fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23

Resubmissions

11/05/2026, 01:14

260511-blqbbahs9v7

11/05/2026, 01:10

260511-bjmseahs5x7

Analysis

user interaction
yes
max time kernel
356s
max time network
361s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Antares Auto-Tune bundle V9 CE.exe
Size 110.0MB
Sample260511-blqbbahs9v
SHA256 fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
MD5 cda53632778d1ced63a7c0809b71cb86
SHA1 f7d30963a0d45f35cc015f5c5e5ed58276b0e628
SHA512 8b6cd507fc76d75aa2d96d5546ef1d12f0c25c015bd195cee914d5501ec277b41801f1adb171ba67b164a3e7e68fd3d232ea9f7903cf11443f9a83db0be18b2e
SSDEEP 3145728:8aDfXHRtVR2oE76WDIJZZPlPZrbsAjHMZN1cy:86vHRtVRu7JsnN5ZfsAjsn1H
TLSH
T109483347A255AE3FC069A73556B3E41058FBB35AF84A9D2226F1C5ACDF221C04F3B871
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4948	Antares Auto-Tune bundle V9 CE.tmp
3344	Antares Central.exe
5904	Antares Central.exe

Loads dropped DLL 1 IoCs

pid	Process
5200	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	drive.google.com
120	drive.google.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\vst shi\Antares\desktop.ini	Antares Auto-Tune bundle V9 CE.tmp

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\T:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\U:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\X:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\B:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\G:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\I:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\K:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\O:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\Z:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\H:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\M:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\N:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\V:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\Y:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\A:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\E:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\J:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\L:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\P:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\Q:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\S:	Antares Auto-Tune bundle V9 CE.tmp
File opened (read-only)	\??\W:	Antares Auto-Tune bundle V9 CE.tmp

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Antares Audio Technologies\Antares Central.exe	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\is-8V4AL.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Access\is-J4HGG.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Artist\is-B6F2S.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune EFX\is-2FL90.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-IDNQU.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-MFUKQ.tmp	Antares Auto-Tune bundle V9 CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-EUANI.tmp	Antares Auto-Tune bundle V9 CE.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_18062126\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_730812876\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_730812876\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_18062126\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1494021090\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_18062126\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_2033727084\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1599746682\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1494021090\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_2033727084\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_2033727084\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_976938395\_locales\my\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares Auto-Tune bundle V9 CE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares Auto-Tune bundle V9 CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares Central.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3684	msedge.exe
3076	msedge.exe
4416	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2820-0-0x0000000000400000-0x00000000004C8000-memory.dmp	innosetup
behavioral1/memory/2820-7-0x0000000000400000-0x00000000004C8000-memory.dmp	innosetup
behavioral1/memory/2820-293-0x0000000000400000-0x00000000004C8000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229358788028361"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{50AF6C3E-9806-4EC7-BFC9-C5E533A4A6D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{62E861E1-FB6C-421C-8EC9-8EFFDA27C0CC}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4948	Antares Auto-Tune bundle V9 CE.tmp
4948	Antares Auto-Tune bundle V9 CE.tmp
5200	msedge.exe
5200	msedge.exe
2372	chrome.exe
2372	chrome.exe
2188	msedge.exe
2188	msedge.exe
2372	chrome.exe
2372	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4948	Antares Auto-Tune bundle V9 CE.tmp
3196	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4948	Antares Auto-Tune bundle V9 CE.tmp
564	msedge.exe
564	msedge.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3196	chrome.exe
3196	chrome.exe
3196	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4948	2820	Antares Auto-Tune bundle V9 CE.exe	79
PID 564 wrote to memory of 3756	564	msedge.exe	85
PID 564 wrote to memory of 3684	564	msedge.exe	86
PID 564 wrote to memory of 2932	564	msedge.exe	87
PID 564 wrote to memory of 2932	564	msedge.exe	87
PID 564 wrote to memory of 2932	564	msedge.exe	87
PID 564 wrote to memory of 5552	564	msedge.exe	88
PID 564 wrote to memory of 5552	564	msedge.exe	88
PID 564 wrote to memory of 2704	564	msedge.exe	90
PID 564 wrote to memory of 2704	564	msedge.exe	90
PID 564 wrote to memory of 2704	564	msedge.exe	90
PID 564 wrote to memory of 3504	564	msedge.exe	91
PID 564 wrote to memory of 3504	564	msedge.exe	91
PID 564 wrote to memory of 3504	564	msedge.exe	91
PID 564 wrote to memory of 1460	564	msedge.exe	93
PID 564 wrote to memory of 1460	564	msedge.exe	93
PID 564 wrote to memory of 1460	564	msedge.exe	93
PID 564 wrote to memory of 5172	564	msedge.exe	94
PID 564 wrote to memory of 5172	564	msedge.exe	94
PID 564 wrote to memory of 5172	564	msedge.exe	94
PID 564 wrote to memory of 3852	564	msedge.exe	95
PID 564 wrote to memory of 3852	564	msedge.exe	95
PID 564 wrote to memory of 4232	564	msedge.exe	96
PID 564 wrote to memory of 4232	564	msedge.exe	96
PID 564 wrote to memory of 4036	564	msedge.exe	97
PID 564 wrote to memory of 2680	564	msedge.exe	99
PID 4036 wrote to memory of 3952	4036	msedge.exe	100
PID 564 wrote to memory of 5200	564	msedge.exe	104
PID 5200 wrote to memory of 3848	5200	msedge.exe	105
PID 5200 wrote to memory of 3076	5200	msedge.exe	106
PID 5200 wrote to memory of 2564	5200	msedge.exe	107
PID 5200 wrote to memory of 2564	5200	msedge.exe	107
PID 5200 wrote to memory of 2564	5200	msedge.exe	107
PID 5200 wrote to memory of 5456	5200	msedge.exe	108
PID 5200 wrote to memory of 5456	5200	msedge.exe	108
PID 5200 wrote to memory of 5360	5200	msedge.exe	111
PID 5200 wrote to memory of 4392	5200	msedge.exe	112
PID 5200 wrote to memory of 4024	5200	msedge.exe	113
PID 5200 wrote to memory of 5476	5200	msedge.exe	114
PID 5200 wrote to memory of 3928	5200	msedge.exe	115
PID 5200 wrote to memory of 3928	5200	msedge.exe	115
PID 5200 wrote to memory of 4148	5200	msedge.exe	118
PID 5200 wrote to memory of 4148	5200	msedge.exe	118
PID 5200 wrote to memory of 4448	5200	msedge.exe	123
PID 5200 wrote to memory of 4448	5200	msedge.exe	123
PID 2372 wrote to memory of 4264	2372	chrome.exe	125
PID 2372 wrote to memory of 4416	2372	chrome.exe	126
PID 2372 wrote to memory of 4588	2372	chrome.exe	127
PID 2372 wrote to memory of 4588	2372	chrome.exe	127
PID 2372 wrote to memory of 6036	2372	chrome.exe	128
PID 2372 wrote to memory of 6036	2372	chrome.exe	128
PID 2372 wrote to memory of 2552	2372	chrome.exe	130
PID 2372 wrote to memory of 2552	2372	chrome.exe	130
PID 2372 wrote to memory of 1500	2372	chrome.exe	131
PID 2372 wrote to memory of 1500	2372	chrome.exe	131
PID 2372 wrote to memory of 4880	2372	chrome.exe	133
PID 2372 wrote to memory of 4880	2372	chrome.exe	133
PID 2372 wrote to memory of 3216	2372	chrome.exe	134
PID 2372 wrote to memory of 3216	2372	chrome.exe	134
PID 2372 wrote to memory of 4296	2372	chrome.exe	135
PID 2372 wrote to memory of 5172	2372	chrome.exe	138
PID 2372 wrote to memory of 5172	2372	chrome.exe	138
PID 5200 wrote to memory of 3020	5200	msedge.exe	139
PID 5200 wrote to memory of 3020	5200	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe
"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\is-D48KA.tmp\Antares Auto-Tune bundle V9 CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D48KA.tmp\Antares Auto-Tune bundle V9 CE.tmp" /SL5="$802D6,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:4948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Antares Audio Technologies\Auto-Tune Artist\Auto-Tune Artist Manual.pdf
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffc5537c188,0x7ffc5537c194,0x7ffc5537c1a0
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,310587056747523010,6384264053464785723,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,8231676822869341972,2030371669272741203,262144 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,13809564063332945226,11854760830269602015,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7060028574400936075,5230099115561885178,2097152 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,12747797399331955282,16894500970029070840,2097152 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4812,i,5924329987689019324,5152687242191437783,2097152 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5012,i,13076778732135228887,7960751769603437881,2097152 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:15
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,8383658612765039786,9390152222724026766,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,13368628350506598595,16519810358456451427,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2981914305007372268,18272201040755618383,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,4126485571081305857,13451490840105494954,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,4126485571081305857,13451490840105494954,524288 --field-trial-handle=2032,i,4776349854472309816,12056026241961230435,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x264,0x7ffc5537c188,0x7ffc5537c194,0x7ffc5537c1a0
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,4924415198571483700,12987992580534875361,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,10043894992304555197,16432404551693747710,262144 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,11586605654420587503,16663219505254847609,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10305504433976752935,18291488315536103779,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10305504433976752935,18291488315536103779,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,5698299299736311121,15998961104390592205,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,2159824426627115974,8075867375107649617,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10672367776162945247,2691310735476851097,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,15647757745711210781,17554285039145109405,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:14
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,8812593488506298541,4181247305696496206,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,11843150342755530110,8828450468143548928,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11544212073813315843,15305511348384374298,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,10246451596747890985,10833732368977703002,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4568,i,11503828226506290714,405685925042253506,262144 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,3837861324189016277,13253970429820788155,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,7641562232866348682,3034115077770360502,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,5308342264148538574,5086645582826075649,524288 --field-trial-handle=2132,i,8392510221363461497,18384528587426513710,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6040

