70e385fd3f90672f447f8693
TLSH
T1673144E16D7D2AC1D07E0DAFA08B3DFC90D8C216F1A871791858ED94423D51D154087F
MD5 SHA1 SHA512 TLSH

Submit Download

223995cd-5a5e-41ef-ad93-2d4bfff209d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\223995cd-5a5e-41ef-ad93-2d4bfff209d2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ebf2d8e2c42d6f6ed6cbe8faab34582df85ae0044df142bdb87ab473a2df34d
MD5 ac3147fabb49cbb508e9efb78cedbe0c
SHA1 82db9b97a734e3558e655ba8f8431fa58e910061
SHA512 b9927353a0328485c40a74218675a5b8407ff32c8fc378ed6d47005be87cb31cffa1ea876263c6bfbdd6af3988838ba1397e3e01ee114dc6b71952b07604d79f
TLSH
T1E541F858A6E91158B3B76F56ABF7A87E487BBC772E06D46E10010D4F0A66B00C872737
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Services.Store.winmd

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.Services.Store.winmd
Size 4KB
SHA256 44f3a05334de6ca0b43ebd17f6c7f1935630e026f049f28828566e364b7f41aa
MD5 4aae69886cd900c373d69194dc4241a0
SHA1 50cc74acbfedea48f1225181682253002bced6da
SHA512 02289cb11b4090028c5a2fecc69be1ddb8ed0b57125c3c7d898b9937b46da53dcfd3cd7c601c8f7e124f5587ff0a3f4450fa7da0add5abab4ff3903ab23f82c8
SSDEEP 96:Y9pkWuCptmTJuY4jTtOfJzlGPM9QGsfzl1dkB:Y9pFu0c2jTtOxcQ+3
TLSH
T1A7915103E6818F37DC69637A68CB0F602334DE6A52E29B5313C0B4B99D876A05F022DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpED3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpED3E.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

cfedd5f4-a8a7-4274-8db4-ced3e25ac66c.tmp

Path C:\Users\Admin\AppData\Local\Temp\cfedd5f4-a8a7-4274-8db4-ced3e25ac66c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decadafa-343a-413b-a7c6-c9ed160a59b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\decadafa-343a-413b-a7c6-c9ed160a59b3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b2c69425-db2e-4f77-a19e-da5b2108ddd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4816_1344613621\b2c69425-db2e-4f77-a19e-da5b2108ddd1.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4816_784187197\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autoruns.zip.crdownload

Path C:\Users\Admin\Downloads\Autoruns.zip.crdownload
Size 2.8MB
SHA256 b04d2ac6dcc287a4b01a9cdc5bd9580a38df8a3379e03698cf7b888cdab7ea0f
MD5 09aa3a18f9dbf8588b0a3489f5c752f4
SHA1 130a744a421ca914f2809685af8262c468f4177a
SHA512 d0a18f5b71fdf9df60e604d12c9279322a6aa8ce6001cd980bd9df138718c59bf7023690de51b64e6926f154b2ebd52950fa21a89e5e30d6942c784a28edb453
SSDEEP 49152:4VDnqM4FsEAnyaDg7a3rDHS1nQVnXEA2/LLYr3FU3YrCFK5doPy4kvOzJcXvYVTJ:jNsEAyOg7GSBj3/LLMFKYrCFs+q4kvAp
TLSH
T105D5338E415D58B1144E22BF66EA1C23D8ED6FC24C3D008530EB77756B996B7CB88B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autoruns64.exe

