150753d5978c3efb1c921844251bfd7577e66f63c7d7ba7ec27f879c330f5bb2

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wpsetup.exe
Size 3.6MB
Sample260428-pgwjesht71
SHA256 150753d5978c3efb1c921844251bfd7577e66f63c7d7ba7ec27f879c330f5bb2
MD5 214c260a5f891cc90a3bcf856e153ae5
SHA1 369e1476300351e51ba803607c60545c28cc713a
SHA512 5d28a8122021a2f42108edb2ffd942ecaf54d15775728c3984618060778dcbfc04be1e9c41a76a5c136c8bffaf29a8712e2813c0641b39a0b0ee48a3528ee1c4
SSDEEP 49152:S2qlmemEowhcmY4qBzd//SMNIeXTp9/+j9MSymNG915nJDld4MyM:BqlboMcmYP5hBIITppMNGlnJIMn
TLSH
T11106330AC49D0402FA2D4DF468B051D17F869E9526CDE4A1FEC1CD6963B89B2CC3BE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WavePadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wpsetup.exe"	nchsetup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_672098744\manifest.json	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
8	nchsetup.exe
2952	nchsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218530656746207"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{54CE1ECD-D2F7-4AC4-9C9C-F1054ED77CB6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 8	5108	wpsetup.exe	80
PID 3108 wrote to memory of 2952	3108	wpsetup.exe	83
PID 8 wrote to memory of 2444	8	nchsetup.exe	84
PID 2444 wrote to memory of 3292	2444	msedge.exe	85
PID 2444 wrote to memory of 1200	2444	msedge.exe	86
PID 2444 wrote to memory of 3544	2444	msedge.exe	89
PID 2444 wrote to memory of 3544	2444	msedge.exe	89
PID 2444 wrote to memory of 848	2444	msedge.exe	87
PID 2444 wrote to memory of 848	2444	msedge.exe	87
PID 2444 wrote to memory of 848	2444	msedge.exe	87
PID 2444 wrote to memory of 4768	2444	msedge.exe	90
PID 2444 wrote to memory of 4768	2444	msedge.exe	90
PID 2444 wrote to memory of 4768	2444	msedge.exe	90
PID 2444 wrote to memory of 3684	2444	msedge.exe	91
PID 2444 wrote to memory of 3684	2444	msedge.exe	91
PID 2444 wrote to memory of 3684	2444	msedge.exe	91
PID 2444 wrote to memory of 4808	2444	msedge.exe	92
PID 2444 wrote to memory of 3092	2444	msedge.exe	93
PID 2444 wrote to memory of 1372	2444	msedge.exe	94
PID 2444 wrote to memory of 4808	2444	msedge.exe	92
PID 2444 wrote to memory of 4808	2444	msedge.exe	92
PID 2444 wrote to memory of 3092	2444	msedge.exe	93
PID 2444 wrote to memory of 3092	2444	msedge.exe	93
PID 2444 wrote to memory of 1372	2444	msedge.exe	94
PID 2444 wrote to memory of 1372	2444	msedge.exe	94
PID 2444 wrote to memory of 2696	2444	msedge.exe	95
PID 2444 wrote to memory of 2696	2444	msedge.exe	95
PID 2444 wrote to memory of 2696	2444	msedge.exe	95
PID 2444 wrote to memory of 1996	2444	msedge.exe	97
PID 2444 wrote to memory of 1996	2444	msedge.exe	97
PID 2444 wrote to memory of 1896	2444	msedge.exe	99
PID 2444 wrote to memory of 1896	2444	msedge.exe	99
PID 2444 wrote to memory of 3088	2444	msedge.exe	100
PID 2444 wrote to memory of 3808	2444	msedge.exe	101
PID 2444 wrote to memory of 3088	2444	msedge.exe	100
PID 2444 wrote to memory of 3808	2444	msedge.exe	101
PID 2444 wrote to memory of 540	2444	msedge.exe	103
PID 2444 wrote to memory of 1692	2444	msedge.exe	104
PID 1692 wrote to memory of 4272	1692	msedge.exe	105
PID 2444 wrote to memory of 2728	2444	msedge.exe	106
PID 2444 wrote to memory of 2728	2444	msedge.exe	106
PID 2444 wrote to memory of 2808	2444	msedge.exe	107
PID 2444 wrote to memory of 2808	2444	msedge.exe	107
PID 2444 wrote to memory of 5064	2444	msedge.exe	108
PID 2444 wrote to memory of 5064	2444	msedge.exe	108
PID 2444 wrote to memory of 1256	2444	msedge.exe	109
PID 2444 wrote to memory of 1256	2444	msedge.exe	109
PID 2444 wrote to memory of 1644	2444	msedge.exe	110
PID 2444 wrote to memory of 1644	2444	msedge.exe	110
PID 8 wrote to memory of 2268	8	nchsetup.exe	111
PID 2444 wrote to memory of 996	2444	msedge.exe	112
PID 2444 wrote to memory of 996	2444	msedge.exe	112
PID 2444 wrote to memory of 996	2444	msedge.exe	112
PID 8 wrote to memory of 4240	8	nchsetup.exe	113
PID 2444 wrote to memory of 4564	2444	msedge.exe	114
PID 2444 wrote to memory of 4564	2444	msedge.exe	114
PID 2444 wrote to memory of 4564	2444	msedge.exe	114
PID 8 wrote to memory of 3484	8	nchsetup.exe	115
PID 2444 wrote to memory of 2188	2444	msedge.exe	116
PID 2444 wrote to memory of 2188	2444	msedge.exe	116
PID 2444 wrote to memory of 2188	2444	msedge.exe	116
PID 8 wrote to memory of 1468	8	nchsetup.exe	117
PID 2444 wrote to memory of 2268	2444	msedge.exe	118
PID 2444 wrote to memory of 2268	2444	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\wpsetup.exe
"C:\Users\Admin\AppData\Local\Temp\wpsetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\wpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fff4b9bc188,0x7fff4b9bc194,0x7fff4b9bc1a0
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,16162880932247993520,8680008143463824507,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
      4⤵
      System Time Discovery
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,8613934707754872117,3990714892924980420,262144 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,2619548519422841302,16212629379342797594,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,16734179134646171415,16423625869148208468,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16723648123549006356,15423915668407912027,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8879786261394436641,9964064957393249839,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,12053768038662075231,17209006279786472975,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4164,i,8610965535168912821,10325226852723746446,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,12085759465437521207,8302959920225875478,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17359994362275514814,14777554879973998332,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12020868767449677881,35253731076161131,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,15577741580094347094,291185083199435024,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,18381938574941819539,11370097297047209747,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10321877924236714472,15961341777129319122,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,10321877924236714472,15961341777129319122,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,8086024041490083600,5791433791790968909,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,12064307302818448063,3072028763256207064,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,18081995386474114988,14392129545407461854,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,4246014441250657527,8128806829590658832,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,1856070683279313050,14467639699205471440,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3450287467302640060,16404212627051152369,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6856,i,9873762508880864165,11040855937161783684,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6404,i,13159781669036609816,14015772189905639683,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4180,i,8390973090214400303,6956074477150162357,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4720,i,13938618591486773511,4518133669466317177,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1182758824836239524,3616319267620870813,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1182758824836239524,3616319267620870813,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,9285219621622864763,9837642283374909427,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,15467058208881438224,3615619218279139565,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,9870459726572229723,1045792337272322601,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7064,i,16997301023097078190,4304623333843385461,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5996,i,10483108900962572422,11333420445321519058,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7220,i,12535955200047502224,4597804664664783286,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7416,i,4287947106437922341,10267414063916395785,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5592,i,5246757735093967185,1243119602222347223,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,15969723655219365167,13306275020071149148,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8008,i,555870065365573437,8021225116794912906,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7936,i,2825082500044356654,3650418285972019974,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8208,i,14520378356668159832,8616338184434506482,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8360,i,9044695337865839351,3176776069006172364,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8440,i,2622494491093754723,18316781702238971480,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8344,i,10636863566995772397,7655373740284846912,524288 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8728,i,17692565127822171591,12378170888073272419,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8856,i,12097738409249302862,10899889411343305572,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8936,i,3327604025697935275,4740084209237297439,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4144,i,3614379170728145171,8605652362855705811,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9272,i,16883759146814172321,12896599346872692883,262144 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:10
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8168,i,18025892843087464719,11490554377706144017,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=9332 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9488,i,7642398144728413351,13236549271211533895,2097152 --field-trial-handle=2088,i,8571325907352106154,5266306499142960178,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
      4⤵
      PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=WavePad&appname=WavePad&version=24.12&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fwavepad%2Fwpsetup.exe
    3⤵
    PID:3504

