Resubmissions
08/08/2026, 01:41
260808-b35sbsxfnb708/08/2026, 01:32
260808-bxx6aszxez708/08/2026, 01:22
260808-brlv3sfl4y808/08/2026, 01:05
260808-bfhpaaxalh708/08/2026, 00:55
260808-a949pser3s8Analysis
- user interaction
yes - max time kernel
273s - max time network
307s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 00:55
General
- Target Antares Auto-Tune bundle V9 CE.exe
- Size 110.0MB
- Sample260808-a949pser3s
- SHA256 fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 39 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of FindShellTrayWindow 33 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ACK2C.tmp\Antares Auto-Tune bundle V9 CE.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACK2C.tmp\Antares Auto-Tune bundle V9 CE.tmp" /SL5="$701E4,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune bundle V9 CE.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExpandWatch.avi"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Antares\unins000.exe"C:\ProgramData\Antares\unins000.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\ProgramData\Antares\unins000.exe" /FIRSTPHASEWND=$400622⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Antares Audio Technologies\Auto-Tune Access\Auto-Tune Access Manual.pdf1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Program Files\Antares Audio Technologies\Auto-Tune Access\Auto-Tune Access Manual.pdf2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe3a0dc188,0x7ffe3a0dc194,0x7ffe3a0dc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7788152156452320983,15592309936744363880,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,7019920374962326393,15064498702127516038,262144 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,2943250231778957200,1208791665302962110,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3647071257820774450,4106021047631909777,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,5499533898119940239,9653788544917860716,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,1231453361283214526,8997412589426806109,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,1059712120183760701,2286305546716202467,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3692,i,12484155497932183029,5623944960653201403,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,16173446214160381650,12815520649367265677,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5464,i,12364197496774369713,779523333421028439,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,16890280554626055634,16597429023990619345,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13497315796954530230,6924955491699741802,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,748006433071736713,18183420719872570091,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,26121442250884552,11809172496595513581,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,26121442250884552,11809172496595513581,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,9786602941808679554,7252010424204524334,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,10399952520773524926,14777390291907035679,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,6797397254891108269,4732050332919957214,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,15643922398622507110,8437226312603918440,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,13952260429390672076,17030257804183807260,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,12770371051529390758,1698411229747785083,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,14452612413986410162,5304176667086682844,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,1710044234316878348,15096060878085706918,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5688,i,9354702803040023273,14044541664058863337,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,8068008526175567096,13887235776138822107,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5716,i,4244276148100234076,17152135650029603378,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6936,i,10260862947630736379,12711531292787653626,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4244,i,1108429744166351679,8548821477914050514,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7308,i,6312590368308308034,7681117731028202523,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,10687227565479893015,8086561879845590097,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7180,i,17460158370681008686,15614179284451700708,2097152 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7912,i,12394871663542313750,29299969360082868,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\MixPadMultitrackRecorder.exe"C:\Users\Admin\Downloads\MixPadMultitrackRecorder.