Path C:\Users\Admin\Downloads\Autoruns\Autoruns64.exe
Size 1.9MB
SHA256 32e268b87130b7b24969718f81534bafec92985c2ece6765a88c20c28c55bca1
MD5 07f151495c65098fb635d3c95aafc285
SHA1 20a8a5bdf45f896fbca70bce4b99afa2c7cb6f35
SHA512 dcedec08cd011ad17a1713cde6c2514256396caa44e6690d8334e79e62dc9f920b6fff4b0efd1ea2ff63952893fa96ffc9a45352c6b9e37e89cadb0cb4fc76a2
SSDEEP 24576:CNs5uiuAJV13BihdiKcffUmCEC5Fpuw1W2k92BeasWkCOkhUG:CNs4iuAJVmhQpffMW2kZaSCOkhl
TLSH
T16A9529D321E901A8D47E92304562853EDBF73C2E53F38ADB4593BD592F26A8C5E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WavePad Audio Editor Software Express Edition Installer.exe

Path C:\Users\Admin\Downloads\WavePad Audio Editor Software Express Edition Installer.exe
Size 1.1MB
SHA256 f85d777538312a24ace0883b2aec818e89f4691c52d70f6827f9a42179bc6ba2
MD5 44b156a66b1e3894a7bea24b89736342
SHA1 04058a8b5eb7ccb4659955447ed0002d6e873425
SHA512 d279a1375af6ed955b4423fd31c29416ce94ca4d1f614f590632497d2971c3532ef85245447b20026d6ecde70b4250d6a65c645c26f8cfe7fed8d8c790591f89
SSDEEP 24576:TtyhsrF+2DR7BWYpLDo44ZUdm2BWmp+jf:Tks7V/m8T9Af
TLSH
T16A454A9127FC0539F7B70B79BD7A68610A36BC395502E69F098D252D18F2B1688F2337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-657-0x000001DE8C980000-0x000001DE8CA1B000-memory.dmp

Download

memory/2232-1314-0x0000000004080000-0x00000000040DF000-memory.dmp

Download

memory/2864-1382-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1404-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1405-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1409-0x0000000004240000-0x000000000429F000-memory.dmp

Download

memory/2864-1391-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1393-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1395-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1394-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/2864-1392-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/3468-1315-0x000001FC12B10000-0x000001FC12BAB000-memory.dmp

Download

memory/4764-1019-0x000001F2EDEA0000-0x000001F2EDEAC000-memory.dmp

Download

memory/4764-1287-0x000001F2EDEA0000-0x000001F2EDEAC000-memory.dmp

Download

memory/4820-35-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-21-0x0000028352470000-0x00000283524A8000-memory.dmp

Download

memory/4820-38-0x00000283343F0000-0x00000283343FC000-memory.dmp

Download

memory/4820-1-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-34-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-2-0x00000283344E0000-0x00000283344EA000-memory.dmp

Download

memory/4820-33-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-3-0x000002834EED0000-0x000002834EF8A000-memory.dmp

Download

memory/4820-28-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-27-0x0000028352760000-0x0000028352768000-memory.dmp

Download

memory/4820-23-0x00000283527F0000-0x0000028352976000-memory.dmp

Download

memory/4820-0-0x0000028333F20000-0x000002833403E000-memory.dmp

Download

memory/4820-22-0x0000028351690000-0x000002835169E000-memory.dmp

Download

memory/4820-16-0x000002834E850000-0x000002834E862000-memory.dmp

Download

memory/4820-20-0x000002834F560000-0x000002834F568000-memory.dmp

Download

memory/4820-19-0x000002834E5A0000-0x000002834E5B0000-memory.dmp

Download

memory/4820-18-0x000002834E870000-0x000002834E896000-memory.dmp

Download

memory/4820-17-0x000002834EF90000-0x000002834EFCC000-memory.dmp

Download

memory/6080-1378-0x000001698DFB0000-0x000001698E04B000-memory.dmp

Download

memory/6080-1379-0x0000016992F80000-0x0000016992F8C000-memory.dmp

Download

memory/6084-1415-0x0000000072710000-0x0000000072773000-memory.dmp

Download

memory/6084-1413-0x0000000004140000-0x000000000419F000-memory.dmp

Download

memory/6084-1414-0x0000000072780000-0x00000000727BE000-memory.dmp

Download