C:\Users\Admin\AppData\Local\Temp\wpsetup.exe
C:\Users\Admin\AppData\Local\Temp\wpsetup.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\wpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e365308021ade71cd7fd8bcb77743afa8328c70101415bb9b419c11ce7afa8b2
MD5 20d252cf697b00581a3fc1a7eb0aa400
SHA1 999f264f6caea10fd708d20094aec5024868af67
SHA512 7bdbd68d07d0b20ca7f49d51c821765822e32a81d51915eddc65d999ab43472632b096aaaf0a8fc634bc0a88ab61a5ff5c5b9e3a19f7fb7623f3e7b7a69eb13a
TLSH
T1ACD0805C17F76C31E554AD7004563F15BA55D5B39B49D73164732C791C4208215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a6727a0a4fa4cb1a57a4c321f756d9dd6f44ea45d205327c5e7e5f18c2f6950
MD5 8f53b23305ec44c09bb086cb47d00ebe
SHA1 a54d190b6b6e3b05a68b18a4e38bc67e0d914f6d
SHA512 24004588102e1fa8a9bf07c27541083145da06836345681ba0f438a086ca89db4bcfe563005d6b736f731acf1ba98f4abfdd021ee48bd0cd93d4afd01bba7f70
TLSH
T1DBD0805C57B76C31E554AD7004573F15BA55D5B39B49973164732C791C4104215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 124KB
SHA256 0a934429b2885209166260bc5ae471a920201cd2d59847746b90eba352901235
MD5 d9031f51ca752a099ddeb4bb07ed403c
SHA1 a3db7245391e8cc7bea94c69e6490c2936d14900
SHA512 2889238daf4342eeb9fc29aa2e3073ef93b1737818ec7ee151f18f39512574d5b8b6250553bebd4673425ce660cc97623fb6b5a4220d3c93a6c46e237bf1a285
SSDEEP 3072:BWjAYCDfoST5h9MPwJXIZ5OO69cNxufES77A43:BCAXzAPwJeOO6C6R3
TLSH
T11DC31216F1C2C01EDE946F706C47DE702AA054D3B2949689FAEC36694CB7322AD6B4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 168KB
SHA256 db9c6d045892bbcd91368eb5e5d1b03a9ad9d9967f1276320feb068e55663ee1
MD5 6948f4c80d35bf3ed091401aa860a1f2
SHA1 9e135f97c5c223fe2da84ba91995eea5d7108eea
SHA512 8b4e1d555a962e69cb82c8cb2063b4347eb0580b02b115de28d23789a4a9be2292cd35ed73acada57c846cd1e419398ea1cac26a1f5da47862ce2af4dd6d5351
SSDEEP 3072:PLZ0djqITuU7Hp9hF/p+izd7eXtgwLxQsxHCY7oHaP7vfpHhX:PeDBF1yzC0HCY7AaPDXX
TLSH
T1BCF3121611CBE24D9AA2A36F77A81F8A1973BBC0F737910C35ADE16B5144F1A407FAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24b6fbd0b47d8255_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24b6fbd0b47d8255_0
Size 260B
SHA256 7e3fc389ff442b30c8628aed51fac0784cb434d38cf602d63a9be7c55e1e0b30
MD5 78ebeda48a0013bb198c17ab55e4d456
SHA1 c78d29cfdfb580fd9133e8fee4d3648f8b5fbdc4
SHA512 53ac37b992d4519ca6512b5080e3d76693af94ac5fbcfe10686eb426cbb906f89fc188fcdcb0a43550b1730c89b938030d23decf6ac1a7696f18c669783f146d
TLSH
T1E9D097378D28C130EE0E83F0F32B3E0A3B13805A02AFA080831801354B224F0CE4A407
MD5 SHA1 SHA512 TLSH