C:\Program Files\Antares Audio Technologies\Antares Central.exe
"C:\Program Files\Antares Audio Technologies\Antares Central.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3344

C:\Program Files\Antares Audio Technologies\Antares Central.exe
"C:\Program Files\Antares Audio Technologies\Antares Central.exe"
1⤵
- Executes dropped EXE
PID:5904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc52c4c728,0x7ffc52c4c734,0x7ffc52c4c740
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,11200254776819834753,14375613187366697977,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2004 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,2610369822533032269,9086310073754019335,262144 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,11623007537293095135,1609224157473243255,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1828 /prefetch:13
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,11636363869331178174,15214759439309659276,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,2983360650985908462,16048255040058901630,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4080,i,3272850909760322945,13709621146563795891,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3892 /prefetch:9
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,3680724802977975019,3719354608922015063,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,2530327362351389971,3313774344623519893,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5792,i,17104840777313341851,4696390160673561781,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3664,i,10507272888346643873,15363977601982546337,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3348,i,9743127316111082640,14828148464770966451,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5396,i,16528822542452182707,4881174262432080932,2097152 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,10379154052781729812,5744516538915974027,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5896 /prefetch:12
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,6150424817787645006,6047831442164744453,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,1773815601244537126,12228116862323147627,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,18123933629330071989,147182044784657263,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,9479602320337225570,9843598534072455792,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,7401839485826610568,13735987673848635031,524288 --field-trial-handle=1976,i,511588430446375409,7421303332030987281,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3604 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Auto-Tune Artist Manual.pdf

Path C:\Program Files\Antares Audio Technologies\Auto-Tune Artist\Auto-Tune Artist Manual.pdf
Size 701KB
SHA256 8014e006ab312980c9e0223aff0934037af3f4705a532ab3add14173495e3e22
MD5 efa9d6aba2ff6c9089ce42e1c44b6fea
SHA1 8f92f99b41b291546db62d8f74d6f1ba508e4a51
SHA512 457b91d1a87aa7148c767e439fd2b80ca8d372197b091cfc82a4edf34658ab7f239f269072a13865df054a4273bd7b110602732931d7ef8f9e9d1680b3f36973
SSDEEP 12288:l/ovYDu7LfW6//j/ZamLv0w7m4vWOUKJy8MvvnaUADLvvdpCgze4z7j:l/iIcJ//jB0wCAUKJwvBA33W4zX
TLSH
T145E4DF17FC880E86E829D7B07D676F6C2B5A3B1D98C47AEF04250ECB7E601554C8A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ea98764ecb9f95fc92aabdd43629306db2656f79ae05b51cd69ad498fe9cc726
MD5 c04c0d8bb7db86e23386139f0ac41725
SHA1 b971068ff3fd2a39c52ce3c95c8eacfffd2eb502
SHA512 8800139bdc99eeedd8be6d2bc461e46e1ea622227b670a4fcdfccbf4e2cfb9c6f7593f0a9e31a06087344094d744900356cc2196ad047a10b3e6cf674d0c85b6
TLSH
T191E022A6CE65DC370CFD0B2861514349E788035B2B91894F7B3E960E8FB2A3E468681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 75KB
SHA256 db4ef6f2ca5d724ab347259ae99aa57684054798205758ba623b6003be969503
MD5 3f45646b158aaabf662f801ab6634f0d
SHA1 c29c034626ba528bec247b567968a823d822a164
SHA512 53e2391e3d3e27016e609e6faeef746e36059750d35e498b23bc5fbd64d54a56b543132d96778c6fe00e31a03158e7cb28ee7bf3098ff1140efeefcbe80c2642
SSDEEP 1536:TxxCnt50kmaBe9tS1CjYamxa4TQ2XCh6Lfc3e1BaVX1BL2dS1+ijG1:HAXnp49tKCjYjTQiCKEu1B2idStjg
TLSH
T1257302A351D8DDDB81B17CAD414F97CA9C388AB7333038E681A07ED2CCEF6191852A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c
Size 131KB
SHA256 0c3771d4d2923df587b067eccbb66d1952c7bf327ec508f4fdd8fda4fc3760ca
MD5 7e78e0ecbf434c70839f40be62ed7db9
SHA1 8dc210da0370f87938e248afa1b9386b48ef00e2
SHA512 e218b29b0e6b8af6455f25d372cc0480a3f1da0d3e120504f87a87a660e75ea9e8306ae6345499d6851e8967c247b395085545186ad0c82a3d67c2492e943cd8
SSDEEP 3072:UbIApdqP/2rS4zf5vUcXdRHsZ9R5wxP+xuSrxOryk6roQtsE:bzP6f5vUcLsZ9L/Gyk6v7
TLSH
T1C2D31234E4EAAB01EEEE55D6BEA27C82C18FBE86755D07BE0C5371DE21A24548E5C10C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062
Size 43KB
SHA256 d82724fef81dd49f492421d84bfea6814bf598b526785a9c0d58ffe471d55ae0
MD5 064a1da99d701fae61b3dfc0e700520d
SHA1 d9f0698d883c745a87662b78381f40ad9eb95bd7
SHA512 976957b2c66b6d2c9a77ca5eeb3de435717b4a0b639774ef2a0408d29b8e312896872e46d20e1550cb46bb268cb7f58cfd1ebb5aba37eb52ebcab5d9bff1c578
SSDEEP 768:jYn66dyELLcTp4ATdgak6SolfdYR5dD/OxaBWjE6XOKuK084p5fzIh46Z4UQ/AS:jYnJyXOeSolfdY/dD/ODJF4fIejUQ
TLSH
T1801301A60BBBA993593AF4E8535E347020F1CD80C0C7E6D52BEB749619752432863EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ce2d1ee92b3f8f791d12fedcbe6eeb789504fff64564d1807a4e248711b25fb
MD5 9e657587a9ff8a15b906c4d5117d52f2
SHA1 999c5394414b1b6fec1985715d95100fe7e2c68b
SHA512 96d2a9d66d0b16b5064fa5a07ac34cffd5bada1c5903dfad618ea34fe465943e1f29be957675f338ef388e8d45fd7583141bc4e8f75b2732de25d76dcf8af816
TLSH
T11771EC88D78530F1C3E012B6FDAD098B6CB6294AE8A31E7A65FB9CBF14633251448721
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_docs.google.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 1bda726386c42a12e889c6ca6e421229285740d61ffa00359657919ff4681665
MD5 9996387059ab5aad2d5b93a0947a7c98
SHA1 25faa4c01d7e6dae8631601ed13e5bf0511856a7
SHA512 ebe2e765157a5dd21b2c8a232fbbf0ad08949d291d8b751401d02b453d67f31addd06b97b8133490e78b2276251e793ec2efb27e744fa1e330d64be74dc2e279
SSDEEP 384:Dpao7CkYci+L5LJxxJl+71DxJrxKJGPWV8mYaaMnNYV3yBwhp1FNeVFn4xUFWxXG:Ue
TLSH
T19A82ADF7C3D9826DC95156F4A715AF1ECE2D0A18431C3C2AC8E8AF4B93E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 cac8dd542eb2883ff7e8b4258fee0b232a4ce95d90a39cb63a6b589b448b58df
MD5 105f29b6a04c53a0c04e81d50af488a4
SHA1 84c27eecdb73d32dc3c156dcd310548c04655405
SHA512 be742a1e21c9ceb46c745b796330e9edf141e2623d4eb92f0c8535e48ac10ba2411e58e79ea012d354ff9f61555aa9761856263c9f5557ad5313f25abf7f89c8
SSDEEP 192:Dpao7CkYci+L5LJxxJ9aaMnNYcZdpdPVYaFBwhp1F2Bd0saJ2nvPQZjhggRm1tY:Dpao7CkYci+L5LJxxJ9aaMnNYcZdpdV6
TLSH
T12B228DF7C3D9866DC95156F4A715AF1ECE290A14432C3C2AC8E8AF0B93E2871D21579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 3b849adfb61868f738eb9ff25515bd768c0f622807eae1722bea60a293fbd8ae
MD5 5d8b71d276d1ee78fb8e5ec00204a93f
SHA1 3fbf98ec7bfd8db5fdaddb695aab8b1c582251f2
SHA512 fe6a45d528112b4a372481f8fab1d37e462256ee493b773b16fc456f998cd54a79ba28529df82359697af55c2520bf62bfc6e8fcd19adc79c41e12f7ef0a5ece
TLSH
T1045177E7E27FB867A03C4DB75E08BC0A2979FD3246D164F4EA62C16CA0418F71B12427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0747e9e37d4a2dba8786ff9315189fe09bf104fca1247223905ae9961233a24d
MD5 284dae99a07a16bf1abe7cfcfee30b2f
SHA1 26296ab6464e2d958ad6457f9679cfa50f6579ac
SHA512 d9210f3f7338473f9c5c6fed1f64656caa2273dc552fd66c9174885c42b62ecb08559949ba168f1a4f3db5216b5dc531383478d6e43a00b565f5bd6b9da0be51
SSDEEP 192:dRFcBzC2AcDp/iQv7gpAPRp2ig7J499Hsb+WNn9i44/2yR21L+ckkwkaUlgVyIsH:dRFmzCbPMsUXv/wED2+21LwEaUlk8
TLSH
T1F052D62EB914753B9CCBC21AF912B717E7F5102265982EC8E7FC892C18E79CD6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5b268352443e69b4ad2ecc46754b75aa66fa6c15ee61f78622c92f6ee9fb0024
MD5 90c2aa04dd4381e91b408fa4ac7fb7de
SHA1 4536a732c51599b7339b093c3f42ff4675e3518a
SHA512 c7f28dfe43c1bf892847c7a44221d3a8eba3bc33bc909d889a4a72f544a8303408b683c9fe0e807b6052bc8a756fec830124fe0de23097c0a6944bf9f30276a1
SSDEEP 192:dRFcBzC2AcDp/iQv71WpAPRp2xgwg7bS99Hsb+WN4L9i4JOeGR21L+ckkwkaelgM:dRFmzCbPMIUXu/wBfeC21LwEaelke
TLSH
T14152E92BB914353B9CDBC21AF912B71BE7F5102265982EC8E7FC891C18D79CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 b855c09dfcd716fe8032eaefa6eec67fea46e1242b21a9c053073f54e152b947
MD5 e44e275d36ee662fa3ce56a991775311
SHA1 c71f3346e43be440f4be41947f3bca0a48ee5942
SHA512 d8ad42fc3a5825bb86c38b404dafae82fdd01e62718aa7334d9771964e8a6398373dbfd279965c28e5dcfe5af790fe8835f03de4380c44dd92fdbc5ad4a0e22f
SSDEEP 192:dRFcBzCXAcDp/i0v71WpuPRp8MsfvrPgg7g9o8sb+WNviL9ibmN+JOeER21L+ck6:dRFmzCQPwIuX3Xw7wdeU21LwEa4lke
TLSH
T15D62E96BB9102A379DD7C216F912B72BE3F5102265D91E88E7FCCA1C18D7ACD6213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7c83a508def4f9ef47efbe68fb848856f0349b61f5ef3ab5fe678052112f88f3
MD5 466a11e26aa4226677f1be2fcee3f0a0
SHA1 3414741d6238105b96a868307551c8acadf6a91e
SHA512 6ca499df3a42d7610610fa034ea609a0870b7855e0fe4e76677a0268e65ecb939737f317406a0c0d4f14d76d2b94fe7c4a8951314ef195165ecfbc2efdcdbde3
SSDEEP 192:dRFcBzCXAcDp/iQv71WpuPRp84vrPgg7bS9o8sb+WN4L9ibmN+JOeER21L+ckkww:dRFmzCQPMIuXqXwBwdeU21LwEaylke
TLSH
T14762E72BB9103A379DD7C216F912B72BE3F5102265991E88E7FCCA1C28E79CD6213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 242b5de1b80d32759c6823e07664c9664fa787afa67706947738646bff1ff0a7
MD5 2b34609d5e16ad4f2aacc8b4f4bfd684
SHA1 13a1c531e717195b3cff6f7580e8432357bdc3a8
SHA512 0d992242ac954aab8da4d94d12be8ae3456eec945b77ffb77d412fffcc216520c0d4b4acc3e540f38b568fbf00f13db63f61f84178f375e244334b1a0c562c3d
TLSH
T15FB012518042A781C00302F4119E048835149F20F745170153E46AB698272E08018164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c4a8d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c4a8d.TMP
Size 96B
SHA256 1fb03a8e8d7347cda83b3836548697faf4f4632c7262558c96351f025f59c78c
MD5 53c572eebe7b0fe2f31a024fb2d4a3b3
SHA1 0e355bd723eab12613d096db1fda30eac495d23e
SHA512 7aaaf14594cec797c514077ed5c5f4c4d9cbc560fa161a0724ac35feb8c2e14eb13c2c71cdfa31e9aedf5cc2e805e71955872485db366949dce46823e187be79
TLSH
T172B02203C0032382C08203B02E8880C83020EFA8C2C3030382F00A33CC22238C02C020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a5a195a948eeba8a6c6edfdcc2b6b1ff6f6befb7efbf1ad186cc66ba0ecd28eb
MD5 d6936c06ae38f31513d776cde0e917d8
SHA1 d04eda1e33938c9d7b2646780666a908161b025e
SHA512 3f98de33f90799030dbc04d446aac4ba7ef5be320fa34c1e2e17f99a0eaace6050a2a82cd004a1cab9c9cbaeb2a84c0bd1bd848333fbc4ac1a807d3f98a89b53
TLSH
T125A002588F410205C42372F61A8E0B452B534C2142511207909082B8E85125AAB26100
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir2372_626325680\Icons\128.png
Size 8KB
SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
MD5 0de22373525e2f8219958621a66ba3d0
SHA1 130e89d9409eda3bf4c24c45e8a7d50086134c2d
SHA512 ce3bbc18af6a84da5859f639ed0e8b578e0a4534ca16fac254e757aa06bf19bba00c0d4e922831a682e1d7ec5456af0635cc01c0a0885394dd6faf5565404767
SSDEEP 192:CKwpZjVWBmHOxZMDkfoy89zziiGjQH56E6vXmU1z:CTp3hOZMEj8J5IQDM
TLSH
T16502AEB2D08CAFA12ECD11D7D7111631F809B384481E9B047A3B789D6DC67696BF0963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 3553cd89e102938127c3bbfe1030c241fc0969263dc3f2f4f32a22353e9b4eb2
MD5 f25b96452cf1182a983aa16ba4f7f867
SHA1 01f179026c6750fd497c278e6c8e8060adbbab94
SHA512 455a3e11c5cae266323a1e4ccb6e1910327e4d545f36a8538e5a24d42127e4047b92f71f2224c5197c483abe0036084d618e743e68cca79178dcee910d72aab9
SSDEEP 3072:JhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/H++J3qUQm08KMWF0bFTcVHr6z4+:p6OgB2HWv3G8YnOnv++JjcMW2VcVLj+
TLSH
T13A1412264919BC74232EE3D2D01F2D858DD19CAF854964F9B1D37B4E02EA301678FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6a380091f46f42ac810a8f5ce13c0f783363b389229ced031ce92ac3131d40d0
MD5 7ebe6565b6fa9f0572f11bb5bda574ae
SHA1 94504526b82d9a1b7602108656283bba59dd2dc2
SHA512 070bedb20beff348cf4358ca013f1044c6dc3291a3d641006103221b5c3da3b9a0cccdeda285fade87481efaa8483bcbcdc4ec0f7f63f181d8431f869c84872f
SSDEEP 1536:ubHP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:q++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T18F9312B9991E7D79636BC296A0079CAC8CD3CCCE111455BC30C76F1E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 e4019a76a1881a9f63e18e8d51834abf0ab38296da60c3614965321b4bc802e6
MD5 5f6757a96d90b3f67ce26d53e953c6a4
SHA1 e158529856461776ee4551818dcbeeb0d198414b
SHA512 e9db85c6e52d0da126812873c95a02a6e40aeaaf623fd3ff7a507453fe08ed19f14011439186ed8aafda1f2cda8f27572ce5641daa9be76019149442ad16e9e0
SSDEEP 3072:lXhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/H++J3qUQm08KMWF0bFTcVHr6z4+:lD6OgB2HWv3G8YnOnv++JjcMW2VcVLj+
TLSH
T1691412364919BCB8232EE2C1D01F2D854CD19CDF8A4564BDB1937B4E06EA3416B8FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 c02a937ecfb2c01736eab71929005b1efb4f2ee4a59c9251111cb423fca14c81
MD5 16092b5df59d69c1d13f8e07b0b430bd
SHA1 3c0a7e7b976f44fc5ec492277c6682c968347ba6
SHA512 348a7355636b94d6ea84f63bee514417c581d4910e7b84dfc0c8d4a9fe1ba5869ea3d3f3533dee7bc1f922ba7df96dff4400bab5cbdc2c24370f84a7af5644b1
SSDEEP 3072:FxhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/H++J3qUQm08KMWF0bFTcVHr6z4+:Fh6OgB2HWv3G8YnOnv++JjcMW2VcVLj+
TLSH
T1AD1412364919BCB8222EE2C1D00F2D854CD19C9F8A4574BDB1937B4E06EA3416B8FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 0e2a2bec3d5a7210fe7f129b8af1a89e5e65edb72b858373e95ef6143894cf32
MD5 9e95cfab2affe17b16b62fa662d25f1e
SHA1 7c286980dfaabb57deef71941f40c8e7aabf01c0
SHA512 119e538593bb3d02b482ad3241213f2d36d4193be10b3dfd0eb3edc94495b3b6abeaa3692e5a958e344d9e6d9854ea747bc7f524a3f02e636f2aabe00ffa5b58
SSDEEP 3072:FhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/H++J3qUQm08KMWF0bFTcVHr6z4+:l6OgB2HWv3G8YnOnv++JjcMW2VcVLj+
TLSH
T1091412264929BC74232EE3D2D01F1D858DD29CAF854964F9B1D37B4E02EA301678FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
MD5 aaac91ebbf67dbbc392d45b8ba21b7af
SHA1 c12b368a2d9e5d86e38c050c8c991930b00b017a
SHA512 d7492a4c51ec39a37fa7e0e893db326eb2afa4a19ccab42d34d8b2aa7279aedca2f5868970e4513c37d26caa55dce67a9dccd146446e47298a0c41e59869c2b9
TLSH
T145D08050DEF05960D8046571242CF7D45F59D9A1DD47DA2125E5EF799DC20C648C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fdcfd05df75c897a6ae400b90c5e56a6067d9d9a631ff864d75351172596e11c
MD5 7f636df2f175df27d41b07591b4b4a6b
SHA1 a31c2db8df5f6dc0866b38603dec420de4f309f2
SHA512 145dcf5b13890c3aea1861f3172c3eba0f4d10c1b81f3c9bb21eb6eb08fe001c63d8b730fd76f08ba9f1744b5adf2fa2127a312f9478592eabd95fa8bf07c80c
TLSH
T16ED0A7726649A021EA2C5130A123D7541F2AC554B4438611F35CC49CD6E80DA53C15C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0bd496229577750dc53053016b6bdd267124938988db34b5e71bf0c648f2532e
MD5 263449b13962d994b876f70ca469e88d
SHA1 2247710e2169e794f6fbc6ef75243045dd5cf93d
SHA512 86765da2226e42646b12e6b8ce96687a60ca7c8aee3260098a9beeaa188e51a8e7a660dda4322384734641692aa54df40987561b1957a500f3bf69a5adfee1f1
TLSH
T148D0A7B6774DE420FF185230A416C7541E75C595B8079605B354C46CDAA51C542C5582
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 871174a10d84fbf0a9faff5431c4842e1e8197a40e17b1893fb456abc1deb616
MD5 ccb6a81dcd461e556b6a8e5d33a061e6
SHA1 e65c24f90d29aae27d5f96482f8400f29e55a5aa
SHA512 7099c456559b7b8a2824a6fbec98a66f34cf213191474a44f22d51a1b2ccb26caf9d80a81a81cec8c0300bca5a5630ec7f82424b733b068762679bf8d0e521d4
TLSH
T1C6E02BE5D865DC2B08FD5B2864248745FB6013572A41888F3B3C921D8FB4E37458285C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 bfb1983697356ed301a6ea85c5e0f17c195821d94393fb4ebea705fa4bfbb0d7
MD5 940b06388a5597bf6b2d806436ddb6e0
SHA1 e0ef2baf2a835bc177220d3ef267839dbd5b6e3f
SHA512 a1a0a49714145132da62449a88c0a6e32cf502ec7989ae6a837b728bebe951d357ec209edd760e16e02bd0a2a87913022d6dfd93b7163096abfa551e679e1780
SSDEEP 384:RIXOiz6+5vxGT0cBBR5P0P8UjSeXyAiqDYdrz80NwotPsSWM:RIXOiU0cBB7P0PiAigerAmtIM
TLSH
T18E13913E3A7C1C52EAE6567D4C9B0A3C2375C8E4C8F6391B03BA3470475EB96790EA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ea10f6e9512ff5da9092d60d9ffe39b8f1fcc6a7447db22e68abcf3b0c54018b
MD5 3139fd2bce6e135e5edad383e9949549
SHA1 7a66bd7f9567a34a77f3b314ebb230ba15480482
SHA512 1aea2f781a4b1f9917435359463e971a7dfe0d30e11de8260279c3979c9bd562ab5c9758ae1e8db89a14422bd1531963238aca70acb447755fc4e86a4aa07163
SSDEEP 1536:0ktE1QBBqdvd5LlEVkhdWOwb4SU8oYjJJAeTkIa1:lqdq+G4+JJA0
TLSH
T12F4451F70965A01BCBA812F5D2033E3DD177011D6DE2F8E9D63C0C952929B22B6BDE94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 a2e17adefd1f0164f3471fde41c9236bb666950b607739043b8a3f787aa1f71e
MD5 f6fff116deac950b40145d5dbb76ee9f
SHA1 2f2da10632ccda51305e930bae3708bb05041b15
SHA512 7ccc9c503c7c73a52b67baf0c29e75eea90682edd3745b7bf70f96b78bc5e5ceda811fa58b11dfcea2ab9a2030316c78851e24de128f0faf71648176fd02c221
SSDEEP 49152:KLEULC58fPiE2gjS5Jy0EL7btnuYMulyKNCQ:4l28fKEluYXtuYa
TLSH
T10D867EEEC6785C83CE678A30B4E0EC477C7412C3B555D1D3895CC59812AB7C1BBAA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4040c78f39af964902a0a5cc0ec638d12dbf5b6d091d798194923fc5673abcec
MD5 72d1f6d2cce53c57751c2b337977f41d
SHA1 878e65c1fc8433e585b424a8b20f93a5a1f88c2b
SHA512 2fcdf967da8ead765b2b94ddca8a49781bde364712284b4e0c97c09c6a3f638d9aa6b3a51074cd9906d4b81e9717d8f2b4a90f1b81e00a3a353bda649a5b9b4c
TLSH
T1D951A62479924D93EBF31E358EBF65266279897900FF3E0B42F8407DAA43B156070969
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aba78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aba78.TMP
Size 2KB
SHA256 1bd0ce8d273723c84bc8e3bf43c4bc5e4f4538d4898e8d0307fb32708d30aaab
MD5 dacb78c6d61a8897c6f7384ce29f1061
SHA1 34cd7c4e1746302cfe8179353b100417d9947e36
SHA512 ce56d0891e2ea898655b5e166c26bd92c36e7304e6ce89e0332f0c14499347b19ab06969e5afeb9cab9b311dc2271236550f384b39326189e55cc36539923ae0
TLSH
T16351B42479924CA7EBF75D32CEFF60286278897900FF7D0B42F8407DAA427146071949
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 3cbffb2fe20b9e90a42f708d9c60482968873042f68a8725ab111f385c7ddb94
MD5 4f67422e3e9e60107fbd379632890f5c
SHA1 d9c5d64e1c8f678ee1264995f08838d6836c04df
SHA512 8abea691d0a405e7b86793eb150ecdb4d9e09ce8a8588599f021f5edb9abf160ba58c43bf693f17f85ed11002bd5983db7f0d3b16b9ffff25fb702b87a3a2000
TLSH
T196E0D8D45CC6C11E55A07AD792349F0CC1C434C2D6C66E072B46C8C87643445F34D54A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 3af53fac58c6757abb85ae93e503ef8ad458981bd788cb07fee23cfea591f7dd
MD5 93baea8fc2e34ecc61d2bb86427daaa8
SHA1 ac4852db483ef684f4fb486f05d2a1ca11d80dd0
SHA512 0fe383f87d49783a91203f9d90e4af8d372f0baf64c23aef3cce482e38a3d0e724eb1958f4d36ceed10f1078bb82b7bbc9d5563cc4e16334e577e4b132685fc3
SSDEEP 48:Tyi+7f+UZD4jJ/BD/26WxlXCKFOyrTpyD:GLnD4jJ/V/26yX7OSTp0
TLSH
T183E2F14D3B12F512C8ED733EA0C2C6F19EBC792C464D7570923C58768C63662F49E54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 513B
SHA256 388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea
MD5 c92eabb217d45c77f8d52725ad3758f0
SHA1 43b422ac002bb445e2e9b2c27d74c27cd70c9975
SHA512 dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 f3d1bfba3a3b6718534b0e7258a23d6605eab9c181bb6d446edc8517ad93c679
MD5 29a8cb40590a49ecd1efbe64c3b437a8
SHA1 daa0f3cc6c49e6c3d734837e624543720f01ff49
SHA512 9d26521b52877f7205f507137ad1d83a910687779ae7cc025740fdfc7ca5fc280af3c7ffc774b2b547f3bc800a8ff297dac8d140113114cbb95efd6eeb10262b
TLSH
T135E0869405C9C56D90957CD3C3695B4CC7D9348FA68D3D171B8FC8886107A45E3DF6C5
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 5d69ed293b241c64608b0de6433fabcfa8e058bc948625e354c57949c2588204
MD5 c1cbfb30c9b2d5f00ad6de769788622f
SHA1 2e9def0e58c280c0d11ff4e7b573ba8dbad618a5
SHA512 266f8cb679fd4431c122818c2d0ba4fd99ef2d747fae380b2f5b778e5721bd8d1ca5a101e3493e37e713c480b14c59de9befa5c8e63ba241b97c6132101a4236
SSDEEP 192:xCgg0+G83uxXBBK31GkSJhB9EJH7DNspUc:xUa83uFBBQ1GkSDa7DNspUc
TLSH
T1BF14421E5F352722CDBD813669E744A35C7DF03F8B1366DA786114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 2b89c82bf6ac016cd93a963da72c40e169c42bdf7e4c816ad75c512e8e52bdf5
MD5 c48c236479ef3da685a9779d9b9a4029
SHA1 d68d3e0294d971687447991c4cdd54af9dc03e22
SHA512 040e0a2c7349780217a04e6689d228a34e2e1d2e0223110481f9afdbbd6521c63b3f61a156d7d5c354ca8e80d86f076ebecbbb26bf50981b7a076f4df154ce5e
TLSH
T10EE0D8E088CDC55E524865C7933A6B0CC7E5344BD68C2F052F4AE88CB107408A78D5C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 db3a22af290d75c54f9262526d5bd29df75ceb3c0462f3bad78176dd5fc20b62
MD5 70caccc2dcfb69eb0e978a764ed65040
SHA1 3c238703c705eea71089bb9cb1a0ae55c97805b2
SHA512 4e707432a75c635b4a601fb805074b66b236ddc39de7a0a09e60d0022986e489c5e63f86b108acc83d533344e664544e6aa71325c50cccf9369dcfb724e64fd5
TLSH
T1E841ACF3C3E8856DC91196F0BA187E2FDE2D0955432C3D5AC8E4AF1B93E2471E141A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bbe82fdb8e6274ae74e2fb10b78487cafa93e8b4e2747ed1d916ca1500924b5a
MD5 441840b1ed7771714e56d61b66a7aee6
SHA1 35f3e202c99409c8ba6fb592f2877039057a95b2
SHA512 181a99fef68f22792c49f5d49bdfa0022e7070972f487dd4a7531cb9d9fd01457fcd900646db2a0f00bbbf008a5005cabbb611a4ce92211492d2b510fcf3efd7
TLSH
T12931AEF783E4856E8A1196F0BA18BE2FCE2D0511432C3D9AC5E4AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 063d5aec95d3a154acb27959c3f8644d46f75d178aeed5ca53e55ee8c63e2018
MD5 8248c78415f2da52387ebdf9efdbd961
SHA1 72ca7bac039f58c8ad30d4c7bb4dd6f81d309e3b
SHA512 92304da92ae4a22b07a2d050c5038858fa387083f39419ceb7604bfbdf69ebc6ff2024ff7d89586fb727482101db1fbac21d0c48793a1deff36614b954da9260
SSDEEP 96:i/IEumQv8m1ccnvSh5jTVHSf5nFXKsZ4g:i/IEumQv8m1ccnvSvWr
TLSH
T15EF2DEFA07276205C99444F0E400AF8FAF16005B47B6B6EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 ae69d8df7100d941c916eb6d0d0e7859156c4dd559113bf49533b4067d255359
MD5 0633e0124b8c4da9ebe7d1806b1e1e64
SHA1 70252e22074b5a5390d1e2341fe922a1268745e1
SHA512 1aa2f6f607ee98a5a724e09a0a29275d06bc29e351cdc4a3d68648241930d18982c2dd4d0485527611e6fe462f2d701a6adaeecfc35c9ef2c645d59d3bc9846f
TLSH
T120C0126185F9F5721138497A6A8469C5B679F435044050E1D9A6877C60924FBAB1113A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b1dec136923651c20e19c385a89fb8d32cb1e77aa73d5b45a8d4e3f57d9b0d73
MD5 8b7aa99f79ef49ef8a200fc3f4ddad80
SHA1 8fa27879fd08dde98fd48b9e90fbe6ff52c32edd
SHA512 f7c6b83648344bba132123dc4f494519f268ce0056bbfef4e86d457f5cbfb64689b05cb2f076c2b09111b86d77f0b8b08b2a3f34f8292fc2b37b5cecf6743ea6
SSDEEP 192:sxZlRlyMqZ/K1Ml8DcH/frsdWpV6CQiW4GmZqzodpEP/W6+WNGY0R1kOw0xClpIm:sxZl6JH/frsdWvxT4mZRS/bG5EO+/Z3
TLSH
T10872F715BA78993BCCC7D619FA55BF53D7F9146392904E449AFCCA0C10E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 121cbfbb7913c12eefa0a83d70ea75163f93f38cccb6e08bb8249bc149a5336c
MD5 e7c3b516848e04a0366db7d3f0a65f41
SHA1 0603052292288c59c6a471af2dffc77c94e307c6
SHA512 71f2d2fb72c852b6713e45852963fafe9284fe3ed1ff387bafb9ed9a3e45bd1e5182544ff36950eea234d82b740a64ed06884018f4c742d57307613ab31896d5
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3cWWlLlH:2DhVP8b320JE/mKWRmmeQReu1jaKcWW/
TLSH
T186031B3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 32b15e09c716ce7a6cc7ad637cd9786c0fc7b38c2308bde978a86af609f85361
MD5 a44e933080a6fc240b6db4f392e85a6c
SHA1 8156e8409ed755005fd9149d8c5fbfd1e39e60fb
SHA512 0118e0dff2522d86aa2a469b17a5fa05a36bfa7a53b0e0f9101f5b4a4896c7aab274ce197df98dd6bcbd5862df956dd5664ae62ece5861c8c07325c208c45b77
TLSH
T198E0269405C8C1BD605525C383B5970CC2E8B44BE2CC3E0A2FC9CC487143904B3DE580
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 ce9f84913cf14939e6997b39fc73187f453504d0d5c8798d7f4bfc3caa0b9079
MD5 bc73cd03c750b47969d1ae04ed9d3ae9
SHA1 4e17486adf718c3ecac6b7b6b5600aed95667c68
SHA512 ed8aedd68169fb47a1467a96c597824eac373a82032bb8b21b46fe6919941dbeb370258000b286bd221c90e08b93e75fbc3c51972882fa66a16b0b9ba8dc3e67
TLSH
T1ECE0DFA016C9C66A728525CBD329E74CC2FA744BE6CC2D162F4DDC88A207640B38F282
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 feedb4590e651071caec339f495fc52470d77c4e2d61885c3821865f2def483e
MD5 e8b9fce69440f7067b557b9e0860f3ba
SHA1 9f757367a697bb2bd3c797750144dcee0cb3cb50
SHA512 027a348b2e48154881c6ff2b3d8478eaeed15bfc490676075abdee79f9c0ecf4f017171413b1c9bbab6e622f600dbd8678df838baf8f3b971e1968003c149c6f
TLSH
T134E086F045C9CA7D504566C7C376AF0CCAF8786BA7CC3E4A6B4CD858B103646B3AE584
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8f630cb69711ea90f1855f26f95541632b91c97ec837f350dd4e957f3bde3b0d
MD5 b9cd3d0ea92456bec9195fffb12a17f4
SHA1 c3766b7921b9ef9b86d761619288d25ae07bb698
SHA512 6c4d210d742ce0102854562387699ef75a2c02d3273fb6b3c0e85472a588d63424d87d93d75d39fd672c8a688dc12a99697c6b2cd3f791443ef44c6b50e8d58c
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++Jmt:qD1rjvYZ5V8fO9ddTXkrno9BJlnL
TLSH
T14EB25C11713B17903ABE358A9155B8AF46C271633018E43B7B7904AA4F6BE34DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 0afe930500dd6c9f97f8fca0114bef0c99738b6b4e73741a31af2ed485d848cd
MD5 231d87f84195c8b8b4b3a1b6f311fbc0
SHA1 d8a40dfd2561df762bc12ccbfa3578ed90f47766
SHA512 15e443a371467b87584a2fc7e26960072e9cd48d93fcfe316efc68de9667bb0aae1363284340d37f1c4645de916345b8d16d67c1a6f8eb6c107c92a340ce38d5
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++Jmj:qD1rjvYZ5V8fO9ddTXkrno9BJlnK5De
TLSH
T1EBC23A11713B179039BE358A9165B8AF46C271633018E43B7B7904AA4F6BE34DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e3f774fbe8af98286ebfec939a787375a491452e72de5ea3fbba1a81a94b1f5c
MD5 bda9e421b454d72c31c49541a17bb424
SHA1 cb8b175536edac439c86e6ec7a1d3e0dd96cfac3
SHA512 637cab425f17e7cf2976c281a9f5eca77eb31cd1010778366b04babc4cc7c125250df3d44d66865d624038d929acd7fb5ff44d3fc05f97d942c98a7165e11fea
SSDEEP 192:FvoWD8SfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a+fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1BA24530A7B747001EDE7D9725CB080771E3CB16ECF22A6915DB264694DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 3e649250dc7c5f0519dfdc76aaa0d617e558a04376cf11b6c7c3f0bf4ed3dca3
MD5 00e19ab928c11ab4e9f839298582f27e
SHA1 fd17b4ebacdb5011a602d18825b67e928b4b2853
SHA512 03cb15e912e3f2d8c6a2edf9a88ba4a16464e58f762cf1161d01e08647262eec1fa39f282c2dcd4025f74b0ac79efffc6c1ecf255c9cf90e09213104259d258d
TLSH
T1A55164C1939A65D56F89A982D21A740365E13E5B261E5871233F44F84F88C3C8F6FE36
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 1859cf110e73f20bded792fc0027b7458cccb23a8ede19e914e289fb3528fcd1
MD5 bd98083fd64f928bb7281d384db41b9c
SHA1 602c5ec9516aadd974deb7ca434d3686d2e30473
SHA512 516676ab63f82332862b2a9566e3a5dbd0192d0f150ed9151a4da04ac4690ea918b95880064353f3169b3f6ba0915398e56502038d498129cfb80e90692e8f1a
SSDEEP 192:lAONXAszlrhNCsiV3HPBvQkIIIrbrMIMBgYcYW:ZNwsZqsKpQkIIIrbrMIMCBx
TLSH
T1135263392B891B33C15E5FB7226B8BA41FD688814976226E34301C5F9DF2A6F87C51F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 a948465f9e76eac482cb80c6fb188d5704b7453120feccb348d94064b30741f1
MD5 47d7a6cbff7240e2ffada50d1e226023
SHA1 da5dfee97180feb7b3694588cdbcbe24a4104444
SHA512 7093b2f0fc896c3fcb539b6e011c887221b6c70cd97d9e65a2d0dd5e4571d669cb9e4152bc09e2b03ce2598a24eec85a9b18088c3a818466c165cb427c19ab69
TLSH
T136E0205054C4C59E60A625C752764B0CE6C43457FECC2D091F4AC44C7403505775D146
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d83f683c61dfde610e7fbe1f25c701bea9075471c6fe691684b316a0190990f6
MD5 b670842ceb2cb720415024205b6bd010
SHA1 ddcc21fc2815ae314842dd418750bf488bfe6009
SHA512 1cb6be6d56c25b92fbc50f5b74f4fe1273c50afe818df3f0cb5e0c42f63de4ddf7992514a2bccbb37ce5c77f6a0c3e16da57199d08043c49a8a730efd6fadbcc
TLSH
T1D8216056F320C148E54E867E942BA7351338E9029FFCEC0F447974752E72E011E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 5e18afeeda47a5998a0704235cd9df86e70f0650f175b70eeac155f02c9335a8
MD5 412798b1cec7eac3cccb60eac303b846
SHA1 65c3eae5e7f6ed4df4e3b10c0f017b22c412e9af
SHA512 988567f26b984527adde7e7eea6132d29b124454c73be49dd809c5798b5fda21ece17932e98b3e03b7ba090f52eca4355740859619530330136ff93e13c71921
TLSH
T16EE020D065C4C6DF506125C742668F4CC6D53857EACC2E051F46CC4C71035427B4E146
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 436ea3afeac1437b91b6da6de33053384c7713a8bbb7a26f4bb235d8ec0ad591
MD5 310eb459c5b20e8aa059803891061a9a
SHA1 88dd179863098ae84de1d96213614b8e3d3404df
SHA512 037bbcafd690f23bba719bffc67f470e7a36293af6492989bb89eefcc9d7f8991ba8bd284ce75fa79e5616ef56b7b34318cd394c159217c0ec84b0a8d6c31285
SSDEEP 3:MsEllllkEthXllkl2zEfliL/:/M/xT02zzL
TLSH
T11F440404FFD44405C54050304375D3705374F450057157D334D104375CD7D411C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 39762478a8b8843289d32859622b9718326c7f2c3c47f8c24a4197af9c0bd377
MD5 208c8988220f6248a92744f516e8b953
SHA1 86d05aea790e8478132db5e2781e18b6e2dbfc6f
SHA512 9ae4a65848d86672ea5308ed8b68540bde1925cbae879508c5203e3b887ffa89b7a30835382a9d85f53ff1f5cf147bf8952613e66e1e2ea1499f913f7fbb777a
SSDEEP 768:ZVFTcpmuwglSZ2ZolYRUCx95jV4koFYS/EAe:ZumkSZ2ZMy99V4koa6e
TLSH
T1EED26C39EC95CDBB98EE5B89A64E7657DCE001B3C59C89E4DBD84F0C00A309DA70BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 153f70ff025df54dcee64ad2ed69e6f4f0daced50d17a1a5a9d97ad93949ec0f
MD5 1bb67eac6bb0700f5aa01ac421b4d861
SHA1 087aeddd304a16285f2d563a8cec6d7efaf91e98
SHA512 d53bcf8c87c30408016a93d491cf2afa4c159f86e7351e4aff90f8e2e12286418925ff9c605dde16f8d870f0bf3b1c4c84cd797dd353b37a76f8d0cd6a2cc7b1
SSDEEP 384:nPiFavqMg38Ng8TUNTUlIxBO2+4Or4LJI/SOrfKYvFOtIdPO6zNSq3Ra4fHrN1k9:aFayv3XwgO2ZI/8Yhb3Ra6I
TLSH
T14FC26D35EC58DAEBEDEA8FD9A74A7607EEE001A7C58C4AD4DAD41D0D00D359D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 21206e43ec47986c6596f14f7797ae7d196ff53de6e14d1481cd37785ed3ef20
MD5 75891b71ccaa4c0666af4304552d24f4
SHA1 6080ae7ee1df644c1f4906bff26d5736f06cc01a
SHA512 c40bf99a30b2038396c25150326966fb3ddd3cba2296cc59705eebadc5dc3634fa5afd19394b0e56aed6b102088dd1b74bd21f907f6ebe66dfdd53edb2e154f1
SSDEEP 384:nbiFavqMg38NY8TUNTUlIxBO2+4Or4LR0+OrfKYvFOtIdPO6aX4eim3Ra4fHrN1I:2Fayv37wgO2ZMQYSym3Ra6I
TLSH
T1E5C25B35EC58DEA7ECEA8FD9A34A7647EEE001A3C98C8AD4D6D45E0D008759D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7bdd143a2a4217ec4d31ef34daaa93c98e7907e2de70df5d926ae06746151a97
MD5 f90592c3112e0a9aaf94178ca0c681ea
SHA1 5a7e3e86fd66ef950990f2b70b654840c47c0a01
SHA512 6872452520bdff59ac3bf3d137cb595ac75a7dcc2820f041ef4f97d02e3b20f39a658d1e7d06abcf547c89b1289da12bb8ab9e5b422207273b413629d604341b
SSDEEP 768:zFTcpmrwglSZ2ZClYSEse9VEhkoFYS/EACU:Am/SZ2ZGcEhkoa6V
TLSH
T1B6F2393CEC54CD7F98EEBB89A20D355699E40273C9A889A8E7D40F4D807609DF74BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02e0130a578d00537792b2da514646bc91ce2df2e4b9f6718089d50ea19f3378
MD5 8b414f63d1d8954cce6cd171b1566f5a
SHA1 c791f1e98c9de6f79409b508a2ae950ead3a202f
SHA512 9248d3b6a867e16163851343d5cc48c3aeee91f4f3f6898c55a8134052e427665e24e1e212468cdad4f69df440de5a1c6d07aafade3559b830aafd116b71f1e6
SSDEEP 384:noiF9CcmyWCs38N88TUNTUlIRXS4O2+4Or4LA+tOrfKYvFOtIdPO6aX42imhkP+b:zFccps3rwglSZ2ZTlYSEmhkoFYS/EACU
TLSH
T1A6C26C35E868CEA7ECEA8AC9B74E7647DEE001A3C98C8AE4D5D94E4D00C719D174FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e6e5c0514ad2309d5901a246ee18676a712752a276cdc9815a6ed5ee9510b74b
MD5 937ff35b12b45d2753955815ef83c337
SHA1 f70dc86035ef63737a3d3dfed572b3570a6f2c3d
SHA512 1d2b41aba20d969acea37cf9d5b0383261285976fef6d89afd2866e64002e04dc0150a73e2b142b545b47dfa0b8f521ddf0adb3bc86b71e665592b2c81144c14
SSDEEP 768:zFTcpmrwglSZ2ZTlYSEse9VEhkoFYS/EACU:Am/SZ2ZvcEhkoa6V
TLSH
T164F2393CEC54CD7F98EEBB89A20D355699E40273C9A889A8E7D40F4D807609DF74BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 145ffd08dac86c59e89f51834c93783ed444659575c831ffdc51c16fe270b3cd
MD5 440e5c90bfd5a1e0e9d8c1c5a6f30aec
SHA1 b50da426cb77b6d80ad91cd670665bf58c049748
SHA512 5ce90dee07b5755c3337079c35d686d11c88002290b1766902e078b6305c97e425da7cd6ad0910210e386d6c7b2a611975cda4e55b326b8569978272d552a4a0
SSDEEP 384:nhiFwCcmyWCm8Nh8TUNTUlIRXS4O2+4Or4LN0tOrfKYvFOtIdPO6aX42syxAhkPt:IFTcpmuwglSZ2ZolYSqyxAhkoFYS/EAe
TLSH
T1E5C25B35ECA8CEB7ECEA4A89B64E7647DEE001A3C98C9AD0D6D84E4C008719D174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0499d08a9a9bae7b1b93e8f96fcb055225be2964cab1b4355fb2f0db9d0cb70f
MD5 bc3807f38515dbdd8923ade75c6444c2
SHA1 893d0fb64cb008c08b0b872f1bf92126ddacd865
SHA512 e83da48939186fcb902c232d8dd9d447e855b5013e2b7a31203fb225df495658591b88539b2ae6ff137a55b4661f9e4431c66eb571693abdf2dda7a3d5189f79
SSDEEP 3:MsEllllkEthXllkl2zEflB2Wl:/M/xT02z
TLSH
T187440404FFC44445C541303C4075C3703370D4101531574334F50C37DCC75401C04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 410440f84a20c037f8a3f636db97445af3aa0530b232f76de0aefe26205b994d
MD5 348cffe5ef29299ca47524c482d49c88
SHA1 803aac33c0ada475af5d9a8794b55bf3f9ccd842
SHA512 6cf52d0a9046a4a0d176c000dd6a274da7426b53910050151dfc526928d2de0c25ed5cb835550d17de7901a28c2899ef7309380eaa493a6d4aee4487608daac8
TLSH
T1514131E15C3D2AD1D4BD0A7EB49B34FC95ECC719F8A4347D6824EA884A7A64D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 afc7d883ff5e0762699bf487d8a61192b2fb35a41541a70d578ac3c5ea607eba
MD5 ae337877632e039d735ee94d8d4e8d27
SHA1 f43153ba60651c494c57d0501747d0603ce596a8
SHA512 e01d35521fe2b73efd31c16a8be009089b4a9133e52fb68d2212ee6d39a91865ee50fb5232d64698d636f3547ba9d03e52d20a77fd8787a78cc7954f2e473813
TLSH
T1534140E05C3D2AD1D0BD0A7EB49B38FCD5DCC72AF8A4347D6814EA98463A60D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b09a9f90449c3cc7d87de3663b00bae6ab22f6cf78ae4ae494d835983b71c375
MD5 4641fe32acf32048ca9d65b3ee95e0da
SHA1 be0be0b48c76c30fa060ba10e1665dec2ede42ad
SHA512 d1ba9a5e41657a0338f414a5dde21aa6c5dd6047048715e90efad3e8e97a89b9415ae0cd906b449e9808fecaf302822ef0054e2ae58a3bb1619a0def01049c26
TLSH
T1164140E04C3D2AD1D0BD0A7EB48B38FCD5ECC729F4A4347D6864EA98467A20D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7dec53cabe36ba7bcdc2e038687b78a5b0520c36ce959c2304e4dc4db104af6b
MD5 21a021452ed1e3b6ba00eecb2bf1e8f7
SHA1 f8a6ac88fe4a28b673f986641098095a74eb8feb
SHA512 1f1c19015c5dd5721d1351237c5fad64c9f55e920f2f7bfe125650bc1d06943937799cf9ac67c6552ed799424fa063dab2ffce7d03c9b909af1bda2ea1fa6b6d
TLSH
T147413FE15C3D1AD1D0FD0A3EB49B38FC81DCC72AF4A4347D6824EA884A3A60D644483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3fdf12599ea9e1232aea05abd2e1edeb4e1df668067d04db991a8b8be2b4fe4
MD5 fa79ca63271b66ae3c4d8d222ccc1233
SHA1 654d122064eb87edabcd1daeb5dc6ded0a7160a8
SHA512 69b2637402dc4d4baeb56744e9ae27bdbfafbf162c7b99f3be9ec9070654d1290fcf78dafa7834329567b2138d9b1578f7847abcdc03983fc604e8b8f6296036
TLSH
T1AC413FE15C3D26D1D4FD0E3EB09B78FC85D8C72AF4A4347D6828EA88463A61E644083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 715c0621202a007f2efcdcb6f2b09e7b03ca73ac08d504164e386513462d0b26
MD5 dbb27134ba9dce764639d13e1ca6e116
SHA1 d9d0ff02d1f46aa5d887c28dcbb504d81074b92a
SHA512 86b2d3fc780ee4fb3b215e303866c3505a97e676f2a69a3cad39f2a75ceb9e55997fe42420eb8a8400ffcb55c45a9d92e4f911563e404c8dbbc7ebd02ddf7041
SSDEEP 24:S4QjC5fiqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw5:xpiqp/IHRH34kWqB1kQnjhHmr6ITmUK
TLSH
T11F42996EDA2CA9A2FEE00B3ED7D1D0127B36A60EC2E4C5F1095B405747C540405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1aab4b55-722a-472a-a0c4-c910230ab939.tmp

Path C:\Users\Admin\AppData\Local\Temp\1aab4b55-722a-472a-a0c4-c910230ab939.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 96ca873acd0057801ada104bf36ce19083f8f669940e37d820b2863bc5b84ddd
MD5 4b42cb77f8ab78272c59efa481d5d363
SHA1 428bcd2afbdeb5754cc62c81f768bb65e7c54e27
SHA512 d00d6596705e0e52695bc8266290826de29d91c6453ba65f9fe0c36b5fc2b585ec43d3d03f899136c9b033a6c9ea6da5c10c629058ba9f9ed69334e21cc0d5cc
TLSH
T172412AE13A35A23F8BC38BD560764C846C71F180436E9A1CAE065036BD5CEE2635EBC9
MD5 SHA1 SHA512 TLSH

Submit Download

Antares Auto-Tune bundle V9 CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-D48KA.tmp\Antares Auto-Tune bundle V9 CE.tmp
Size 2.5MB
SHA256 4cfcbcffe82bc6943890fa818ded2708f46c4f85ec368de00836ac708acdb080
MD5 ebbb655a85d61e4adad34d9ade0ea184
SHA1 41d3a5ab6de2cd4c45bd9545906c53ba9eaf345d
SHA512 a84a4104356c23fa5a618368fa4ba2793435832f3eefb6b243d1513d7ac586002449f127abc6bbb3cf199a930bdd718c6d1ec273738e1d9796d423ddb312eb50
SSDEEP 49152:3g2qPtc1e5OS7bPGoUl+x/grN4azvchYk2C4:3vqPCnrN4azvSY9
TLSH
T14AC54A12B285713ED06B2B36493FC6909937BE6179368D5A6BF40D0C8F355802F3BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1494021090\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1494021090\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_1599746682\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_2033727084\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5200_730812876\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2820-293-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/2820-7-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/2820-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/2820-294-0x0000000000B80000-0x0000000000C1C000-memory.dmp

Download

memory/2820-8-0x0000000000B80000-0x0000000000C1C000-memory.dmp

Download

memory/4948-292-0x0000000000C20000-0x0000000000CBC000-memory.dmp

Download

memory/4948-22-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-18-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-26-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-9-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-30-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-34-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-38-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-10-0x0000000000C20000-0x0000000000CBC000-memory.dmp

Download

memory/4948-11-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/4948-51-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4948-5-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/4948-291-0x0000000000400000-0x0000000000683000-memory.dmp

Download