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\Downloads\MixPadMultitrackRecorder.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -installrelated f5⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\wpsetup.exe"C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\wpsetup.exe" -LQUIET -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vt -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.Off%252CMixPad.ChangeIntroBulletsToIntroFeats.On%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.On%252CM.Bold.MixPad.BoldDotPointTxt.audiomuscetracks.On%252CMixPad.BigHdrBtnFreeDownload.Off%252CMixPad.RoundedButtons.Off%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.On%252CMixPad.TopDivAnnivMessage2.Off%252CAll.EdgeDldBubbleTip.Off6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\wpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat" -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vt -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.Off%252CMixPad.ChangeIntroBulletsToIntroFeats.On%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSenten7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\NCH Software\WavePad\mp3el3.exe"C:\Program Files (x86)\NCH Software\WavePad\mp3el3.exe" -LQUIET -instby fiWavePad8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe"C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe" -installsched8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\vpsetup.exe"C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\vpsetup.exe" -LQUIET -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vtFWCoJ3ilZpgtFMspP0peL1jvOb9nQnaeBtssVdblAbhjMIXPADSofttbsonWTvvMIXPADMixerhometbbtnoffMIXPADSearchbarv2onMIXPADCrescendopromoteonMIXPADMultitrackselectoffRmrwN3cnNg6eDpeqITrj -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.Off%252CMixPad.ChangeIntroBulletsToIntroFeats.On%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.On%252CM.Bold.MixPad.BoldDotPointTxt.audiomuscetracks.On%252CMixPad.BigHdrBtnFreeDownload.Off%252CMixPad.RoundedButtons.Off%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.On%252CMixPad.TopDivAnnivMessage2.Off%252CAll.EdgeDldBubbleTip.Off6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\vpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat" -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vtFWCoJ3ilZpgtFMspP0peL1jvOb9nQnaeBtssVdblAbhjMIXPADSofttbsonWTvvMIXPADMixerhometbbtnoffMIXPADSearchbarv2onMIXPADCrescendopromoteonMIXPADMultitrackselectoffRmrwN3cnNg6eDpeqITrj -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.Descript7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe"C:\Program Files (x86)\NCH Software\VideoPad\mp3el2.exe" -LQUIET -instby fiVideoPad8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\VideoPad\turbojpeg.exe"C:\Program Files (x86)\NCH Software\VideoPad\turbojpeg.exe" -LQUIET -instby fiVideoPad8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe" -installsched8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\switchsetup.exe"C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\switchsetup.exe" -LQUIET -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vtFWCoJ3ilZpgtFMspP0peL1jvOb9nQnaeBtssVdblAbhjMIXPADSofttbsonWTvvMIXPADMixerhometbbtnoffMIXPADSearchbarv2onMIXPADCrescendopromoteonMIXPADMultitrackselectoffRmrwN3cnNg6eDpeqITrjG41uPbokHv8xMIXPADPlaypausebtnv2onGnbnMIXPADGhostlinesv2offMIXPADMidichannelrenamev2offMMBhLbdvXl9uR0cuY5sgAFWqEb2bUyzmE42hYmfsMIXPADNewprojtemplatestrtscrnoffAGme -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.Off%252CMixPad.ChangeIntroBulletsToIntroFeats.On%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.On%252CM.Bold.MixPad.BoldDotPointTxt.audiomuscetracks.On%252CMixPad.BigHdrBtnFreeDownload.Off%252CMixPad.RoundedButtons.Off%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.On%252CMixPad.TopDivAnnivMessage2.Off%252CAll.EdgeDldBubbleTip.Off6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\switchsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat" -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vtFWCoJ3ilZpgtFMspP0peL1jvOb9nQnaeBtssVdblAbhjMIXPADSofttbsonWTvvMIXPADMixerhometbbtnoffMIXPADSearchbarv2onMIXPADCrescendopromoteonMIXPADMultitrackselectoffRmrwN3cnNg6eDpeqITrjG41uPbokHv8xMIXPADPlaypausebtnv2onGnbnMIXPADGhostlinesv2offMIXPADMidichannelrenamev2offMMBhLbdvXl9uR0cuY5sgAFWqEb2bUyzmE42hYmfsMIXPADNewprojtemplatestrtscrnoffAGme -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\NCH Software\Switch\mp3el3.exe"C:\Program Files (x86)\NCH Software\Switch\mp3el3.exe" -LQUIET -instby fiSwitch8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\Switch\switch.exe"C:\Program Files (x86)\NCH Software\Switch\switch.exe" -installsched8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\zulusetup.exe"C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\zulusetup.exe" -LQUIET -instby rpMixPad -instsvar VhunXOBfDrkvCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveoffMIXPADExplorerbaroffMIXPADIsovocaloffT7ghMIXPADEnabletracklevelduckingv3onT7vtFWCoJ3ilZpgtFMspP0peL1jvOb9nQnaeBtssVdblAbhjMIXPADSofttbsonWTvvMIXPADMixerhometbbtnoffMIXPADSearchbarv2onMIXPADCrescendopromoteonMIXPADMultitrackselectoffRmrwN3cnNg6eDpeqITrjG41uPbokHv8xMIXPADPlaypausebtnv2onGnbnMIXPADGhostlinesv2offMIXPADMidichannelrenamev2offMMBhLbdvXl9uR0cuY5sgAFWqEb2bUyzmE42hYmfsMIXPADNewprojtemplatestrtscrnoffAGme -instrefdata refdate%3D1786176026%26referrer%3Dhttps%253A%252F%252Fwww.bing.com%252F%26ref%3Dbingads%26ref2%3Dbbc1c048a6211ec23617aa3ed98294d8%26ref3%3Dkw%253Dfree%2520daw%2526m%253De%2526d%253Dc%2526c%253D77103492103205%2526ag%253D1233653102426072%2526referrer%253Dhttps%253A%252F%252Fwww.bing.com%252F%26kw%3Dfree%2520daw%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3DEdge%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.Off%252CMixPad.ChangeIntroBulletsToIntroFeats.On%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.On%252CM.Bold.MixPad.BoldDotPointTxt.audiomuscetracks.On%252CMixPad.BigHdrBtnFreeDownload.Off%252CMixPad.RoundedButtons.Off%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.On%252CMixPad.TopDivAnnivMessage2.Off%252CAll.EdgeDldBubbleTip.Off6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-3024-1\zulusetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat" -instby rpMixPad7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\NCH Software\Zulu\ffmpeg23.exe"C:\Program Files (x86)\NCH Software\Zulu\ffmpeg23.exe" -LQUIET -instby fiZulu8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\Zulu\x264enc8.exe"C:\Program Files (x86)\NCH Software\Zulu\x264enc8.exe" -LQUIET -instby fiZulu8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\Zulu\aacenc3.exe"C:\Program Files (x86)\NCH Software\Zulu\aacenc3.exe" -LQUIET -instby fiZulu8⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\NCH Software\Zulu\zulu.exe"C:\Program Files (x86)\NCH Software\Zulu\zulu.exe" -installsched8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -installsched5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8172,i,14704519882629858653,11755539082526268413,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5870261717892886988,17188948336808002866,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,11794711167612344224,14364246211890791447,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,16070246647897127775,17499304061358819596,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7732,i,8514241034261950192,360768581788440601,262144 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,3887141869930987883,5957609035576447864,524288 --field-trial-handle=2372,i,4967705257619420206,7446420534057302596,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\Downloads\MixPadMultitrackRecorder.exeC:\Users\Admin\Downloads\MixPadMultitrackRecorder.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe"C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\Downloads\MixPadMultitrackRecorder.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"C:\Program Files (x86)\NCH Software\MixPad\MixPad.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x154 0x4501⤵
-