Submit Download

2554581abc1bd937_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2554581abc1bd937_0
Size 494KB
SHA256 14448d6c8274a44eeb8ec48898fa794e88c3376a2b11ae71f365e22357a73e88
MD5 e4ef3e3170a7339ec2fe14878c5903e9
SHA1 5f336b0a19a5b7580630ecb677d906dde56dad3e
SHA512 b6b813f06f09a22b946f613c927079cd479b9817cbb15641fe4edd66166ee65c9ce8c494af8c8338fca9a2a767ba333d687dd0306a8282a39f2e92064774fa7e
SSDEEP 6144:lK1z3GYbSxvybqUxAoM2VkhntoPO8yS/SRfDK/pSYTLiDtbDs+Q0ZZt:gxoUxMqkNto//SZ54651
TLSH
T173B4B8249B917F72CBB253F60293C5277235459D2ED3810362A0BB292C1D2EB5E9BC5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d351e8a190c5317_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d351e8a190c5317_0
Size 3KB
SHA256 32d49f799b7f9e9d1b9d3f4376a3a6102300889981d9a45e2baf0979a9d34312
MD5 12712d1a15817cef4e6017fe47df3b6f
SHA1 a0d4dbcbc3e9747ade57b5caa8727077ef08110c
SHA512 3250a7a6856868b7e16b216576f2ed9b5f10259f7c4da99821de8a8d2c0ddf6af5785cac3e5bc9dcbe975c0ca5ed9eb23b556fd454bcdc1d619141eb34179580
TLSH
T11971E922D384240FC510A1F9ADA3CF2A7211B05E9BFBC37B142126725C592E64FA754A
MD5 SHA1 SHA512 TLSH

Submit Download

599b8d61ab8e18f6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\599b8d61ab8e18f6_0
Size 847KB
SHA256 c881f89835e76e69673049b8da70fa3fd66e5ab10c090350da07019a90624cb7
MD5 24c7589d01fa435bd2f590bd5ad5cf98
SHA1 fb38752aa8ef2552e67274348a1dba767f322bae
SHA512 3d6930d2724396e24ea282489756b93293039c8350bc94110871e8a6379dbd26f26657237fe94b8ddd58490810b96380e72f0cf54e96eaa1aa0e9ca17cb21231
SSDEEP 12288:pUhR2W/U9YJmizXM/8U4zP2u8llOymIsZqiD:0R2W/kWsoZo
TLSH
T1BE05A500DF80BF31CAB643B153D7D5767539014B2EA392439260BA2A6C2D2D76EDB85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6411216df07126e7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6411216df07126e7_0
Size 250B
SHA256 367bc4dffe320fd1a7921e2dea46b73c9528be3cbe98d445181fe96e77db1bc4
MD5 ba41e7e75ca9b5ca0f3dcc9de0a71f27
SHA1 b45bd7366dd082fd9c7fabc7e7239dd4af9ee822
SHA512 8bad85228717021c8d422e461e38d491eb90e7b1aff44055444c37fc83ce81d62bd6a0b00309df809c7bee6f2491ca6e0bcf0ccd40b658d32993bd4372f700bc
TLSH
T104D097D364302801CB0AC9B2C3967FD8BB2D43AC2F88A1E2083000F12701AA3570B454
MD5 SHA1 SHA512 TLSH

Submit Download

896846343fb215f9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\896846343fb215f9_0
Size 923B
SHA256 4593ce555b805c03631391d8a8dd23facdc6f44efaf89ddd65532a5e8935cffc
MD5 5d13676818da6b28e9bc87b2e17ba014
SHA1 60c886286dbf71dae1fcf9509cd05475af1830f8
SHA512 278c734d8be3b4217514607501dd728959d2384f9dad1ee3135f78ef6188a209cc38171ab7cc1f5f0af6ae4e70cbc1c592b4953cd86f57d6c38587e925e704a3
TLSH
T1A3111E5B8743B895C21927F2B1EA8326E33350CEAEABC70E8262067E1C161B66D24002
MD5 SHA1 SHA512 TLSH

Submit Download

9588c02798ed7e4f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9588c02798ed7e4f_0
Size 277B
SHA256 49dc72c4e18b46da7c28ade860f093be9aa688523dd2cb8514a918d27045fcd0
MD5 411e88c6fff61bd7bae664c982051ebd
SHA1 0f4d6a5dc41f86748ceea4a41041e85617511334
SHA512 5fe0d1a24a665dea02b9d57e8587ceb4d9ff17dfe3f401705e574ea6209c5a49fb99b497cacb317fdb5f560d1712d052aa9defb4d8af8c6538f4bab0154143c8
TLSH
T16BD02B03D2050C12C16AC7F2B376110D71A2A095806964E04C5C4C7966564F186AD611
MD5 SHA1 SHA512 TLSH

