hxxps://clownfish-translator[.]com/voicechanger/

Analysis

user interaction
yes
max time kernel
90s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://clownfish-translator.com/voicechanger/
Sample260804-ecy4msvwe1

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
140	4384	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
5260	VoiceChanger64f(2.05).exe
5616	APOConfig.exe
6056	ClownfishVoiceChanger.exe
5612	ClownfishVoiceChanger.exe

Loads dropped DLL 7 IoCs

pid	Process
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5540	regsvr32.exe
5584	regsvr32.exe
5500	AUDIODG.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\I feel good.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Church_Melody.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Metal2.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Duck.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Ghost.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Singer.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vst\howto.txt	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.bmp	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Metal.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Rusty.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Vocoder-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Gunshot.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Flute.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Laugh.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody2.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody3.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\You guys suck.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Robot.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\You suck.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Bell.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\AudioChanger.exe	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Applause.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\CityHall-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Bicycle bell.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Fanfare.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Sheep.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Smoke weed everyday.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody4.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Robot2.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Boooooo.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Ricochet.mp3	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus-Off.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Ghost.ico	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.bmp	VoiceChanger64f(2.05).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual.ico	VoiceChanger64f(2.05).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APOConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoiceChanger64f(2.05).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302889118834309"	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{71F1D6B6-3280-4B7C-8107-07A3C49DFCC6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Program Files (x86)\\ClownfishVoiceChanger\\ClownfshAPO64.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2026"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1"	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe
5260	VoiceChanger64f(2.05).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5260	VoiceChanger64f(2.05).exe
Token: SeTakeOwnershipPrivilege	5616	APOConfig.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
6056	ClownfishVoiceChanger.exe
6056	ClownfishVoiceChanger.exe
6056	ClownfishVoiceChanger.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
6056	ClownfishVoiceChanger.exe
6056	ClownfishVoiceChanger.exe
6056	ClownfishVoiceChanger.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5260	VoiceChanger64f(2.05).exe
5616	APOConfig.exe
6056	ClownfishVoiceChanger.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1144	3212	msedge.exe	85
PID 3212 wrote to memory of 4384	3212	msedge.exe	86
PID 3212 wrote to memory of 4308	3212	msedge.exe	87
PID 3212 wrote to memory of 4308	3212	msedge.exe	87
PID 3212 wrote to memory of 4308	3212	msedge.exe	87
PID 3212 wrote to memory of 4628	3212	msedge.exe	88
PID 3212 wrote to memory of 4628	3212	msedge.exe	88
PID 3212 wrote to memory of 1596	3212	msedge.exe	89
PID 3212 wrote to memory of 968	3212	msedge.exe	90
PID 3212 wrote to memory of 1596	3212	msedge.exe	89
PID 3212 wrote to memory of 1596	3212	msedge.exe	89
PID 3212 wrote to memory of 968	3212	msedge.exe	90
PID 3212 wrote to memory of 968	3212	msedge.exe	90
PID 3212 wrote to memory of 3004	3212	msedge.exe	91
PID 3212 wrote to memory of 2484	3212	msedge.exe	92
PID 3212 wrote to memory of 3004	3212	msedge.exe	91
PID 3212 wrote to memory of 3004	3212	msedge.exe	91
PID 3212 wrote to memory of 2484	3212	msedge.exe	92
PID 3212 wrote to memory of 2484	3212	msedge.exe	92
PID 3212 wrote to memory of 5064	3212	msedge.exe	97
PID 3212 wrote to memory of 3216	3212	msedge.exe	98
PID 3212 wrote to memory of 5064	3212	msedge.exe	97
PID 3212 wrote to memory of 3216	3212	msedge.exe	98
PID 3212 wrote to memory of 1068	3212	msedge.exe	102
PID 3212 wrote to memory of 3820	3212	msedge.exe	105
PID 3212 wrote to memory of 3820	3212	msedge.exe	105
PID 3212 wrote to memory of 3820	3212	msedge.exe	105
PID 3212 wrote to memory of 4404	3212	msedge.exe	107
PID 3212 wrote to memory of 4404	3212	msedge.exe	107
PID 3212 wrote to memory of 4404	3212	msedge.exe	107
PID 3212 wrote to memory of 3152	3212	msedge.exe	109
PID 3212 wrote to memory of 3152	3212	msedge.exe	109
PID 3212 wrote to memory of 3152	3212	msedge.exe	109
PID 3212 wrote to memory of 3352	3212	msedge.exe	110
PID 3212 wrote to memory of 3352	3212	msedge.exe	110
PID 3212 wrote to memory of 1348	3212	msedge.exe	111
PID 3212 wrote to memory of 1348	3212	msedge.exe	111
PID 3212 wrote to memory of 1348	3212	msedge.exe	111
PID 3212 wrote to memory of 5076	3212	msedge.exe	113
PID 3212 wrote to memory of 5260	3212	msedge.exe	116
PID 5260 wrote to memory of 5600	5260	VoiceChanger64f(2.05).exe	118
PID 5600 wrote to memory of 5680	5600	net.exe	121
PID 3212 wrote to memory of 5804	3212	msedge.exe	123
PID 3212 wrote to memory of 5812	3212	msedge.exe	124
PID 3212 wrote to memory of 5820	3212	msedge.exe	125
PID 5260 wrote to memory of 6008	5260	VoiceChanger64f(2.05).exe	127
PID 6008 wrote to memory of 6060	6008	net.exe	129
PID 5260 wrote to memory of 936	5260	VoiceChanger64f(2.05).exe	131
PID 936 wrote to memory of 4924	936	net.exe	133
PID 5260 wrote to memory of 5484	5260	VoiceChanger64f(2.05).exe	136
PID 5484 wrote to memory of 5524	5484	net.exe	138
PID 5260 wrote to memory of 5540	5260	VoiceChanger64f(2.05).exe	139
PID 5540 wrote to memory of 5584	5540	regsvr32.exe	140
PID 5260 wrote to memory of 5616	5260	VoiceChanger64f(2.05).exe	141
PID 5616 wrote to memory of 2040	5616	APOConfig.exe	143
PID 2040 wrote to memory of 3092	2040	cmd.exe	144
PID 3092 wrote to memory of 1168	3092	net.exe	145
PID 2040 wrote to memory of 5932	2040	cmd.exe	146
PID 5932 wrote to memory of 5868	5932	net.exe	147
PID 3212 wrote to memory of 4204	3212	msedge.exe	157
PID 3212 wrote to memory of 4204	3212	msedge.exe	157
PID 6056 wrote to memory of 2016	6056	ClownfishVoiceChanger.exe	159
PID 2016 wrote to memory of 3812	2016	msedge.exe	160
PID 3212 wrote to memory of 1732	3212	msedge.exe	161

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://clownfish-translator.com/voicechanger/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff81128c188,0x7ff81128c194,0x7ff81128c1a0
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11213931450286503175,4609904771989313247,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,3437076641136217337,7302561265369250834,262144 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11303136153063085647,13974538226056909266,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6245545351127923898,8147070487012722995,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10864709070367758337,6469110365291124751,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9661094177160941943,4962627116522723983,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,13639472264116672785,9025896423481514392,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,2674676365697550839,17582796147470137365,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,5539673409374917499,10087731403341407554,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2343515099844495071,3089522696117126927,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2343515099844495071,3089522696117126927,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,2930928879879793806,3926719110080687843,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,6571668559010207438,6563581510097394632,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6384,i,6819445118607629974,2513271708568026989,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,15930089422203371443,2224435748225346634,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6812,i,732571387705666029,17381871263829121619,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,11927645176447624774,13907734600777137328,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:5076
- C:\Users\Admin\Downloads\VoiceChanger64f(2.05).exe
  "C:\Users\Admin\Downloads\VoiceChanger64f(2.05).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" stop Audiosrv /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Audiosrv /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" stop AudioEndpointBuilder /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AudioEndpointBuilder /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" start Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start Audiosrv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" start AudioEndpointBuilder
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start AudioEndpointBuilder
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5584
- - C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe
    "C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop Audiosrv /y && net start Audiosrv
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Audiosrv /y
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Audiosrv /y
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
    - - C:\Windows\SysWOW64\net.exe
        
        net start Audiosrv
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5932
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start Audiosrv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7216018366204844109,14005239255433590454,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16019512110614961157,15616738320123114249,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,14706117271798413079,6044243980148380290,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,15103113980862169864,13800104902476763879,524288 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5764,i,15251259369648997379,12003720782073806683,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5928,i,14155312926333560987,15961007120863632632,2097152 --field-trial-handle=2360,i,9107252127775997269,7257196057912061361,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:3328

C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe
"C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clownfish-translator.com/voicechanger
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://clownfish-translator.com/voicechanger
    3⤵
    PID:3812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3bc 0x4b8
1⤵
- Loads dropped DLL
PID:5500

C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe
"C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe"
1⤵
- Executes dropped EXE
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

APOConfig.exe

Path C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe
Size 196KB
SHA256 d0666f91e134e6522150a46dbe521479993cd708492f090b72940ba050d1a68a
MD5 6dea0364646c299c12239e7402c28e7c
SHA1 a801c2b7c49dcd6e2f8c33b59a2e1ca8c70adb21
SHA512 b3030b301e571649892aa2c081c254eb293520e0bbe3a4df1522d70cbe35661485e1bc7688d8413d88e298ef3463e3542e4bede73ab1b3adfbfc4b76bdd99b21
SSDEEP 6144:lXtzpxJqoyk6H9APPQZLFlejj85JL7guX:PpPK9A8LH5N7gM
TLSH
T11A146D25BDC2D073E666093069E8CA759A29F8B10F609CDB73840FFA4D346D19735B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfishVoiceChanger.exe

Path C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe
Size 985KB
SHA256 9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43
MD5 c5f5ce5a750f79fb8c20157dbd71833a
SHA1 7a8a06a183ba6465bb02984516beee6fdf5c3b85
SHA512 e3fa60275dd6e19098b3d814eb21e8c3106ab6a6f7d2a74a4deb9bd2aaf7f3501869ed62d05565cfdb2244e65e10316fc90f0d550aa77a14f6f9177c66640d37
SSDEEP 12288:LaSsnEVp1pFJq9hRIL8NOvsE6IVEXYD01b6aOffk5NI/r:Oqxp/IRILRkE6IV7Y4OST
TLSH
T13A255B1C6EE502B9E1F2C770C9A16506EA717C85873D99DF03C1C2994E729FACA39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfshAPO64.dll

Path C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll
Size 371KB
SHA256 e58a7d9e14ebe9ca894747913e36b559808bd5cab7d6a6cb7fb95f4a0d6725aa
MD5 9de8fbab7f2421c02a37258debca29cc
SHA1 ef16998beb341ab07f4e7cfb5b9bff5563cba369
SHA512 ba21d63bc50f9a63a185d9e163e8295de07ab4d00cbc538fe01f0c97eb67e8781bb2e45b9fc6b16c825d9a0dd238ac176f15873c555086398f4c8dbb3c6c37aa
SSDEEP 6144:QvbxZ1gPPNcOemnk+j8edhyQ7BsX4m9V5CIiRpKsVgWooz18ZU:CdgPFcFIR4gyksX78UCeoH
TLSH
T13084BF05FAA500F9E177917C85BBA607F3B2341D0370CAEB03A446696F277D45ABB722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alien-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien-Off.ico
Size 16KB
SHA256 9d68b4ce0995e03fa5a623c36ac00d2641697f9c2120b2d4acc24b371037a729
MD5 3f7b046b32d33fa1db6d801326c84c92
SHA1 f267a3236f46e5160fbda29bfc0e628ab24f2d35
SHA512 e5e1f723e41c9f4ee324883b7d2746f89b8333b17172b1dcd05e8e070caa200e184d12382140986a0ab852312878e9c1d9e6253accc558af246f69f4598ae347
SSDEEP 192:uD10D/av2EfZsnYlMNluw/l5K4kidr+QJWQ16Ti5Y:I10DSeEfZWgMNUmloi1Eiu
TLSH
T1C4722D3B0A2DE813DD8064B1AB62D4FB67306D5D0665890239F63E3BF7ACA17BC0C156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alien.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien.ico
Size 16KB
SHA256 99d1d4618d0ac84f70b30334c94208c617c76f8f1604f665f8dc5c424e638f4d
MD5 b4912b4e5ac58c1da8deb5834e3c366b
SHA1 4d3470a065095f6498e45f7303a8630063eb658c
SHA512 aaa10258b02e41eb13e45ad5746ef5dce249020a973a83e2532bc2d20de0cba6d92d3f4bb3716f871b9eb4db633863763a087769054f9b832cd308b1e7865139
SSDEEP 384:9S7e222222222222Rw+2u8wexKUluUvaFPd7:9Ie222222222222W9ANa7vI5
TLSH
T14D727DB42601A1A9D6A48C718FD4C1310B203D6EA486ED963EF8BD1F79FE2674C064D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atari-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari-Off.ico
Size 16KB
SHA256 6df6a6464c72af219094cf3787cf0d1f858e2fd3b6c5cc213deecabd911769af
MD5 6f984a4938ba524ba9657d3c63845790
SHA1 0b1789655b8139fa9975aea26860674a5b4fd4de
SHA512 f7c403fbf0e3436eae86e141078db563ca7b75ee157eaac4bfd239c5a42227680598a3cf76e4f30760232f71dc3b4fffe7a5bab8d6106854be9eabc7c43298b4
SSDEEP 96:f08opGfmdCRtijpfChf2h5hTAOPcEmvV+WAiPgopg44ld:eCRtijpkuhvTAgxgVLRSld
TLSH
T1217215222639BC16D46225B97503F272BB02AF631647B1A676E3DC777463DE61FE0340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atari.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari.ico
Size 16KB
SHA256 3874c8be3dc907e0f26b658fec2a551e9651933a819bc15bf9f93b578e8b5284
MD5 b5c428102274914255a1c7f4876e2dcd
SHA1 03c76804698ac954d950b6a7dc334fa9ae6db45d
SHA512 daabe89489aa3f6089e05a2d96f149211d4b4338d19e68497b5531d45a8580979dea303b95bdd93f14a349c743e18e120eedabcad7a472b9dd8032f5db42aeee
SSDEEP 96:fF4MmcfBDUD3inWmrMuxutZu2uJOu6wzYgadpbcqe9Mwc2OAPuaY8E5rFbcnjXn4:yeRrGOYe9yYuaVLLAHdRI+ld
TLSH
T1F772EB1DA728AD42C5653AB9C463D3F04722EF1052E186CB2EE5BDF33D266636C3D058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cave-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave-Off.ico
Size 16KB
SHA256 671d371f7b2f07fc7b1e8ea9f0ab1bdf2a9055e79f3c859b19b6f579fc17987f
MD5 fc40dfade66ab7cf24962bca246834c0
SHA1 9f5c5dae7824afd92ae3dacc9bd72f814bb5e776
SHA512 e0bcd0d37c1b1a4db6dec33d9b3f6471612a7e266349b744bc1e3664e908cb737304af77f3d6f91c7e44ed561b86ff4e686625301fbef4a24919df765d105efc
SSDEEP 48:SeeBxuMtMkqCvNbvaKFqhsA5OpFIVgi1V0KDBlYXtEwRwXtWAm78O3LoYk27fxYS:aDthq0NbZFUsA5OxtK8dDRmOFtzxYOt
TLSH
T15A725EB2EA675F4BF759F3B0FC1A40956F273A444808621AC97E648209A201FF4FF15C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cave.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave.ico
Size 16KB
SHA256 716cc28267dcdafd13ca183d11fd74394f7e55063874d5c19a088ec40e225590
MD5 f8b303268883f3500b9723c5f82843d2
SHA1 805cd035ae00e0fb37f3afbac9cffdd5c3b12014
SHA512 0d4b0873c42ff4da2b908bb458c59adba5765c48c4b2168ff7749fa58bd637b483001615532ca4a4158b9e43ac6881ccf4f372d9faf29f136bd473741a975e9a
SSDEEP 96:wTdrWLDwKJdeQYXcq9LCqh8Y86k5KRmbARaj/8AN5tmgnUYLYtp2pcX5YOt:wTGD5J0QYs9yCLsI+aoCclbsaX5dt
TLSH
T1CF72CAAC31044AC9EF503672D0E25386EAAC4C692864A067DFF63467367348F7EC5E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clone-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Clone-Off.ico
Size 16KB
SHA256 e899579042c65ee392700daf59d07252d9a4241fd70cc56a00075d2be5ce5609
MD5 252a8304468aa4d67cdc654959f72ac5
SHA1 4cdabf4f34cd8a27991ee08d7d0d366ce1060723
SHA512 78854112f576c3ab88a43d1ded442361d32a4f3a5ccfe72f1317b6c0bc0b697cb6f492f5c18053667466eeb37f278c2aac9b54079ff04302c9a2862f704807ec
SSDEEP 96:s+iN0u0u0u0u0u0u0uIXuku1hTed+Up4KgJ+/n5sss6hhhhhhhhhasChhhhhhJH:s+Q3333333IenjTed+w437D
TLSH
T11672EF7D7409902DD5B03038C7229AD7FEE93CAF5364B10122F66E4B95ADF42AB18287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clone.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Clone.ico
Size 16KB
SHA256 d5e17286741825c832a92ff8eca5aa1a11a3873cf825e76d549a06d7527cf437
MD5 818e9c0e411979071778221ef3e64ecb
SHA1 6e9f0e72c0d0dd8d4c6208cc65ce643464c2fc60
SHA512 1cc1202620add273cd1e6eedd4cd01b01457725e2ff798107959f6c4f9dea9aafc068ed8a77e366b01ce2fa4bd92a8c6e8a52d86f5209eacb17924a25f7b3b1a
SSDEEP 96:04eVYumijdVfw5PhI0PI7MS2/uvsss6hhhhhhhhhasChhhhhhJH:GVPJ0/jD
TLSH
T11E7298273116BC53ECB06834BB6682E8BEEE2FE97750F4267080794A557B00CA8737D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microphone-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.ico
Size 4KB
SHA256 0c39e36374122bec7f62f2008971630aab77acb842a8227414aa8efd41b875db
MD5 7a4eae69fa8bbcecd7d1c5c26cbf0f57
SHA1 d4bc72f9954fa58f624718d68dcfa8df4ef43867
SHA512 a1edd33ffbb0cc97952dffbaf87cd813cf6f80fb4a1c27dfbf1e642c8b2ea17076af84fcb674a737fcd9ed7f5d62ae604a777ca10900a01fda7a85cbee5628be
SSDEEP 96:+XDKha7Ozha7DbuzhbtajKEa1WHuY8Z//8dL:apOda7DbuzttamEEWHnm//A
TLSH
T1CC91C833292698D1EE1C5272B4974D92292138EECBD0AD4835AFF7778613233520BB79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microphone.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.ico
Size 4KB
SHA256 a8992375ccda029017fb09cf9f404bb7c7364f6b226dd3c082ad30cfb0897e1f
MD5 ac87badf42c18d9b85e9927553934a22
SHA1 12c52083ceec0b8e02c7df852cd866ae902c5355
SHA512 cd8541c9f9b76b0223e9b323fe0dc8b4d24b18779e876c558fc4d512a2e3807b813941d0033dd32f3b3e7941522b7e2c28e27e25a05a8186b6222065ab666062
SSDEEP 48:h9PzuVTiHY1wUica2VAHonMkr17xG4I961BDkC4DkDMCEPiBCLZZgKI54MhskJI5:h9P5+VSHOy4I9GBQ32PykkL
TLSH
T14091E8516EFE16D9D1ABA43EC1DE5533842FEB942A2C1C2050A9190583F3A8771BA15F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Fast-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast-Off.ico
Size 16KB
SHA256 9d5d274595493a116342d0773e33743f2c8b08dc4c5857fce3467b993428fd2e
MD5 fbf41565033ad19d2248a78cc799f2f5
SHA1 4c60e313038a57b86f2239c50ec7ccc99127ee88
SHA512 3973cddef018e61ac8c25b5bd4af32ecaf12c2281dc452bca7c120a92ac769ab5ce45b123f26a679291a194a8292880affdd86ba35916792a0bcbc3d456530c2
SSDEEP 96:0K4p5TZsT3iUrBF6L2+PIPxG+D6lVfuSSUJVrS+v7x/aMuYAssr6UpW2aNh2Et:H4p7YiUg2+J+elVfbN/u+vFWr6NNNhJ
TLSH
T1A472D76BB545D40BC90012FCDF75E9BEB2B1ED6029548B403AE2BE7FB67C3939916204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Fast.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast.ico
Size 16KB
SHA256 253a04575aabec843f6f4ab9d0fdd874d526f7a0f8c45922bd7bfa9242f2bac9
MD5 4c38f648467f86b0b76cb3bb9913270a
SHA1 1c7abe04aed779f9932f1d518e65e6a24657cf56
SHA512 a16efffddb1813f1fe599b3d7b93b13886640a4b18eaa6e08597c36c0a51aa376fd2587b4842ed3728b56bcfdd7bd1888424cc0f8655b9f83d29579907d76625
SSDEEP 192:HJTxtRje9EmxqwR2fip95+s8YF36PSzbyh4gjRcSJAqG3k9:CWm5rT5DTUKfyhfsq19
TLSH
T132720A70F605D544E61F82F68FF9D6BE4B70AC1919101EDCA5ECBF9B3A792E2C600618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Normal-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal-Off.ico
Size 16KB
SHA256 e108093b0a2897652c3646c58be076fa0f6fea8099858429d4430cefeb2370ff
MD5 68dfefeae93b257db46fcaf0f101c8c6
SHA1 a4c9c364878bbf4192c222be65d0303ad6d13afd
SHA512 e59c53ba2ac469f37ba6f39359d9f62418fc255876820cc0cbc75c6559abd7487c01fd6cb15c54e91622fa7bab5e040dd21b5ffac0d005f66bdc88c0dda62f3e
SSDEEP 192:H2ztALUoI0ZUF9Ij2lk+KCMnLM5mnGEaldiZJdlhbfHbC:KtALTUF9zl6MjEazi3XVHbC
TLSH
T11C72FA6A266CF413C78090B97F53C5FBD734AD083909860279F27E37B5BC25B6A51219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Normal.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal.ico
Size 16KB
SHA256 8176921000f89a71e8719ed20b77ffb380f87bbfe5a59f073c841c61d9a877b8
MD5 6e4004a72a3fea06f4ddedf1a349c54d
SHA1 683937023167f7571dd67398f2bbecde2c7f7cca
SHA512 b1bbda78d27d727fc768d56065773d70918e0f15d8860011de0aba007562ea6985268978858568f631e695f8a4729393c342c0c944280e3e94fe5fe000dc455a
SSDEEP 192:H2cuh0Nb5xpkkQaAjXBhspi5RzwuXXQ+9wAyyIUokFnENHbC:Wcuh0NxkCAlhswg6QswAyyokqHbC
TLSH
T1BD7209AD3629B91BC38050751FB0C4B5D3A2BD0C39014561AAF1BE0F3AFD687DE651AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Slow-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow-Off.ico
Size 16KB
SHA256 76f2e1f2dcb7ef4a532d3ed539e8e5eea900ecfd24b84da91b6d7a6201453aaf
MD5 9212061a50c0a464fc9a23ba2b642402
SHA1 38e063b9d901855295ba27468d386fb19c264610
SHA512 25591857a02bb78bbe1f7e2ae621920cbae65d2ff270d1549acf3aae2a4d59970bf9c9364b9b543dac63fd8d97f0e18708e1f71bdcf76a22c3d9af73c8d34800
SSDEEP 192:/CwLptgd5lGZ7t2wAo+SBBm0imCbg3KIl:JLpElGXAo+T0iWKy
TLSH
T16772B66B6B29D906D31031F89F50E0B59BB4AC0C3A1A9BA16DF23C5F7AFC6535C89017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Slow.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow.ico
Size 16KB
SHA256 06cae75f238e989d3df868fcaa8529c614c3804fd57c6a7fa26f83fa892d26e3
MD5 a3b4f287362f6128ee9c1647af52b0a5
SHA1 de1c96252d1b867089704bb4ad617ff169575fc4
SHA512 0b8541b43f6eb688abe8607c9adb76987238bd724d3b64ebdb46b661deb143765e6a425943b1ec80e09d6e8584859fb639078e3d7bebd72c23c39131d51d8fc1
SSDEEP 384:DEXlwzcFAb/pT9999999H9999999deQKD/715:DEKzcFArpT9999999H9999999dRI/T
TLSH
T11672089A7915A61BC30616398FD0F7B0936C5E9C2F510542ABF7BE077EFC82B5A09428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Baby-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby-Off.ico
Size 16KB
SHA256 8656ab19d7393e74a6e486dfa7c99f6ece46b1a479c6459356d8b9a2493c5af6
MD5 f1df374917d3f8f9ed76f195a95fc69e
SHA1 a0011da872fc603b91b64333db8431b1215dd357
SHA512 f18ad61d77b902113a50361cab2eb549b636fadfaa49b64cd0bb8815d79494e1bf27393d2b3737d77c103c58bf2f323b601b508ca24f873bb1864dc7ea11ff67
SSDEEP 192:vnwyQnnGUJaBo9+uiiiiiiiiiE9iiiiiiiiiik/r31HrrHHPWQKK:vwxJiAWb1rrnuQH
TLSH
T12C7298C27C1CC9C6F51029FD78539B98A484ED9B62D9315AA64FE7DE80E434202BD7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Baby.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby.ico
Size 16KB
SHA256 1b4852f4cdac1a50f802b0590cd615cb41b0dc4cbb2760abfbc7998edc0529e1
MD5 e3fd1405f464a7a805d81082f68e7e9f
SHA1 351b37806e40734e5808929cd25fbe5fe4620f1f
SHA512 e41b022af71f7f7f5a5b42fc75867db4236ef94b15cdf333495da7eab90d89ea5071110ec28b562132f7ab0bafd692fa70d9889c62d736dd1b7e931b05bf6c44
SSDEEP 96:5hnwHoTASy+Md5MpmEjVdCHGVZj0u000AVgWdwbnZVD6CniQKQQQQQQQHQQQQQQz:vnwIJgWpdw6Z4kwTnvVPMdDZyYM
TLSH
T1247294C56D4841E3F572FE77640388EA115328BAF4159CA26644FFBF938EC674BA1113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Female-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female-Off.ico
Size 16KB
SHA256 9e14fa6d74fcfa6aff3f7d8f7dd3b56af1487d759059e5905ab5020f3b231345
MD5 93adf3488c6445baaf58722b824cef92
SHA1 493dbddffdd665be4bbff73710ed6be48f8b5fc5
SHA512 b6fe5dcb7d7c81cb26d0720339466707084ca3d29f6558fc74fecc0f9f6043040e2b6bbccbeb66fd772305be92ed95a9eed703ad2f3adcae8edb55a2c5e0bc25
SSDEEP 192:Vsy/Z0Ka/i/irkkpiZii0qeZo10h+jDycY+1OiVRRwvMcJvJF:VsQaDUeZ20h+PycROiivMcJvJF
TLSH
T112725710B44448DEF73B15B6A653C5D64DA4FC9BEB51203F26DAEA9724F4303482ED2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Female.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female.ico
Size 16KB
SHA256 161de208a3aec64dccd1351be3f0cfb31f4fa144a6fcb6776437613bc36d6074
MD5 9df98607c8c803b39f1f31e1865bbe65
SHA1 1bd4eb1bc6eaaa3036f45bae64c0d091c158f3ff
SHA512 b89b772fef928cbc0990331f4d30bd21cfd519fd45b0fe02114bf8da41134e205dd43ea1dc7ee0744233008183c132f4745eb2fe27712ad7f0928dbadccd7997
SSDEEP 192:GKwpljqcstJ54RLpJKJSVZJZL5irUAannnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnm:GKwplqyJFFLUUAzesF
TLSH
T12972A11076C05189D1198ABB9B3BF063051F2D1A133A99392AF07F0B27AAD875E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Helium-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium-Off.ico
Size 16KB
SHA256 2c639ac60a864b592ec054da4a07d11bb4d6cdb1066ea698cef5d3e59b71704d
MD5 7594baf2728dfdc8f8c55456f5f5f932
SHA1 bc8d54bf277dff6a3f73b3d7643bf43db403d2fa
SHA512 7392ef4431edf3e316f1f2bfa37ce58ba4987f26af9f9023dc7e820473890be5fcee27a8c8536cc4a627ae49040f480bf0d9ab2d751808b0e7f10b7f931f856b
SSDEEP 48:5eAGUYilHGcmSf3IB22T66666666667p3C7KYfrypTHPDGvXP1OK94LBa8Ym1fa:sA1YXcpfa22XQeLPDGPP1O+3rm1fa
TLSH
T1CE72A48AE243D1C9B49416A8CF369BF2C621AD52CB043123FE1F3EF9767A312462455F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Helium.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium.ico
Size 16KB
SHA256 57c4be5d556f6b4c787586728f75edf5f2f29fe405eb362ec400ea7d19159cee
MD5 14d45e43dfe60e6a24bb73dee4f617e3
SHA1 4f2ba51c9c0e3eb0b83fa3401ed2fa737cf67e3c
SHA512 ae50ede1a98eec82ee53aa82f7be4e1fd994ed41d321ec6274f423b0bd19ad9d595d3f9f20c498490af5dd26a7783936016a8795e1b96acf64758588d6279f98
SSDEEP 48:ClHYZTdOiG20hC2R780tJ6Jp0cmzj/dUd/XO6oIcHnnnnnnnnnnnweUApELj+GWy:CaJdOthFR78OJm0Jj/dWeusEjsRNfa
TLSH
T16272275CA1D8D1808A440E2EEF3292F80830AFFDC8D4415BE570BED9B67971FB8C5689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Male-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male-Off.ico
Size 16KB
SHA256 3743770e30f2e35187794c0f765d3313ffca4257d5f54579ec6f49c799a113d5
MD5 ec5bf36ef0d5a9d98b174eae13e053d6
SHA1 c060e8aa6aff84662e25794a86b7e29c15bfbf32
SHA512 9e230ed7ab209ea98ca53a7a639b0ca2f8df3046c8964bb2956d207b5a677c92c01e3b79cd87ddc1d386006b33cbec67250cac28beadb525ac80c971df3427cf
SSDEEP 192:llqzjF+5mmQJ3kSUvY2b8QUOk0n4IsybhirO5q:HMjF+5wJ3nUA2b8QUOk0n4Isy1q
TLSH
T1F3726E52237CC48AD55502BB7956F667EDC36C2D096F8006A9FEBE2B21E56C2340F21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Male.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male.ico
Size 16KB
SHA256 69c3129ac103c9b5c7bf0203d79911a195c52f849b8cb51ea2a72a22ae0e5db3
MD5 4f722d42b679c3137e0ec5d0380b5c2e
SHA1 30f9554ac568321f10ac08346ec5fd9094fc65f5
SHA512 b64d35d1f14449a0b3ce2097324a577101e576d0151ee938cd76124392e75bf6bf650aea3a2654a2436be47d8b93c46d0353eeb048fcc730057a3285c2f5d2a6
SSDEEP 192:m2FBaR89rlv3FD4g0+8MgJ2pzyJYXG2UrOwiuRq:LaR8vug0+8MgJBJYWmmRq
TLSH
T1BC722B733E8098C7E15DB972DEB1DFF03E522D7D1800F20620A17E8B2BA7475AAD8558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Manual-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual-Off.ico
Size 16KB
SHA256 3eca94615a2ca4f29cdc0a3104fd84b6b01dc19415381c32e31edcc1073cfcb9
MD5 a46db4094f28a4548446e255b3b8f6c5
SHA1 b4fbc2baee8d82b38cc4b3af4f76f83acda1cdae
SHA512 a398d136284b7692a6159a2373f52f5658170b3219c08d9f8156b2b612e4b103bd3eab21d6a01b7750fb35995572f7ae1fe41c358819d8c388a660cba406ef50
SSDEEP 192:on8iS575Ovh6jEUNXokcaXEBgNIQDna0icvkcL6QI:oaVOdU0SiQDnaZ8kcLhI
TLSH
T109720993DB29D49EFD2031F0A1D3817B9DF42D352B50968D9F26B44AEEA030B784F519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Manual.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual.ico
Size 16KB
SHA256 d872545106e8e899c1e340e992e7a22cefcbe62eb1aada04fd2089d629043716
MD5 cd5e5ffbece346671f78bf2add304a73
SHA1 cae262814cede831b21a8d2756778d408ae55511
SHA512 d26873abcfc65e7899c6ecc4be47f342a5280e733afe03ab528c5743022a91e0c292823afa699d8044480fb78c0f4ff41cecaf8e0c2ca09d99a5f58fa10f2638
SSDEEP 192:x54DZyK7su/bJvK0lMsJGt+ERNR0duGDuLqEos0YFTUlq9ycX/w8dw+f+u4QD:xmEK7Hv2sot+ERnGDVcLFh3vw8Ou7vD
TLSH
T12B722AC32614D58FEB59737033A7119E93301E242912D25BD26FBE0DBFBA762B849D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Radio-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio-Off.ico
Size 16KB
SHA256 3dd0c14f58f5e386a5351067444709b2ffe4c5af7076abc301c642d75f9bd49d
MD5 d86fedd0bd1d19b0dcd1ba34f29d08d9
SHA1 0887b15268146436037262b9eea36a29edc535df
SHA512 52cfabb25ce0de3f7ff23163de2fcd9e5fcd749d84f1427307955aae3eff74f163ce7d2339a7501321da2142fcd48efe4e7b432742bbd35ef07271e7b258d994
SSDEEP 192:h2tn/HIuTRjg6IAe0mUx7dSchvTZTlPJ3+SqkyYtkhrjrfL:h2N/HKl0KchFTlB3NqkOhjz
TLSH
T1887284692F9CDE20E29638F463B0A14DE9B4DC1116FFC611EE6A387AC37CB42AD5D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Radio.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio.ico
Size 16KB
SHA256 383986e6129a7fa4659787bf5159a03f9b2e0f1ecd8e90d018a326d4f80523b1
MD5 f2214783b072e29992dddf5702b80df8
SHA1 f5cf7b5a1ab07350a6cc8329ff59090b0008c60c
SHA512 ef1afd460324f30e57b9eb25ab0b44ff217052c4d965a1f6617bb3be761f9646e60fa74ab454c269e22808b24f18af8d546c8b4be7142d07440d8990d3e694f3
SSDEEP 384:4oTl5YCj9xL3y9zV6thsifpqpcxLXXtrDPY33QUESZ:V0Cj9x1lDPagUEA
TLSH
T158722B282F9DCD2DE3057D78A6B0C2944AFC8E617D2FD147AF17B8ED88B5688B840574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Robot-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot-Off.ico
Size 16KB
SHA256 16a4d7c4bb8e9985454f48b5694dcc5e915681b6900ecd0dcfd30970617195b3
MD5 49f703b6b44a50cb8446e93ddb5e3e6b
SHA1 f63de1e09be9bbc2e465ed91d0a41cf2878be5c5
SHA512 3608583c4866d3096f3b311a661fbed96cb817a01f296421ec35b665647d4f28ee21b19004a3e75f5e1237d6fc3ae1ed1a5848262786ace9e9071394efb3a9df
SSDEEP 96:8zAJUC5z5mUUnTIMdGZsk3IHUEoRDtlrZVR44U9dAUu0a9clE:8EJUKz5mVn34OOrltpZV7U9do6lE
TLSH
T16272F8623A39D532CD4E28F49D93C88A64B32F657CE85A05B5667B3FC5781629C0E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Robot.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot.ico
Size 16KB
SHA256 f4b31cc68ab44252953dfd7ba9ed190904a2855a187c5eb9b2d1865af6b4925a
MD5 dc21021665efc0d91a3c023349e0088d
SHA1 a9db1ccf0293442e171af55dff9b305da26ed551
SHA512 3d797a568390992805f5a0ad3d247afce0fca4a399c439cd68f2496c4b49491fb216554fe940512c984371083771f73136ec013921bd5184dbc276676a269b16
SSDEEP 192:1VPbSWXUICKM4v3Bi14ucAHtXs2FbWY7btq+pKa7R+hwyBqI:HB5EdHRxb17R6d2ux
TLSH
T1EF725B223236528AD8D1BC3B1E54C4868C2D3D779EF9C2C1FD837B9E2A355139848768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Silence-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence-Off.ico
Size 16KB
SHA256 a5a127fafc661c60ab71a91a3af1e75757dc8f769814886ec1385be491d0bee5
MD5 15b678e256892c094819e9adee6931c0
SHA1 af96f5f1f0ba441cb27fc92ec84bcf64ace578a9
SHA512 4d0f5cc19ace20534c2b88325cb7f1482e444b14628eb2c5d02ba2d89c1f53d4a14033b23f714fab6f5fbe9d2e5d286bdd8d9735b0f343cb156e287506c2998f
SSDEEP 48:csIvV3gtu3B+seAg8UQ2oYbyLbk1Pbofcj3tJXrAAAAAAAAAA9:csGV3YuQRAg8UdoYbfPboEj9z
TLSH
T1BF72963564C7A440F92E1CB00676BA7AB424FE999A7BECB0A21CBF5D14328D19F0770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Silence.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence.ico
Size 16KB
SHA256 174cf35498ac34dbc791179f2eae97421df96566788d10774cd119da236b86c7
MD5 d182f6d36f07ce8c87ab7c3a5b63c660
SHA1 ccb3953c3de04823f64674069b8fd8fdf2d47290
SHA512 849e074ab63223361664fff2a667d13e89de642a877e8c7baf28f3a8580f5cfe32754a750d9fb46cda290daba3cd8887ab6e9824dbca2597d01555e0968724b6
SSDEEP 384:shgBsm+T0t38R1GlgrdxLuHBEACTAJRtQHJny:nJgg
TLSH
T19C72B8F439C38411E92D24FC3AADD99215B23C63C2E3199DFCDE769A12B901E641BB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1fe65dd88e905125f0fe0975dd292827a1ca52403738a77f7c2f051c91e6a77d
MD5 df267ee81dd4141104df7a63f184bc90
SHA1 eeb08693f3534f9a03920f39d2bfbe940a3ecbce
SHA512 a2943548255303b2c59b915e78dd8f1052b7dfcff68db50ef5ab4d0a1b23486575c385ce3ffff755cca7b30e9f3d908a9bcceed728ac91fdbcf1ed2b67171e6c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
TLSH
T1E7B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 1.3MB
SHA256 0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd
MD5 cff7f369730e0075970510da603ff32d
SHA1 a66aa15d2838cf68ef8c5acb09d5b7b79c517466
SHA512 9ec61a4b22cad798b725d6abf43d8be10c50b5694496f479d1b76b86cfc1d9c6f17b255917c3fa7ce7c1f983e4e699df6cbb34d7ef14c04f3dd5c619529c06be
SSDEEP 24576:cYDZBrabd6i5Rf35kxnNxgAqbED5wXBB38X+AbaVppzcLFfXBDtAHCCx5GG:V2J6iXPqrWAqwwqdaPp+XBDtAH0G
TLSH
T1675533A0FB68F598CB22E932DA1824E39DE2A4F51445914F3704EB95B74F2D74D3E309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16bad70c301d4ed6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\16bad70c301d4ed6_0
Size 3KB
SHA256 24cdd192bac8c3ef7c5902b8f4a86af6ae04758b778a896484504db53cc4773e
MD5 22607439ab9fc7a90864a1baa2b8c068
SHA1 0eeac6c9f26f99f2c84778c258be98bf090b7dba
SHA512 e885b955fc2be71a4782f7aebd396f12487680b5bd4fb0a7405f4a82a542ae1a70938f1c31aae6bb9b9c811e6a4f0bdd41464b9fb91b7f2efd6160d646adf1bd
TLSH
T1AB71A5E6A3449B0DCB36A3F912568626A336800C3ED3872350C1EB722D942F76999D4E
MD5 SHA1 SHA512 TLSH

Submit Download

216da2577ffd6d26_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\216da2577ffd6d26_0
Size 320B
SHA256 456978e313c929204e8d5a8868937107b9a37c1fbd23af6cc5229282e2c3957a
MD5 e3f4718d190c7b20513f2c349dbee918
SHA1 4a8adb080685c3d977ff0f4cd1ac88af4d338db5
SHA512 062dd414d52d6f638b8898908408a3b797bcd51157e7c6d955b7ef34bdfa77656ebc946549a60fc5f32be4c5c54625e091c1fd8c55529b1e9d968f355389a948
TLSH
T1E7E07DF724482011C5EAC7F19596469F92A340480C2554D1E40551B25764B76326D132
MD5 SHA1 SHA512 TLSH

Submit Download

336a68eaaf209f48_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0
Size 309B
SHA256 58b50d12e90bf197a291a816abb8536391c077eb458cb2d8eb44fcdb20e6f7a6
MD5 0150a2d11ccfb89bc2b4165c91e0feb5
SHA1 fda4332def912bb057139897152cb9bbc25a641d
SHA512 68de1a946ef2585a1b1f3425c37df13867313d9c17bdb809aeb54f4de34c9715c661f64db83d61b14487491cdbcdddf7d917e281ec7d32c934ff424be906ac92
TLSH
T174E02BF395641992F6BA46F39E5623BEC23750D91DE59CAC245490262A109E0A3C3275
MD5 SHA1 SHA512 TLSH

Submit Download

7fc9bd879aa4bcd5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7fc9bd879aa4bcd5_0
Size 2KB
SHA256 f5dcdd4e69b88a2729114e5b0fc1465ba6020bbb77f546ba82ffe0644a808327
MD5 d0f9766f53b2dd3ac3b4bc58fe353504
SHA1 2f1d7a6c208a022b42af4f641f91f3cb1e5d403a
SHA512 d043a269210d2fe355689f7d10f770681db4bc2b10ccc3ec2f620eb3361b55df33dc447a1a928c500b3a6426edea3e24de5b0d12abf98c36dd714a0b9e0074fd
TLSH
T1F85119F773949555DF33AFB893821A17AAA271059DA28F33242086A21C507F3399D05B
MD5 SHA1 SHA512 TLSH

Submit Download

92411b9b079a4d7e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\92411b9b079a4d7e_0
Size 302B
SHA256 31269796b7fffa34fe2a7a0cb3f59ccd7b3849ceb066b8bb2789220bb05c82a7
MD5 f0b1ace84e91357d272f28a161930c20
SHA1 4996ad9dd365664581ea79deb0393311aca5eae4
SHA512 c1a6ea7ddce5451e3ae0c2ed04b7b5041a5f312bee795591b9ea219ef091c1ed5f3c9f1116d099bb205908a6cf0db89793b963432ce1ef8f1e2a411a22793398
TLSH
T17AE0EBF3D0002520DC36E3F3E2F04459C34F40C70EB68198A02262B213187F3EA47270
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 112e13c0d7222c7a6136d8a75f9914f8218de637a05694c6c969e0f1616f9a60
MD5 80a44af8ad16fe83df3d43054c9efc84
SHA1 f79903521f757fa4223bac6c33d156286bbc7bf0
SHA512 65a30f6958f582246f3062045a6ce053623dee8b51469f227d36b4cb6f0f34c14fcf7b55c865549884f3f8d6f67e2304a17ea7d2be889962735b212dec8e06af
SSDEEP 48:1B5btz4uI92VVlXsS45Wy5hLHu+CdcrvWUEOoNlWSQ5LLADy7tlwAmaR/Snq:NN4rSGWy5hiFmrvnEvYID6XmaQq
TLSH
T161A11AF23051131CFB700076E7DA092578B6B6DAF147BF9A5010A876680E7EEBE3841B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 90feb474a0f3013561af51d3fea72ca38de7aef191607dd66f57f017b563788d
MD5 9dcb21ddf685d8327224e23a0e0a02d1
SHA1 a6ceaf70009459d2b5f8d45149f2a0fb80068a32
SHA512 a7bc67fc57e1be16259fb1dca34030475bf3433a727b7b3ac3f9c9eb4486d624ba9cc78181444190282c84fc5edf05c1a31d678d024d1064afb2d48797a01b74
SSDEEP 48:2B5btzZuI92VVcXWS45Wy5hvu+YalKSUEOt5+6lWEQQLLbDyKtlwAm6R/Sn2:QNZrvQWy5hmnaKrEW5Z1TD9Xm6Q2
TLSH
T190A1D6F23291232DFB3005B5E7DA05247834BAD9F507BF9A5014A976691EBECAC3841B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5888c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5888c3.TMP
Size 3KB
SHA256 0bc197f040ff6d77a3e016125da63a0c47c3284bc4c3e58238f3ed170067586d
MD5 63575115ce75a77cf7d0c44edc71488e
SHA1 8c6741fe7d9168d5d18c3b6a0e3fbcc337971837
SHA512 9749fac252d12a5e9e84d4fdaf692a134163613aa31ac22d3ceaf8c1f06b82534b71087bd0854ba169b8bd9f47b8563946fb28002a0a6a45fd4399699bfb7c59
TLSH
T120715EF431111B7DF3300271ABEE02257538BAD9F4477FAA1064A836591DBED7C2802B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 86124ce0f8e0351330547d9f53d84cd879d4139c68d6bb299333659db402d5d9
MD5 cbe2d778ca2eb10a3a62981da20e3bae
SHA1 2d9e40062ff49deccd92aa28724def5e0032b600
SHA512 d36c5068397c10b6724d253a447bc1ff727bcfec20f720926788e6e6d2fe41cd10396c19daca041cc57da3e1245f22e6b6d5eddb7a215b5c0fa1c8b104bc1b26
SSDEEP 192:DqyhyDy4JyIyUykyKy0Jy1yyy8y3JyYJyUJy2y91y9Fy5POytMyNyzyFyVsymPTT:DqyhyDykyIyUykyKyQy1yyy8yZyYJyUw
TLSH
T122026FB7DAD5852DCB621BF0F6117A2ACD390969837C7C1A8DD4AF1BA3E14709101ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f22d3ae125907dc47333a192c5a043fdacddeefd4a50fda6c04b9cd16b53c7e5
MD5 c31433c70c9450919c226b068939d9da
SHA1 914345080b6fe847a438f5c12ce631170f6bbbfd
SHA512 08591254f69202928a462a9110b661bddfa9adaaef86f75bc6abee45f983f9afa830adbc11e56576efa22baacfb6b6480a8075fd62edf69c647958885d7bc8ae
SSDEEP 192:DqyhyDy4JyIyUykyKy0Jy1yyy8y3JyYJyUJyD1kGy4ysylpycy/yZytLyUyYyWPE:DqyhyDykyIyUykyKyQy1yyy8yZyYJyUX
TLSH
T18A026EB7DAD5852DCA625BF0F6117A2ACD390969837C7C1A89D4AF0B63E1470D101ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cfc71463545c4911b9b80e1a3be08f74ae9ba591883c52e8675b6b5021e6d2ab
MD5 fcf9fa71c4c2bec068f3d07991780ffb
SHA1 a03a3691b56fee55a27c5eb6baa590a8599d6367
SHA512 05d7239df91bb7cba68339554fb54f4e1bdc4554728b7d86e3c698276e1170dbf7b05c9e00c029ec82fd66eb2fc7867e99ea5b68174e18847d2eea8a7bb200c2
SSDEEP 192:sxZyR1yM/jK1Ml8Mk+/faseXUVEIdpUFHW6+WND4//YvBWeLBIgrJ:sxZyrM+/faseXq8Hbs/SJ9
TLSH
T12B52F815AA34A977CCDBD20DFA41BF53D6F9052292901E44AEFCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 03b4060b982a3d179d4ebcbca95a86eb78cddbcca319102f93de1308bfa7b57c
MD5 916da65f89cd1ace5270be990aaa8efc
SHA1 77171377bc95d6e3f0fc7d5d320b3fd26f53509d
SHA512 41bca0b7f0ec82ffcbba89614d90aa5073f2ba02c98fe9621c4e103ea8bc189fa622a1b8ed70004121836fc87e705a07bf84df60693b183054d41e414586f684
SSDEEP 192:sxZyR1yM/jK1Ml8p9+/fasFWpV7elVEIdp2CHW6+WNL4ROfYPJrE8rIgbPJ:sxZyre+/fasFWv7e9JHbjfdcV
TLSH
T1B362E915AA746977CCEBD20DFA41BF53D6F90422A2901E54ADFCDA1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 25e4d78869177e2edc55a53073fd834e911826c5f54b7258267b993d0b5b18e4
MD5 b2d857932dcf9ba289a3223d3b6a8d70
SHA1 be7cd5337bc4fbbc631ab6a1e816c7422a7499fd
SHA512 3ac2cf59fb4c64a1592ba1f08b6a30f7f5ab74f59dc6c7b61c8e79545a1a9c7ede2590cda1421a41ad36a1b97e991efab4f2dc95733ced088d3eef509ad4c792
SSDEEP 192:sxZyR1yM/jK1Ml8M9+/fas4XUVEIdpUFHW6+WND4//YvBCeLBIg5lJ:sxZyr1+/fas4Xq8Hbs/mJJ
TLSH
T10D52F815AA34A977CCDBD20DFA41BF53D6F9042292901E54AEFCDA1C04E2BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d34521840af0d2240c56d53d7be08d0df37e0619992d24803ae52a9ac49ba157
MD5 00fda33241e5855eb2a8a8961e7dfbd8
SHA1 07e649e8ecf64169d06465314409496662fb89e5
SHA512 063605d563f11b50df2389c294608ad907d86a95f6cc48a7c239e585bd8be6043770202144236ee4870bdbedb8e4c1397ffb173db735a057855668d063dab87b
SSDEEP 192:sxZyR1yM/jK1Ml8Mj+/fas4eUVEIdpUFHW6+WND4//Yvq2eLBIg5PJ:sxZyrb+/fas4eq8Hbs/bJf
TLSH
T17C52F815AA74A977CCDBD20DFA41BF53D6F5006292901E54AEFCDA1C04E2BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5ea0905de145269ebbeb8edc80b34d5b188bd4c5b9782f9d86c1663b55e8ec5e
MD5 70627c8c35dd49a265f599e8d93e6171
SHA1 c010c0c5dfc9f609cd549534e13909f3c9f12a83
SHA512 4d8357ceef2e89dbc3f256e2e8baa81553a021461a97e6afffea056b73de1657f3469b00c06e480970a1a77470b1cc7a0059c2d9c84753a80b524eee85f0910f
SSDEEP 768:55seJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp6roqt:55seJ3xWvhfwnu1jaVcL88px8
TLSH
T190E20B2B280CCB7E4F844E6DEC2A6F966EE801CB67984D5447FA980C03C77EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c067dc3b2bbbaee7fb91077fef7e494b22202b9f0ea5844ead95265ff362583a
MD5 4a6707bd17bf0f4329083542ad5c5fa5
SHA1 902fad90b0846d6ba98963e962cb164cd4eaad03
SHA512 84af15c98ac069cfb0d734f60963a3245e6e8f27d90fd1f3a0cbf7ac606d32c60f570693fc74c40624041a80fc2060eb66656aa165eb2038a5697d11302310f7
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Eg:KYHIhKggkXyBcIHK5W8Ty95I5KSEcC
TLSH
T159913202357F02023C7D254CA6A296364E4231E3359CB4AFBFF804955E66E214EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc64cf5a-a526-425b-a93a-b4a633f2f60c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fc64cf5a-a526-425b-a93a-b4a633f2f60c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 6aa2e8f0378b52aae60c7592615881e09b5d1cabf176614c63d0946312e787b0
MD5 911abcba9c536a0a9d1a0e6abf908b61
SHA1 36b1de440d98562ed176bf287dba8708faa21339
SHA512 1cb80ba4a0fdbbd36a785c69d7b8184babc6bee9ab560ce5a236a9ddcc65f23e4ccb4be8371fa8336870e197708b6446b5308d487f8359eb71ce3ca059b89161
SSDEEP 384:EmiFaZcIp8sNR8TUNTUlIlD007yqDlJuldLKoJr+qpN:wFYqkwgW07Clh+qpN
TLSH
T1ECB219F248D7883BD9AEA743E77D2E028EBCC067B5849650B7D85A1CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b32b5d66f7fd2a4f91570cb7c26802ac0411f8b27e1bd955e9f5d32e8a7f06fa
MD5 6a33ae041cc120e1e979bfb5fca1dd97
SHA1 3683a26b5b7d4ae8bbe325954ba5fba954c5b772
SHA512 56aa5d77e3adb977ab6711d7e37277d139658fad61ee4f7cab037172f74e2c1f56a08c740450ea46e8d6b7bc9a1e811f26247ee4658d89c3a488736b26937600
SSDEEP 192:lON76vMtPQmiUyxoThTFp+FdLXKV847aFU/u:lON76UtR9TOdLK1uU/u
TLSH
T1A6020735AC786C7B9AB3BD86F48A27171FE421ABE5D11B50EAE82F1D00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4295dadc3f71d4ff7d50700cb391f0b3c7892758a75b3bd4b0e0ce4635e73f79
MD5 fd45a9fd213dbbf281d7f715cbd58a5a
SHA1 9957091f79c86832d71c2111f571824af3be80c3
SHA512 da0f4cd2c70c21c098aa5ba8dc6847f4de4ab7eb7ae4233223050084ba40b97b85e18d07af6411cda9dfe6f869aa85deb12b00ee9a1fcc9b8751c049d7dc3c86
SSDEEP 192:fkONK6vMeqPQmiUyMoUhTFp+FdLXKxzSJr680ISq6U/u:fkONK6UeqR+UOdLKoJrjqU/u
TLSH
T196121C32AC649C3B5DA3B581F08A36135EF0D26BEAC56B60FADD3F1C01DA66C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 22dbac28e63d537526a15c351c32e0736b0756b7cd76222967269b1af98ccbae
MD5 91c2da5d048a0536faab6ca806674c20
SHA1 355fea30e6d6cac958b2c791a3ae46c45ecf9556
SHA512 42ab63f9db1b05021572918cb114410cd36eaa662c0248e9ff7e6a00054d625efc3cc2a6c81951c0ea8a172cc6cbb2d141dd8c77108ee346e6925ee237889cd2
SSDEEP 192:uvWm+xasuheOwQxMGsNvGQ9jPM7FcqvQmiU1TvJB4MTFp+FdLXKxzSJra8z1Sq6/:oFZcIhsNvG007yqx1JuldLKoJrzqpN
TLSH
T1B5627C726C749C3BA9B7F281F48A37135EF49127A7C45B60FAED6F1D00D92A8030AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ef0e9b854f29c2c5595749c11fab17b16582d01a147571c44a3604c8f05964da
MD5 256fb25e8b0095e7126ba7097ad6bb7b
SHA1 f53c87e94560dae510601edae6b5113701004817
SHA512 e0448dde45bf98bc493d77fe7aa79c20db031478e8e2b88afa94a291d87196e016ff17243bffbff4abbb7b4d94cf74abbfde6dd119ac75f0d9e50b9fcd3de0cf
SSDEEP 192:u/Wy+xasuheOwQxMFsNvYmQ9jPM7FcqlQmiU1TvJB4MTFp+FdLXKxzSJrH8z1SqG:sLZcIisNvD007yqD1JuldLKoJrMqpN
TLSH
T170727C716C749C3B98B7F181F48A37139FF49027A7C85B60EAED6F1D00D96A8130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 219a735557b4b9d26bd37a59d2a29c547ade065922a18d0b026ecc9263b7c915
MD5 6ed3b929e8d80530d3821d279d803876
SHA1 014f246b0a6464a72b4a478c68f87d6bde3dae44
SHA512 85826e6d9e9510303bacdc267b379dd980fd617829682dd4762d235ba1151556d6cbf8ef691512e9b5c39d3a1d8634783f08296864a4c154ef39640eae3e882a
SSDEEP 384:EmiFgZcIp8sN28TUNTUlIlD007yqMiJP2ldLKoJr21Hv4ASBqA/sJOK+Y4MkZpN:wFeqJwgW0jlMlh21PScAK+Y4MkZpN
TLSH
T1DBD26EE188D38DB6D46DA7C7A77DAE1259BCD033B5888508B3E4652DEC4B1BFD306411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7f1edf5a00a925dbb865c3b467ef0a9ab80f52331d117ab02c2901b5fae5ca30
MD5 d92613f26d183633f4c1cfda53d3d07f
SHA1 f99bd9d8e2aff552a7643a82ac29811136cb50f6
SHA512 f1a7b609bf663cbd70ce88993eff259ee64a2bf50a17b55749950dbdade0d74372b37782805adfa156f3e80ee288922fcd7594aedda0ae1a796a60972f78264f
SSDEEP 192:uvWI+xasuheOwQxMgsNvY1Q9jPM7FcqLQmiU1TvJB4MTFp+FdLXKxzSJra8z1SqG:otZcIfsNvy007yq91JuldLKoJrzqpN
TLSH
T109727C725C749C3B98B7F181F48A37139FF49127A7C45B60EAED6F1D00DA2A8130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 86401d357651c771b49cf4e751981f89913afe6a2a64b1c5249fbdc48bdc2f9c
MD5 92edf1069ef7366e4c27c44c727c880b
SHA1 7bf927357ce78796c3035633b7d55c1435bfe0c2
SHA512 c57739d4da6ec26ab0228a5183d32c92a4845bbb5183c2b418b5a094455ca336824574f1d65634ae8a8888297552afe145bf705e6e9b02411571d4774eced54c
SSDEEP 3:MsEllllkEthXllkl2zE/lgS/:/M/xT02z1i
TLSH
T12444040C7FC00C07C50011314051C35033F0D7110F13774334550433DCC57400C40104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44c208f9-8682-48c9-b66e-40f5a343d16e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44c208f9-8682-48c9-b66e-40f5a343d16e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4f86f2be50066fc1837403242d28d6463037b7aa7ec538e3e0d8cf83e45429e8
MD5 2b4259751ee3eda97d28208181296c8d
SHA1 be9265e98e3f1070097dbbd48ecdca7a5858fc51
SHA512 662a73b95120b0284a0e39beb04e32aa019a7592855a5fde15c1d5870eb46e6f85ff5922f9c0c9e5e99295598a6a3b2632e006cf634c3231cbed776252a66159
TLSH
T19041285CB6F9114CB3B37F1AABF6686E487BBD772E06D59E10010D4F0662A40D9A1733
MD5 SHA1 SHA512 TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4DFE.tmp\KillProcDLL.dll
Size 14KB
SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
MD5 586270250a1acce8126a0877fd5bb981
SHA1 9f5645b37b3af04004697639855da5c99a41aca1
SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
TLSH
T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockedList.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4DFE.tmp\LockedList.dll
Size 28KB
SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
MD5 2ee096682cc84f5fd44fb5291c00596c
SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
TLSH
T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4DFE.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso4DFE.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso4DFE.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1013B
SHA256 fff26b6c2dc6cd0edef0a328328ad37c186e03af9f78810bc5e0c5234ca663b9
MD5 d03aa3a8a9377d16452d572fcff3d46a
SHA1 e013a5b64b2f664fbd75b0e0880ecba2e7af21a2
SHA512 b4c952b66d64d931118423f3f16c2dad0d1ea896c0a1efc3fd7c94e4f494995e98881936bf7b88881d46c3c6bc13c0a8e38497436dc97c32126e3ccf52341b2a
TLSH
T1E71102590F289E8A2F54F213347EC50933ED3D08F09A74DCDA6A0A8E1CE52EF6364254
MD5 SHA1 SHA512 TLSH

Submit Download

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 1KB
SHA256 3611675b9bcf40e3ea22de1058cae462b08be53f32c759c5b97236cf7d96f33d
MD5 169a54964a216725a0f987bfe93839ee
SHA1 94ab45453d940a68689ce507513dc97d66b5c70c
SHA512 eb21310f5157335c3b48891ee925b208e32476b1a2d3fc8e3b3d0d97a250c6e3239fdc9d9b2a2bc6671158f17d5450b6ee79d3fb8acaa16ff6b629b78baa9dba
TLSH
T1DD11205D4F689E9A2F54E213343EC10836ED3C08F0DE70D89A7A0A8E1CE56AF6368250
MD5 SHA1 SHA512 TLSH

Submit Download