C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -runonstartup1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe"C:\Program Files (x86)\NCH Software\WavePad\WavePad.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe"C:\Program Files (x86)\NCH Software\WavePad\wavepad.exe" -runonstartup1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"C:\Program Files (x86)\NCH Software\VideoPad\VideoPad.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Program Files (x86)\NCH Software\VideoPad\VideoPad.exe"C:\Program Files (x86)\NCH Software\VideoPad\VideoPad.exe" -exe DebugSaveDumpFile2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe"C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe" -runonstartup1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\5bdf29ed7d044f8ab22f32e51ef14817 /t 6928 /p 69481⤵
-
C:\Program Files (x86)\NCH Software\Switch\switch.exe"C:\Program Files (x86)\NCH Software\Switch\Switch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\NCH Software\Switch\switch.exe"C:\Program Files (x86)\NCH Software\Switch\switch.exe" -runonstartup1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\NCH Software\Zulu\zulu.exe"C:\Program Files (x86)\NCH Software\Zulu\Zulu.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe39adc728,0x7ffe39adc734,0x7ffe39adc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,8787823323238135139,8723195674514328351,262144 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,7611073883638231955,8686611489556759646,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,2586995886779528524,14816000532156004470,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,17156478179183699439,4731666296104671152,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,17617883416269813033,14559519049564470117,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,15439293578315083750,10684459397932802451,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,12955627181392202552,17087701539943260646,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,8515252838609486552,13949679566340994073,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5240 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,1419688211832356101,2746392083507465935,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5420 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,10602575957055687845,2600346601436870628,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,14794382683249984013,244138113568223304,524288 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5348,i,3112750569389516502,7921810873982913703,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5816,i,8428489454632782123,5512396746985634698,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4616,i,3903954290272195838,16611642774521356443,2097152 --field-trial-handle=2164,i,5070655237402077625,6554488247701203236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
dustscratch_textures.zip
dust.jpg
filmlines.jpg
folded.jpg
grainy.jpg
hazy.jpg
scratched.jpg
streaked.jpg
torn.jpg
waterdamage.jpg
mp3el2.exe
turbojpeg.exe
mp3el3.exe
aacenc3.exe
ffmpeg23.exe
x264enc8.exe
Auto-Tune Access Manual.pdf
is-1NQBQ.tmp
is-RE0UU.tmp
manifest.json
manifest.json
manifest.json
manifest.json
unins000.dat
unins000.exe
AM Radio.ecf
Alien.ecf
Angel.ecf
Astronaut.ecf
Auditorium.ecf
Autotune Pitch.ecf
Autotune Robot.ecf
Bathroom.ecf
Big Guy.ecf
CB Radio.ecf
Cartoon.ecf
Cave Monster.ecf
Cave.ecf
Child.ecf
Chipmunk.ecf
Concert Hall.ecf
Cyborg.ecf
Darth Vader.ecf
Demon.ecf
Dracula.ecf
Ethereal.ecf
Fairy.ecf
Female.ecf
Frankenstein.ecf
Geek.ecf
Goblin.ecf
Grand Canyon.ecf
Hanger.ecf
Heroic.ecf
Impossible.ecf
Jumpin' Jack.ecf
Klaxon.ecf
Lost in Space.ecf
Male.ecf
Nice and Clean.ecf
Ogre.ecf
Old Male.ecf
Old Woman.ecf
Pirate.ecf
Pixie.ecf
Protocol Droid.ecf
Robot 2.ecf
Robot.ecf
Squeaky.ecf
Stadium Announcer.ecf
Super Villain.ecf
TV-Radio Advertisement.ecf
Teenager.ecf
Telephone.ecf
CB Radio.ecf
Professional Broadcast Female.ecf
Professional Broadcast Male.ecf
BrowsingTopicsState
messages.json
craw_background.js
Preferences
Secure Preferences
000001.dbtmp
cfdab65d-166f-41c7-af55-021b36581014.tmp
Local State
Local State
2cceb306-60af-40fd-9635-638380ce19c3.tmp
protocols.json
settings.dat
settings.dat
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b03b6.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5b92c7.TMP
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b460e.TMP
the-real-index
the-real-index~RFe5c23db.TMP
index.txt
index.txt
the-real-index
the-real-index~RFe5b9bcf.TMP
sync_diagnostic.log
f1939056-595b-4ce5-bb56-9db258d79761.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe5b685b.TMP
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
45c097fd-344b-42d0-891c-df4c124707c9.tmp
5C02.tmp
85d4dcfa-cc7c-4177-af7e-7f8ca1160870.tmp
switchsetup.exe
vpsetup.exe
wpsetup.exe
zulusetup.exe
Antares Auto-Tune bundle V9 CE.tmp
nchdata.dat
nchdata.dat
nchsetup.exe
nchsetup.exe
nchsetup.exe
nchsetup.exe
nchsetup.exe
nchdata.cab
nchsetup.cab
f9672547-ab76-44c3-ae6d-7d3a77aafb25.tmp
content_new.js
47d9b1ab-b209-40f8-b9fc-26245a3a0a88.tmp
messages.json
PS3%20HD%201080.dat
YouTube%20-%20Vertical%20Video%20%284%3A5%29.dat
YouTube%201440p%20%282K%29.dat
YouTube%202160p%20%284K%29.dat
YouTube%20720p.dat
Default.dat
YouTube%20-%20Vertical%20Video%20%289%3A16%29.dat
Animated%20GIF.dat
Facebook%20-%20Vertical%20Video%20%289%3A16%20-%201080%20x%201920%29.dat
Facebook%20-%20Vertical%20Video%20%289%3A16%20-%20720%20x%201280%29.dat
Facebook%201080p.dat
Facebook%20480p.dat
Facebook%20720p.dat
Internet%20Video.dat
PS3%20720.dat
SonyPS4Pro.dat
SonyPS5.dat
TV%20NTSC.dat
TV%20PAL.dat
Twitter%20MP4.dat
Vimeo%20MP4.dat
Widescreen%20TV.dat
YouTube%20-%20Vertical%20Video%20%281%3A2%29.dat
YouTube%20-%20Vertical%20Video%20%282%3A3%29.dat
YouTube%20480p.dat
AppleiPad5.dat
AppleiPadAir.dat
AppleiPodTouch2.dat
vlc-qt-interface.ini
MixPadMultitrackRecorder.exe
Audio Editing Software.lnk
Video Editing Software.lnk
NCH Suite.lnk
memory/2820-376-0x0000000000400000-0x0000000000683000-memory.dmp
memory/3120-363-0x00007FF601670000-0x00007FF601768000-memory.dmp
memory/3120-326-0x00007FFE46720000-0x00007FFE46731000-memory.dmp
memory/3120-348-0x00007FFE362E0000-0x00007FFE36305000-memory.dmp
memory/3120-347-0x00007FFE36310000-0x00007FFE3635F000-memory.dmp
memory/3120-354-0x00007FFE37860000-0x00007FFE37B16000-memory.dmp
memory/3120-352-0x0000018D40840000-0x0000018D420AF000-memory.dmp
memory/3120-353-0x00007FFE2C0F0000-0x00007FFE2C335000-memory.dmp
memory/3120-346-0x00007FFE36360000-0x00007FFE363F8000-memory.dmp
memory/3120-333-0x00007FFE36BF0000-0x00007FFE36CC2000-memory.dmp
memory/3120-344-0x00007FFE36610000-0x00007FFE36621000-memory.dmp
memory/3120-350-0x00007FFE36210000-0x00007FFE3622B000-memory.dmp
memory/3120-343-0x00007FFE36630000-0x00007FFE36641000-memory.dmp
memory/3120-342-0x00007FFE36650000-0x00007FFE3666A000-memory.dmp
memory/3120-341-0x00007FFE36670000-0x00007FFE3669D000-memory.dmp
memory/3120-340-0x00007FFE366A0000-0x00007FFE366C6000-memory.dmp
memory/3120-351-0x00007FFE361F0000-0x00007FFE36202000-memory.dmp
memory/3120-345-0x00007FFE36400000-0x00007FFE3660B000-memory.dmp
memory/3120-335-0x00007FFE36860000-0x00007FFE36948000-memory.dmp
memory/3120-334-0x00007FFE36950000-0x00007FFE36BE6000-memory.dmp
memory/3120-331-0x00007FFE36CF0000-0x00007FFE36D04000-memory.dmp
memory/3120-332-0x00007FFE36CD0000-0x00007FFE36CE1000-memory.dmp
memory/3120-323-0x00007FF601670000-0x00007FF601768000-memory.dmp
memory/3120-325-0x00007FFE37860000-0x00007FFE37B16000-memory.dmp
memory/3120-349-0x00007FFE36230000-0x00007FFE362DB000-memory.dmp
memory/3120-327-0x00007FFE45ED0000-0x00007FFE45EE9000-memory.dmp
memory/3120-339-0x00007FFE366D0000-0x00007FFE366E8000-memory.dmp
memory/3120-338-0x00007FFE366F0000-0x00007FFE3671F000-memory.dmp
memory/3120-337-0x00007FFE36720000-0x00007FFE36761000-memory.dmp
memory/3120-329-0x00007FFE370A0000-0x00007FFE370CB000-memory.dmp
memory/3120-328-0x00007FFE370D0000-0x00007FFE370F2000-memory.dmp
memory/3120-324-0x00007FFE46050000-0x00007FFE46084000-memory.dmp
memory/3120-336-0x00007FFE36770000-0x00007FFE36853000-memory.dmp
memory/3120-312-0x00007FFE37860000-0x00007FFE37B16000-memory.dmp
memory/3120-311-0x00007FFE37B0D000-0x00007FFE37B0F000-memory.dmp
memory/3120-330-0x00007FFE36D10000-0x00007FFE370A0000-memory.dmp
memory/3120-364-0x00007FFE46050000-0x00007FFE46084000-memory.dmp
memory/3120-366-0x00007FFE37860000-0x00007FFE37B16000-memory.dmp
memory/3352-377-0x0000000000400000-0x0000000000683000-memory.dmp
memory/3492-309-0x0000000000400000-0x0000000000683000-memory.dmp
memory/3492-308-0x0000000000400000-0x0000000000683000-memory.dmp
memory/3492-28-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/3492-27-0x0000000000400000-0x0000000000683000-memory.dmp
memory/3492-5-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/4104-310-0x0000000000400000-0x00000000004C8000-memory.dmp
memory/4104-26-0x0000000000400000-0x00000000004C8000-memory.dmp
memory/4104-0-0x0000000000400000-0x00000000004C8000-memory.dmp