Submit Download

bd8028aaf0debe86_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd8028aaf0debe86_0
Size 11KB
SHA256 a9f0652dd7e90dfde7316db8f19a525a91d25100aa9874bae3e159c1813237e7
MD5 199af064d1d90c5a8d0198ea5401f605
SHA1 95d507809ef04d7da243275989aa1dbefdb973e8
SHA512 6fd3acd49087afff227d67e5581da5425304e8c936ecb2167fd3dabac418f871bdc4a2008acd0e6de8674f4a323f02555e3e70abe71215f9cb83433ca7f3aa8d
SSDEEP 192:RjySznATThB4Fe4C3ckzJLd5Uo8Xw7sV5iGi92g1RZjn8iQ4eMj:bnApCFCMAJL3e3ihD8p8j
TLSH
T187324DA0E7226097D0671FFA9996DA17D730E54D17C3527EE2E12A642C293F342DD804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcbb5b5026fc829d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fcbb5b5026fc829d_0
Size 79KB
SHA256 12873a23e8a5e7f7fab47ae5c29bdc26be70d2d98c5c50e9ce31405bade83a0e
MD5 039f07abedb3e74964d216b435f364cd
SHA1 5a240d1fa7e3ca127bb161f1fa1b2e4adeba8301
SHA512 7be5553b11be18c2f7400de9c6b415bc06535233046fc1681ff9b6d41f097af19aa0c8bdb93a6eb00dc2d5054e5c5548fbd43cecff0c67b42bf3f8f001367049
SSDEEP 1536:yYoTx71U6oDiwhL9kMWoenOrCHakl/FfohrXzu+DTXz:5QZ1vw1sdoenOXkVxoh/H
TLSH
T1C883F8142751B97ACF2643B6A1B68817B23602CD7ED7920617E0B3353C662F75E8EC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 24fdcb1133a33ed46a9bda03a7e4cc27718759c0eac952ce3256f9d7adb5c482
MD5 934a7021ea261336d35301038984aa92
SHA1 ca8f6b36ed690ebe9b17578bcca5733b261429b9
SHA512 f9956a2891810237fa4a25bb817c75f2976d5d2a50c917f6f0c6a94c2298cd18667c87f5557ed3c74fc543ad3c140407cb9152aa3ca9d4ca9d185f66d54101bd
TLSH
T15C71A2C84AE5865FF7E0CDF276ED104C7232899C97371E630DE8A0BC6A4973D6184914
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fb2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fb2f.TMP
Size 3KB
SHA256 c1e3dd1ba5704f3be721850220dc3a4a428f71706f8ec7fe80374686ebf076b0
MD5 ba20b9f969e86c3453f724537f2b35d7
SHA1 406724e58c3fed7967761c0cba1cbad211056684
SHA512 fc45e46bd9894a307d159fe42d1a618f91af9c99f221408e73679292ed4220880d26a48b952986653c8efa5f649b48dba6b76abbb5df0d5f02f4dea3774fb796
TLSH
T1C36172D89AE58A4FF7E0CDF276ED004C7232895DD3772E231DE890BDAA5973D0184911
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4e867b6d469b199c7aa24c709880ade799e1f7dfe0fc62f5c1dceac2edce49aa
MD5 37c36ce0361027fe4edadbb40ed25e3c
SHA1 f98c0fbff89d830978e7044e602dcd4eabcbc258
SHA512 b9ff81ac3472422e7273aa0ef673759dec1cf50af73afd6b654f6b76614858d6dbed7b7a7e32dfb20632ce6f44ebf70e2411f72480f16093d1b94844ea6275cf
TLSH
T12171BDF7C3D4C62DC91156F0AA18BF1BDE1D1924432C3D6AC8E4AF4BA3E2471E10169E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4f633bb4714a098ee76a789b31f4fc9af5517b6084bcd5f3178852f988fd367a
MD5 af587c1116dd86697fa93255d662e69f
SHA1 66f57a7052bb43b1623a5ec6f9d011be8b40331e
SHA512 ed3554616216e9b42f70a1589fb1a54d8516968ec6949522d4abb7839fdde7838e5cc917456d8c9502582b4c26f03843e412cd50ada19bcbe36b911d18a8865c
SSDEEP 192:sxZ9RgJyM//K1Ml8McC/fUsVeHGFvaIdpQr/W6+WNp2HfatrVx0Gf5a1Ig4J:sxZ9M0C/fUsVeHiLa/bifddc
TLSH
T1E9520916AA3459778CCBD219F955BB63D6F90463D2901E44AEFCDA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8fa3780e0c00aa83335ff5a3c02f61edee766bb127d06dbb766ba1b35d14bb31
MD5 7d496724d2070f664fccef9217c1c7c1
SHA1 284d08d5db2672a83309d3efb297f6da69e6abec
SHA512 c2c0cd094b98a0364f0fb9188a89fd8b92c909fb1e98f155d6f6123ea85b4aea97bdeb47d6684d995cfc8a04e1b703445fd1bc911a255bce7c5bb30e1ddb4b91
SSDEEP 192:sxZtRgJyM//K1Ml8McC/fUsi5ebGDJ4IdpQX/W6+WNpyJpatutE0GKata1Ig5qJ:sxZtM0C/fUs8eb2Ji/bqpLl50
TLSH
T168620916AA385977CCCBD209F550BB63D6F91463D2941E44AEFCDA1C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b0e90d3a10a8ae66508a9882eef9a30e8d0abd5b6e12dcda361def3715981c86
MD5 01b123ecb54069454f3c6bef0223c1df
SHA1 7ae4313ec07c61d929b7e43dac031c85c7ce1dd8
SHA512 d17bda01c5abea91fc406b1869de032c7e4baa23df1aeaf7e0c2b1f12def2872d9dd44f500174604a1d3d37e4c457b96822fbf250262d7f3db7c3670bbadb909
SSDEEP 192:sxZtRgJyM//K1Ml8UQpcC/fUsi5ebGDJ3Idpie/W6+WNp1yhatR1i0G6aMH1Ig5m:sxZtMq+C/fUs8eb2Yt/bSh4D90
TLSH
T176620A16AA385977CCDBD219F550BB63D6F91463D2901E44AEFCDA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d59718b856cca83841a1165f3cc0125a770107752d4d725104d48f80a7f70b9d
MD5 31e45b311df49b3361be885ac8f79760
SHA1 0bea1b507fdcbf1b75ea5d971577d76a67037d24
SHA512 8732428ff5f16e018d4b82e1fcd40aa76ea8c7cd6524a4c765923df2ea6b4270940ed8205c60b5ae437f624884ba8a54d216694d9df1fd9a4174c4dcdf415603
SSDEEP 768:W791L8/j2Ax7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3JFzJLlh:W791L8/j2AnEnqeWRmqSQBqu1jaKJFzN
TLSH
T105031B3B2C4CCB7E4F804E9CEC267F9A6DE8018B9698C95447EA884C03C76EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 e999e133cf29b3b18e7240122ddfb194a5d8519d5e8e57f5bef8a608d21465fd
MD5 ae112944c3fda9b0ab22f79facd3a1c3
SHA1 57a0523a0589d4b279c37ef04c1c268ee434f3f2
SHA512 9d557f11a4653fe23b7e28246e70bd1d1f9a6866515845b86436e5a42dfed7b438896ab80572b92bae7175db042ffac4bb7d4c99fc10e2f4d0991c1ed2858711
SSDEEP 768:Wk91L8/j2Ax7pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3JFzJLlt:Wk91L8/j2AnEnqeWRmqSQBqu1jaKJFzp
TLSH
T139031B3B2C0CCB7E4F804E9CEC26BF9A6DE8018B9698C95447EA484C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b4e59f6f4911cb36e9b24166b1d0e4e522ef3efee41db981630fe99d6e52077
MD5 5400f006d63802d28bb6b17099ab8e90
SHA1 5e171c6f67c0ac894ccda63ece923e38b3c4057b
SHA512 9083854b85fdd339bf8abe0b9950c66d2fc80255455fc6c8d87d103b037ef565566b4fe1a72cddc445c959abcd930ac1a4e72c36f15b5eb17b551faec6446e95
SSDEEP 48:KYfIJKEA0zyVNINKm4ofytTIBKIwUAX9XkXZXtX3X7XD:KYfSKEA62NGKm4SOT6KIw95wlpnLD
TLSH
T11B91E040B07E06E12A3D255A81D1B43B828531A7742DE53B3BB901E24B6EE11EDFDDCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c472a867-2721-46d9-9c43-24396af6cdd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c472a867-2721-46d9-9c43-24396af6cdd5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 280347500501017c66cbff856a7247d71fd2757be4fea73590767f6123ce2945
MD5 83c59535eaead1c008b4ae7622d3a356
SHA1 f78f3ed303206d59398ab83859fd3d00af03738c
SHA512 7522d81c8775b5c12b00e87e5c1a350c8377e6de16a53ac4b91b11113b19a1577bed002322240aec1e30b12c9006d97c8c6cc74bce43b1b7d2d5d46ed4f88080
SSDEEP 384:niSxmoWQ8Nkj88exPUEJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0QoUiw4k3L0mDcv
TLSH
T16D827C7568658D375AEAE245F5963243AFF8107BE6C82F44E6DC4F0E058A2CC234EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0f41df423b157796f11f302a284b3fd08e5efe97b408ff86d3760a0145fd6f25
MD5 d45a20ac766bcc325d65102bf59b7fe4
SHA1 b5f15fa12ceee097a75c94c7223548b4b2b6ed3e
SHA512 65e798852917aa22ce20269514679e8629a79d30e386a453c59e25fb56d2cfc5c485039ac6ac15fd07f3ec01bb646404af87d04120d72622fbe1ec65b0b4941c
SSDEEP 384:nrASxmoWb8Nkk88JasUCmDfQMX5Q/5+B8f5X1fL0mTV5fPoBv:Jx0bCUKEw4kpL0mDcv
TLSH
T10AC2A6F598E78937D99E5383637E2D429EBCD06771881984B7D81E0DCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5de2684e3709f9f14fb8b7b2d294c7d54ccd83b1ecd8b26099339c674ff735da
MD5 180e80c7b4c97bd8dc95cdaaacacb9fd
SHA1 e2941e8e929de33c5c71d0e13dfd90ad9244c2d4
SHA512 f20e4f47a6cffa4838ff429c2580f1ba5752325aff35162d5e0e0f22b959a4a96b49563b6bdcbc1b2b0dc0ecf87abe348744c24e89cc2cfcf497ca2cbc82e785
SSDEEP 384:niSxmoWq8Nkk88exKUgJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0qsUOw4k3L0mDcv
TLSH
T173826C7569658D375AEAE245F5963243AFF9107BE6C82F44E6DC5F0E048A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1ca486705653e44d58b78a98659bb213f388b26e6033a7eac592ebe88a68fac6
MD5 ac0ae84692fc9968606e64f3059b8026
SHA1 1276912321644031c5865039b6e4c26067df6c9c
SHA512 a0a26a538c2641cc2e11f8b07abbd5c5e60e2a8d7b4ce043a8926d85b8ddb89e78d5aeb90bb76da4faa43544b5dc347c28f1d2513e1899ab72e2d39cbea30483
SSDEEP 384:nrASxmoWM8NJk88EaeUUmDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:Jx0MkUFEw4kDL0mDcv
TLSH
T1A4C2A6F598E78937D99E5383637E2D429EBCD06775881984B7D81E0CCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 40aa72366b280918fc0306c8a5176ca773af05463b9fd5107d8642c2a152d093
MD5 79168843b8824f7c0a6351c54b93d958
SHA1 9eb7c3475455772501bcf32d69f9381897c0a747
SHA512 3401171d93a113ee4766b10a7843f8c0fb0f20b1b127d2fc18d1db3556dc1099491e9503a9a663e67f86ac80ad6422eb4ec56207be63c865505c229c23cf0ae5
SSDEEP 384:nrASxmoWC8NJk88haDUamDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:Jx0CiUjEw4kDL0mDcv
TLSH
T150C2A5F598E78937D99E5383637E2D429EBCD06775881984BBD81E0CCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 89b86866df5c0c94400819f4ab7aba4cadb1df873866eab669497f391b9e6663
MD5 1978cea4f1b543cbbae296e0c56534fd
SHA1 44159d948f58dff8dfb2043069e352c3487954f9
SHA512 038022f51d4c68eacd8b5cef6fe243215fdae8078308b7cf72b1baede6ea4b062f971748d71cda70472805c7ca1a4db295550af87a8d0f545a297654392e3824
SSDEEP 384:nrASxmoWX8NJk88tasUsmDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:Jx0X5UNEw4kDL0mDcv
TLSH
T1CCC2A6F598E78937D99E5383637E2D429EBCD06771881984B7D81E0CCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 55fe841a1e24ab245eb02220c8a64162ffac5756c27ed9ca758d5d02260174da
MD5 b4ca0dacc86879bca8f6445efeadf1ee
SHA1 d46ddf192901cab8a03998209da47cae6485282e
SHA512 f6eaccfe376dff1a27d324e2e3ce179009206cc2d4cdabcdb3560cb612d6de0247f72faba529527a6e3fc302237b416f54fa83130917d444f7fd322d7d652cf4
SSDEEP 384:nrbSxmoWx8NJo88aaKUcmDfpMX5Q/5+B8f5X1tL0mTV5fPoBv:Cx0xGUdEw4kDL0mDcv
TLSH
T138C2A6F598E78937D99E5383637E2D429EBCD06775881984B7D81E0CCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67459685dbca7a13d6c3ea8f2cdc98cbbf2755b20295a85e0afa4402033117f9
MD5 c34e6383a5f63135cf0d0b4cd8133479
SHA1 0392a0c94932336068ef3f414853a27574f0e45e
SHA512 3271300591afc4add937ff29c151ad7bcdf034a1ee504737fc18163ff9883b988962b1dbf621d659441583f13ae4fb37bdd6e93d7879451f9932d11dff223ed1
SSDEEP 384:niSxmoWn8Nkk88CxlUIJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0nfUWw4k3L0mDcv
TLSH
T18D827D7569658D375AEAE245F5963243AFF5107BE6C82F44E6DC5F0E048A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0baae1e1373df70a04f17768a9dd41a764f4c33f354ba8df902bcaca04e835fb
MD5 6a4cd5ae5c14ad4c63ac10388018647f
SHA1 e4b69c04c20bc252abcc36bb3c24e1bda17a725e
SHA512 d75bc7202d3b3ecca4ce881720dff244c08858802fb6b83173a392b6dbe03fb983f3f2be468d02c4841240f59decfd93bf472d572bfbf5d39cb86c6ae6283eaa
SSDEEP 384:nrbSxmoWN8NJo88IaPUymDfpMX5Q/5+B8f5X1tL0mTV5fPoBv:Cx0N1ULEw4kDL0mDcv
TLSH
T17AC2A5F598E78937D99E5383637E2D429EBCC06775881A84B7D81E0CCC862BFD709816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 59c98a2e651e116a05c06800620feae15abfe96734233f3ce45632bd5dcee148
MD5 849d3f443766d65f8bca2a7917842012
SHA1 274d003358b0225b877718cd557e6a6d58f5962c
SHA512 feac5133b1bb661b6556682d6b4753136a3a246eee64fee476d989360fd773cd8097717320d102c82ae64cba4a49f133f68323b9de577d28ca219e4d7e5d62e3
SSDEEP 384:nrnSxmoWu8NJo88gapUOmDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:ux0ujUnEw4kDL0mDcv
TLSH
T1DAC2A5F598E78937D99E5383637E2D429EBCC06775881A84B7D81E0DCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d3aaeca73d7cdd22df09c0db4dc5bb139a397d5835233209b0038d911f2946e0
MD5 aec23c9000cbcea9dac3baefcb216093
SHA1 e1cb8025242aa48f92cf29d15d3d365c97b11f40
SHA512 6acac0ab06d3a80f640da1f0df78862b9398c726837f2c1a8ff392d2ba30a7431e581e35f2a247d5637b2368277a8fcf9922e0c618a6c97cd51a4b508212861c
SSDEEP 384:niSxmoWN8Nkk883x4U0JX5Q/5+B8f5X1tL0mTV5fPoBv:zx0N7Uyw4k3L0mDcv
TLSH
T1E0826C7569698D375AEAE245F5963243AFF9107BE6C82F44E6DC5F0E048A2CC234AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 faf99fd3506b720a8287ee5a8c1b7f59e784f09fc85ca20727dc92495cf9b9a1
MD5 ad8c719d57f2db31b9e721d2e669202e
SHA1 04e79e0062520e6daccde1bbc32ef288ddec5f11
SHA512 6ab2ec9adb4f662caa3916964933e42e06677bde608d5d66e99e21768e0c1709c12aa5c2d95ab6f6165dc4479719952ee2bfea3b7bf2d80579655c38056ee7ad
SSDEEP 384:nrASxmoWh8Nkk88wa3UkmDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:Jx0hyU1Ew4kDL0mDcv
TLSH
T19AC2A5F598E78937D99E5383637E2D429EBCD06771881A84B7D81E0DCC862BFD309816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfcbcf49bd4c16094c3ed3752df5c9092051c16f911874e4dbc3ba502009ab7d
MD5 f69fde56892de7017b35d21834b97205
SHA1 e71b312d7a24b378d3213d1d7d30a93d63a944c7
SHA512 b62b05167c08ce2c099f3e655f4b26f9922b61d9d488288c09414231891bdc1b1def3317e30d9ee4e214ca0ec137f59a4a4f84f4eaa941bff66b27b9d91222af
SSDEEP 192:YGNd6hEQmiUyAlaIYX5Hw/5+Njzorf5XRxh/vqLLFqWsU6:YGNd6+p8IYX5Q/5+B8f5X1oL0U6
TLSH
T1D512F975B869EC375DE7B544B08732939EE42077EA89AF44E6E81B1C00CA75C2749D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3c62c029337c28988ed6b8e1d6e5958acdd4eb15c4237b226c41693f6af10d8b
MD5 7b23d845437a69dd01f73c8c7b2c3871
SHA1 de97f5c6b12e32896acace4b9cc212f0f46f216a
SHA512 6a5d65bcd7274b4933fbeef43efcccee813c04c1df4d53e8f3ebbabb3fba3db2c5c9754db25e8f4c3b694e1720b2a4920d1b74fa0bf33e85cae9fdbfe1183205
SSDEEP 384:niSxmoWg8Nkj889xzU4JX5Q/5+B8f5X1tL0mTV5fPoBv:zx0gXUmw4k3L0mDcv
TLSH
T166826C7569658D375AEAE245F1963243AFF9107BE6C82F44E6DC5F0E048A2CC234AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af255e0ed873d2b80ba7fa646f7eb2bb12ca03cd86d56055dd2167721c0df290
MD5 cc5ee03d74fae8a55e25d413a37a08c2
SHA1 8d22b069fda310356d04ec8ca5aad5d5ff42e199
SHA512 48dd55b81016dcfef12e42cd2d59b7c3e961da780343b126f53d40936cd6f33e6d9369d550a6e1dfeac08f8749915e486aa6d91762789ab1ca1bc84a0ee51918
SSDEEP 192:ZGNW6hNQmiUyVGhaNYX5Hw/5+NjzorfLWYLnRU6:ZGNW6RaGQNYX5Q/5+B8fLLRU6
TLSH
T11A02E939B9687C779EF3AE49B44726139FE4103BEA956F84DAE80B1D00C765C2346D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a01ce3c412c199793378e5539b51629a4ef11d5e63506a08940f6110f5dddb16
MD5 5647282ee00ba40bd00826a1a73d76c5
SHA1 fc6e32b746a81b7606c9f4209502024fea5ac2c2
SHA512 1fdc09e1d7a37b6044ab5293d729d2c287bb229b4f8940f46061cd6e13fce1bf606a21e1b0138b26e1035eaf989f6dcef8f956af4168d5a24847bb770594227d
SSDEEP 384:niSxmoWa8Nkj88MbxwUJ2JX5Q/5+B8f5X1tL0mTV5fPoBv:zx0aHUJQw4k3L0mDcv
TLSH
T1E4826C7569658D375AEAE245F1963243AFF9107BE6C82F44E6DC5F0E058A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 98f0fb9b6212371ee5609b2adc934cd354a201da3ee21c81b2643ad326316993
MD5 1a6cd12d1415df998ff62f05623294bb
SHA1 8cc7947eb891bdbe3a7dd5dba4de2876979be68d
SHA512 1ca77c1c0c36ceb38b3cd2b56283b04957d07eeaaf454d121c7a4be9ef508868dfd2297d20acc8df245166ad2885f38071dba945806829c8366018871366179f
SSDEEP 384:nrASxmoWl8Nkk88WxpUsmDfQMX5Q/5+B8f5X1vL0mTV5fPoBv:Jx0lfU8Ew4kpL0mDcv
TLSH
T153A23979E8A5CE37ADE6A386B2467683AFE4106796CC1EC4D9DC1F0D04C72DE170AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9eedb5eab270741efb804f6165d204a1fda9291f7663adde2c32e024a467f165
MD5 0757a5b8cd858ab80927ba989d7ebf45
SHA1 6fa37d2a6d5de2ac38217e50d223dec8209c5610
SHA512 0ed4b18da669c081def4f90f9c0201edcee2cefed8242659e9445346ba4004d3913b29c1f16991562bda746b1d37db28ea90115199ff05c50c00fe1386a97bf9
SSDEEP 384:niSxmoWP8Nkj88TxdUkJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0P3UCw4k3L0mDcv
TLSH
T15C827C7559658D375AEAE245F1963243AFF8107BE6C82F44E6DC4F0E008A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d5030bc5b55323f7399f19d93d2bc71247d6c0b28d37f202ca2570d6663439dd
MD5 a8e3c36d3b7c426c12a30401def6c2e1
SHA1 b2b0ac7e153ea1361cd69e0e95ca03edc32b9c49
SHA512 56a29a8da19c684490eec3476ea26fb0e9cf020b85ffc93c947613921700b7d8b5e4a7be5aadb9addb8ec815806dee4907ee7f551ec7d7161f3f11c3d8befc56
SSDEEP 384:niSxmoWdA8Nkk88zxDUEJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0WEUiw4k3L0mDcv
TLSH
T182827C7569698D375AEAE245F5963243AFF9107BE6C82F44E6DC5F0E048A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 44dcaae6d73c69e336ecabb80a8e51675d400a9b2fb91e6522f7cad85df20ca9
MD5 39630a42b4e59f037b040530207bfa14
SHA1 9c7205e18bb40192a5d5c511eef2b5df1884e5e1
SHA512 26a7eb03db819024a5ae2f56af8d3afbd40ad8c4059d969549d74bc0684f7ea15a0f94e1b165c3643ada03f5304297543103c17d6a75418765f423ba167fba9c
SSDEEP 384:niSxmoWs8Nkk88BxeUYJX5Q/5+B8f5X1tL0mTV5fPoBv:zx0s/UGw4k3L0mDcv
TLSH
T11C826C7569658D375AEAE245F5963243AFF9107BE6C82F44E6DC5F0E048A2CC234EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57ec98016645fcd07230ff231d9b1e04bf078760025fd042a96400baf5c90c25
MD5 86d0113ef70f234027bfe75cea6ec538
SHA1 9279d9fbe11cfc804ceb600a7cd139009dc78780
SHA512 ca70e2b18336704d6e6393e37e7c8a37bb82fd47fba9b64e024fe2f41de88d9eb1e7b5c7054b44bcd0165197e8dec0c8391ac983263dbe94d962152e322e2940
SSDEEP 384:nrASxmoWQ8NJk888ayU+mDfpMX5Q/5+B8f5X1BL0mTV5fPoBv:Jx0QcU3Ew4kDL0mDcv
TLSH
T1D6C2A6F598E78937D99E5383637E2D429EBCD06775881984B7D81E0CCC862BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2490f2a3-a666-4272-8196-751715dffd73.tmp

Path C:\Users\Admin\AppData\Local\Temp\2490f2a3-a666-4272-8196-751715dffd73.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9040a8ac-4613-4079-a732-d61feadb1016.tmp

Path C:\Users\Admin\AppData\Local\Temp\9040a8ac-4613-4079-a732-d61feadb1016.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
Size 9.7MB
SHA256 75a3fbe0cc4ee6240157334dd287316d2e761053dfb34cd249a8fa53fa303998
MD5 d2245ce916e91358451868cbe4904244
SHA1 b04a2fa97248b0ef7c97c58dcf3769ff79723394
SHA512 3a8156249a4c143c050ff055ce208d651e21c6f445d1e89f25ba5dad96946704de91aa374ba924384172d3b1c76c34ede39cef8a1fb60e438b1db02af0291488
SSDEEP 98304:mzlZBsTqJcoID//gEobKnV4N8TAYKBrICr7uk3DfKIH2OY7QwfnK0Q:mpuqJco2Xis4N8T4rrT9NwC/
TLSH
T13BA67B02E7C68675E0AE2B7098FB2315A736BC205BF583CB97943D599CB13C1AC71396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.cab
Size 398KB
SHA256 562df9f0eb72a98d982af46f288ec7014f415dde6cbfa1fd4d87ff63946c1e44
MD5 e0a5cc6c0f26382b5447b5596868091d
SHA1 b27327206c69485465d8f65a4b95b02f1b6d5f13
SHA512 877e336ff947d30d5507eae152cba22fed20ae110172c925fe34af6b2d34b760bcf9dfa59d120cbb0f0fa339b991ac6796d2946cf12f7553c4d148c42b8b6160
SSDEEP 12288:F4mq/HMN17/KhHHPxPB7hT6emFv9wMEjvf:im1i9PxTmemFv9wRjvf
TLSH
T19D8423B7E3C61D64F9BC8DB11990A7607F80960D3C4E76F876D64AA36BD90224CCBB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.cab
Size 3.2MB
SHA256 2a5f2ce527886f8d098d81be2e3c0ea87de3db818a7576c3386d054668055afb
MD5 b7d4ca177770b50c10383bc836d70da3
SHA1 af0b4c345741f410e7e56ee709569aed75862420
SHA512 c6fcaa7630bc6fc1980693cb7ed2493ee726808bf8544df59b51871543678c0871fbd4fbb2750f5d88d1a7cad87d3fea9dc1117f25a528b06bf05a161e6ba8b9
SSDEEP 49152:gwhcmY4qBzd//SMNIeXTp9/+j9MSymNG915nJDld4Myc:gMcmYP5hBIITppMNGlnJIMz
TLSH
T1A4F53309849E0113FA1E49EC69B040D26F478FE113DCE491EE81CDA96278DF6DD36DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2444_1177909931\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efbfe6ed-55aa-4575-be61-854b02924ae3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2444_553378253\efbfe6ed-55aa-4575-be61-854b02924ae3.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2444_672098744\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/540-582-0x000002123EE00000-0x000002123EEAF000-memory.dmp

Download

memory/1288-712-0x00000229D08F0000-0x00000229D099F000-memory.dmp

Download

memory/3108-34-0x00000000027B0000-0x0000000002871000-memory.dmp

Download

memory/3908-87-0x000002D03E670000-0x000002D03E71F000-memory.dmp

Download

memory/4272-178-0x000002410AE30000-0x000002410AEDF000-memory.dmp

Download

memory/5108-35-0x0000000000DD0000-0x0000000000E91000-memory.dmp

Download

memory/5108-615-0x0000000000DD0000-0x0000000000E91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads