fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23

Resubmissions

08/08/2026, 01:44

260808-b56seabb378

07/10/2023, 15:11

231007-sk1t4afg827

Analysis

user interaction
yes
max time kernel
600s
max time network
546s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Antares_Auto-Tune_bundle_V9.1.0_CE.exe
Size 110.0MB
Sample260808-b56seabb37
SHA256 fb83741f29e99b8af74f9e182c3f1eaebeb2f401a5c6886f1c045d406e282c23
MD5 cda53632778d1ced63a7c0809b71cb86
SHA1 f7d30963a0d45f35cc015f5c5e5ed58276b0e628
SHA512 8b6cd507fc76d75aa2d96d5546ef1d12f0c25c015bd195cee914d5501ec277b41801f1adb171ba67b164a3e7e68fd3d232ea9f7903cf11443f9a83db0be18b2e
SSDEEP 3145728:8aDfXHRtVR2oE76WDIJZZPlPZrbsAjHMZN1cy:86vHRtVRu7JsnN5ZfsAjsn1H
TLSH
T109483347A255AE3FC069A73556B3E41058FBB35AF84A9D2226F1C5ACDF221C04F3B871
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
484	4264	mixpad.exe
535	6120	mixpad.exe
536	6120	mixpad.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	nchsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	mixpad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	nchsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	mixpad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	zipsetup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

pid	Process
4740	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
5704	nchsetup.exe
2768	nchsetup.exe
6120	mixpad.exe
4876	mixpad.exe
2240	mixpad.exe
5488	mixpad.exe
4264	mixpad.exe
6248	zipsetup.exe
6412	nchsetup.exe
6816	7za32.exe
3320	expresszip.exe
4208	expresszip.exe
1680	dllbridgex64.exe
6952	vst3hostx64.exe
5124	vst3hostx64.exe
6524	vst3hostx64.exe
3236	vst3hostx64.exe
6904	vst3hostx64.exe
6852	vst3hostx64.exe
4376	vst3hostx64.exe
6552	vst3hostx64.exe
2900	vst3hostx64.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Wine\Fonts	vst3hostx64.exe

Loads dropped DLL 11 IoCs

pid	Process
4208	expresszip.exe
4208	expresszip.exe
4208	expresszip.exe
5124	vst3hostx64.exe
6524	vst3hostx64.exe
3236	vst3hostx64.exe
6904	vst3hostx64.exe
6852	vst3hostx64.exe
4376	vst3hostx64.exe
6552	vst3hostx64.exe
2900	vst3hostx64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MixPadInstall = "C:\\Users\\Admin\\Downloads\\MixPadMultitrackRecorder_9T5FK.exe"	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MixPadRunOnStartup = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -runonstartup"	mixpad.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Antares\desktop.ini	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NCH Software\ExpressZip\unzip32.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\infozip3\unzip32.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\zipcloak2\1870__wt	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\unlha32\unlha32.dll	nchsetup.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune_AAX.aaxplugin	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\Contents\Resources\is-51ET8.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Access\is-5JMK4.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-1HH77.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\7za32.exe	nchsetup.exe
File opened for modification	C:\Program Files\Common Files\VST3\Antares\PlugIn.ico	mixpad.exe
File created	C:\Program Files (x86)\NCH Software\Components\dllbridgex64\dllbridgex64.exe	dllbridgex64.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\is-9EFT4.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\is-MTHQE.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-ABS2H.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\Components\7za32\7zxa.dll	7za32.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune EFX.aaxplugin	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune EFX.aaxplugin\Contents\x64\is-9MB5Q.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune EFX\is-8AFHG.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\zlib1.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\7za32\7za.dll	7za32.exe
File created	C:\Program Files\Common Files\VST3\Antares\is-GHT39.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\x64\is-G73CD.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\zipcloak2.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe	vst3hostx64.exe
File opened for modification	C:\Program Files\Common Files\VST3\Antares	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Antares\desktop.ini	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\unrar.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\ExpressZip\7z.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\infozip3\1870__wt	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\zipcloak2\zipcloak2.exe	nchsetup.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\is-KVITF.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\is-3EVRB.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\VST3\Antares\is-F2NFM.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Pro\is-FH3R2.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\unlha32.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\arj\1870__wt	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\ExpressZip\expresszipsetup_v11.28.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\dllbridgex64\__wt	dllbridgex64.exe
File created	C:\Program Files (x86)\NCH Software\MixPad\mixpadsetup_v14.20.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\par2\1870__wt	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\MixPad\shellmenub.msix	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\MixPad\mixpadsetup_v14.20.exe\:Zone.Identifier:$DATA	nchsetup.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune_AAX.aaxplugin\is-IIKRC.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Access.aaxplugin\is-BMK6C.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File opened for modification	C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\vst3hostx64\__wt	vst3hostx64.exe
File opened for modification	C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe	nchsetup.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune_AAX.aaxplugin\is-KVM50.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\shellmenu.dll	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\ExpressZip\par2.exe	nchsetup.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Antares Audio Technologies\Auto-Tune Artist\is-9I8SQ.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\shellmenua.msix	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\arj\arj.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\MixPad\shellmenua.msix	nchsetup.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\is-85QTQ.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\VST3\Antares\is-S4AA2.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\VST3\Antares\is-1COK0.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files (x86)\NCH Software\ExpressZip\7za.exe	nchsetup.exe
File created	C:\Program Files (x86)\NCH Software\Components\7za32\7Za32.exe	7za32.exe
File created	C:\Program Files (x86)\NCH Software\Components\unlha32\1870__wt	nchsetup.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Artist.aaxplugin\Contents\x64\is-MBLRN.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Access.aaxplugin\is-MBE30.tmp	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expresszip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vst3hostx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares_Auto-Tune_bundle_V9.1.0_CE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllbridgex64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MixPadMultitrackRecorder_9T5FK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zipsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expresszip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MixPadMultitrackRecorder_9T5FK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1216	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3880-1-0x0000000000400000-0x00000000004C8000-memory.dmp	innosetup
behavioral1/memory/3880-7-0x0000000000400000-0x00000000004C8000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306272691651717"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.MixPad.dss	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.MixPad.sd2\shell\open\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.nut\Shell\NCHconvertvideo	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.htm\Shell\NCHconvertdoc\command	nchsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mixpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\Mix with MixPad Multitrack Recording Software\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rec\Shell\Mix with MixPad Multitrack Recording Software	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.MixPad.midi	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.vox\Shell\NCHeditsound\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.bethsoftvid\Shell\NCHconvertvideo	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppm\Shell\NCHconvertimage\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind Pixillion \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.heif\Shell\NCHeditphoto\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind PhotoPad \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.ExpressZip.deb\Shell\open	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.MixPad.aifc\ = "AIFC Audio File (VLC)"	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.smf	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ts\Shell\NCHeditvideo\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind VideoPad \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.webp\Shell	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ts\Shell\NCHconvertvideo\command\ = "\"C:\\Program Files (x86)\\NCH Software\\ExpressZip\\expresszip.exe\" -extfind Prism \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.aac\Shell\NCHeditsound\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind WavePad \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dtshd\Shell\NCHconvertvideo\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind Prism \"%L\""	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\shellex\ContextMenuHandlers\ExpressZip\ = "{8EEA165E-0B8B-4BA7-9796-50214C767171}"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	nchsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mixpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpg\Shell\Mix with MixPad Multitrack Recording Software\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.vox\Shell\NCHconvertsound\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dng\Shell\NCHconvertimage\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.ExpressZip.arj\DefaultIcon	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mp1\Shell\Mix with MixPad Multitrack Recording Software\command	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.msv\Shell\Mix with MixPad Multitrack Recording Software\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.MixPad.m4b\shell	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\mxgfile	nchsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	mixpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.ExpressZip.apk\ = "APK Archive File"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cda\Shell\Mix with MixPad Multitrack Recording Software	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wv\shell\Mix with MixPad Multitrack Recording Software\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.mp4\Shell\NCHconvertvideo\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.ExpressZip.txz\Shell\TXZ File	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NCH.MixPad.oga	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jps\Shell\NCHconvertimage	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bkz\shellex	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.ExpressZip.pkpass\Shell\open	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mp3\Shell\NCHconvertsound\ = "Convert sound file format with Switch"	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.wav\Shell\NCHconvertsound\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" -extfind Switch \"%L\""	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.m2ts\Shell\NCHeditvideo\command	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\mvifile	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.pcx\Shell\NCHeditphoto	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CABFolder	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.ogv\Shell\NCHeditvideo	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aif\shell\Mix with MixPad Multitrack Recording Software\command\ = "\"C:\\Program Files (x86)\\NCH Software\\MixPad\\mixpad.exe\" \"%L\""	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.jvg	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\tgafile	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	mixpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\shellex\ContextMenuHandlers	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.cda\Shell\Mix with MixPad Multitrack Recording Software\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpga\Shell\NCHconvertsound	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lvf\Shell\NCHconvertvideo\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mpegtsraw\Shell\NCHconvertvideo\command	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ras	nchsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.wav\Shell\NCHconvertsound	nchsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCH.MixPad.aac\shell\ = "Open"	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.aif\Shell\NCHeditsound	nchsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.rss\Shell\NCHconvertsound	nchsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.wlmp	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\rawvideofile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\shell32.dll,19"	nchsetup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NCH Software\MixPad\mixpadsetup_v14.20.exe\:Zone.Identifier:$DATA	nchsetup.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5704	nchsetup.exe
5704	nchsetup.exe
5704	nchsetup.exe
5704	nchsetup.exe
4740	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
4740	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
6412	nchsetup.exe
6412	nchsetup.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
5124	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6524	vst3hostx64.exe
6852	vst3hostx64.exe
6852	vst3hostx64.exe
4376	vst3hostx64.exe
4376	vst3hostx64.exe
6552	vst3hostx64.exe
6552	vst3hostx64.exe
6552	vst3hostx64.exe
6552	vst3hostx64.exe
2900	vst3hostx64.exe
2900	vst3hostx64.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6120	mixpad.exe
4208	expresszip.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe
Token: SeDebugPrivilege	5704	nchsetup.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
6120	mixpad.exe
4740	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
4264	mixpad.exe
6120	mixpad.exe
6120	mixpad.exe
6120	mixpad.exe
6120	mixpad.exe
6120	mixpad.exe
6552	vst3hostx64.exe
6120	mixpad.exe
6120	mixpad.exe
6120	mixpad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6120	mixpad.exe
6120	mixpad.exe
6552	vst3hostx64.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4740	3880	Antares_Auto-Tune_bundle_V9.1.0_CE.exe	96
PID 2516 wrote to memory of 5704	2516	MixPadMultitrackRecorder_9T5FK.exe	124
PID 5200 wrote to memory of 2768	5200	MixPadMultitrackRecorder_9T5FK.exe	127
PID 5704 wrote to memory of 6120	5704	nchsetup.exe	131
PID 5704 wrote to memory of 4876	5704	nchsetup.exe	132
PID 4740 wrote to memory of 5772	4740	Antares_Auto-Tune_bundle_V9.1.0_CE.tmp	139
PID 5772 wrote to memory of 5760	5772	msedge.exe	140
PID 5772 wrote to memory of 1216	5772	msedge.exe	141
PID 5772 wrote to memory of 1884	5772	msedge.exe	142
PID 5772 wrote to memory of 3500	5772	msedge.exe	143
PID 5772 wrote to memory of 1884	5772	msedge.exe	142
PID 5772 wrote to memory of 1884	5772	msedge.exe	142
PID 5772 wrote to memory of 3500	5772	msedge.exe	143
PID 5772 wrote to memory of 5088	5772	msedge.exe	144
PID 5772 wrote to memory of 5088	5772	msedge.exe	144
PID 5772 wrote to memory of 5088	5772	msedge.exe	144
PID 5772 wrote to memory of 5944	5772	msedge.exe	145
PID 5772 wrote to memory of 5944	5772	msedge.exe	145
PID 5772 wrote to memory of 5944	5772	msedge.exe	145
PID 5772 wrote to memory of 3180	5772	msedge.exe	146
PID 5772 wrote to memory of 5788	5772	msedge.exe	147
PID 5772 wrote to memory of 3180	5772	msedge.exe	146
PID 5772 wrote to memory of 3180	5772	msedge.exe	146
PID 5772 wrote to memory of 5788	5772	msedge.exe	147
PID 5772 wrote to memory of 5788	5772	msedge.exe	147
PID 5772 wrote to memory of 6256	5772	msedge.exe	150
PID 5772 wrote to memory of 6256	5772	msedge.exe	150
PID 5772 wrote to memory of 6256	5772	msedge.exe	150
PID 5772 wrote to memory of 6328	5772	msedge.exe	151
PID 5772 wrote to memory of 6328	5772	msedge.exe	151
PID 5772 wrote to memory of 6580	5772	msedge.exe	154
PID 5772 wrote to memory of 6580	5772	msedge.exe	154
PID 5772 wrote to memory of 6664	5772	msedge.exe	156
PID 5772 wrote to memory of 6664	5772	msedge.exe	156
PID 5772 wrote to memory of 6664	5772	msedge.exe	156
PID 5772 wrote to memory of 6680	5772	msedge.exe	157
PID 5772 wrote to memory of 6680	5772	msedge.exe	157
PID 5772 wrote to memory of 6688	5772	msedge.exe	158
PID 5772 wrote to memory of 6688	5772	msedge.exe	158
PID 5772 wrote to memory of 7088	5772	msedge.exe	161
PID 5772 wrote to memory of 5184	5772	msedge.exe	162
PID 5772 wrote to memory of 5184	5772	msedge.exe	162
PID 5772 wrote to memory of 6904	5772	msedge.exe	163
PID 5772 wrote to memory of 6904	5772	msedge.exe	163
PID 5772 wrote to memory of 7020	5772	msedge.exe	164
PID 5772 wrote to memory of 7020	5772	msedge.exe	164
PID 5772 wrote to memory of 6616	5772	msedge.exe	165
PID 5772 wrote to memory of 6616	5772	msedge.exe	165
PID 5772 wrote to memory of 6848	5772	msedge.exe	166
PID 5772 wrote to memory of 6848	5772	msedge.exe	166
PID 4264 wrote to memory of 6248	4264	mixpad.exe	171
PID 6248 wrote to memory of 6412	6248	zipsetup.exe	172
PID 6412 wrote to memory of 6816	6412	nchsetup.exe	173
PID 6120 wrote to memory of 1680	6120	mixpad.exe	185
PID 6120 wrote to memory of 6952	6120	mixpad.exe	186
PID 6120 wrote to memory of 5124	6120	mixpad.exe	187
PID 6120 wrote to memory of 6524	6120	mixpad.exe	188
PID 6120 wrote to memory of 3236	6120	mixpad.exe	189
PID 6120 wrote to memory of 6904	6120	mixpad.exe	190
PID 6120 wrote to memory of 6852	6120	mixpad.exe	191
PID 6120 wrote to memory of 4376	6120	mixpad.exe	192
PID 6120 wrote to memory of 6552	6120	mixpad.exe	196
PID 6120 wrote to memory of 2900	6120	mixpad.exe	197

C:\Users\Admin\AppData\Local\Temp\Antares_Auto-Tune_bundle_V9.1.0_CE.exe
"C:\Users\Admin\AppData\Local\Temp\Antares_Auto-Tune_bundle_V9.1.0_CE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\is-K1GDP.tmp\Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K1GDP.tmp\Antares_Auto-Tune_bundle_V9.1.0_CE.tmp" /SL5="$B0246,114584709,763392,C:\Users\Admin\AppData\Local\Temp\Antares_Auto-Tune_bundle_V9.1.0_CE.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://codec.kiev.ua/releases.html
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x350,0x7fff9407c188,0x7fff9407c194,0x7fff9407c1a0
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16982185670788373031,11168632975941056638,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:3
      4⤵
      System Time Discovery
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16961193446232602208,13460035426553218824,262144 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,13358697364747448067,2328573599548043806,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2935761213915133413,11872196547035676649,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,10950811924735617409,1692948736878960843,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6209179619698223929,10478553766820389528,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,15319190642360346249,5590543350179036779,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,10408873484058111154,634518859307190809,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17732494849252995508,8843689604858440855,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6332592582487733210,5269208274645990606,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5584,i,1244760174370990544,5470963912482484173,2097152 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17521327235827815769,247508352940543867,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,16778866151353190468,12016907946266021615,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2819473714702987273,12039066911157564135,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:7076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2819473714702987273,12039066911157564135,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2391902117804642819,9179700558723131001,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2993680456839028946,5610957804748912220,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
      4⤵
      PID:6904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13940806729236679265,16538000094390518740,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      PID:7020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11515852125072380024,11113618016239415549,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:6616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,8615444043056904171,17531266708748468317,524288 --field-trial-handle=2636,i,4843413433947652724,9008940376243351899,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
      4⤵
      PID:6848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4172 -prefsLen 34775 -prefMapHandle 4176 -prefMapSize 270331 -jsInitHandle 4180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4156 -initialChannelId {797696f0-3279-4a21-bf26-cd98b83e0989} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
1⤵
- Checks processor information in registry
PID:3964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4596 -prefsLen 35012 -prefMapHandle 4600 -prefMapSize 270331 -ipcHandle 4608 -initialChannelId {e5113df8-1258-410a-bd85-d3e29515b598} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
1⤵
- Checks processor information in registry
PID:2400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 32900 -prefMapHandle 4588 -prefMapSize 270331 -jsInitHandle 4848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4840 -initialChannelId {3062af15-8e79-431b-a91e-a88ad9cd6029} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
1⤵
- Checks processor information in registry
PID:2340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32952 -prefMapHandle 5104 -prefMapSize 270331 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4340 -initialChannelId {8d7dec79-f515-4af1-9c59-81533524e23b} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
1⤵
- Checks processor information in registry
PID:2476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270331 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {2c2c8e32-86b6-47a6-851f-f9d752dbdf27} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
1⤵
- Checks processor information in registry
PID:1452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4380 -prefsLen 33071 -prefMapHandle 4384 -prefMapSize 270331 -jsInitHandle 2480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5928 -initialChannelId {2d5aaab7-2c8d-4d54-97d5-6a3880ca448b} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
1⤵
- Checks processor information in registry
PID:4100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2556 -prefsLen 33071 -prefMapHandle 6404 -prefMapSize 270331 -jsInitHandle 6352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6412 -initialChannelId {13a9addc-6ac6-47f7-aa9a-04a208456f6b} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
1⤵
- Checks processor information in registry
PID:2764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 33071 -prefMapHandle 5256 -prefMapSize 270331 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {96172479-736d-4aea-bedc-2fee3b6e08bd} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
1⤵
- Checks processor information in registry
PID:3280

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6856 -prefsLen 33367 -prefMapHandle 6860 -prefMapSize 270331 -jsInitHandle 6864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6872 -initialChannelId {603235a9-f68a-4d6f-9fce-e4d46808d2b2} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
1⤵
- Checks processor information in registry
PID:3708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 36709 -prefMapHandle 7152 -prefMapSize 270331 -jsInitHandle 7148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6832 -initialChannelId {4f93261e-6ac8-4514-b51b-57485fc3b7b4} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
1⤵
- Checks processor information in registry
PID:5504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 36749 -prefMapHandle 7092 -prefMapSize 270331 -jsInitHandle 7512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7516 -initialChannelId {35a9adbc-e2b0-4a2b-b710-fcb0c660af4d} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
1⤵
- Checks processor information in registry
PID:5804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7716 -prefsLen 36749 -prefMapHandle 7724 -prefMapSize 270331 -jsInitHandle 7728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7092 -initialChannelId {977d5b1d-ff68-4ef9-8e58-2e2a143ee064} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
1⤵
- Checks processor information in registry
PID:6012

C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe
"C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe
    "C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\MixPad-3148-1\dllbridgex64.exe
      "C:\Users\Admin\AppData\Local\Temp\MixPad-3148-1\dllbridgex64.exe" -LQUIET -instby coMixPad -instsvar VhunXOBfDrkjCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveonMIXPADExplorerbaroffMIXPADIsovocalonT7gtMIXPADEnabletracklevelduckingv3onT7vhFWCcJ3ixZpghFMspP0peL1jjOb9bQnaqBtsgVdbxAbhjMIXPADSofttbsoffWTvjMIXPADMixerhometbbtnoffMIXPADSearchbarv2offMIXPADCrescendopromoteonMIXPADMultitrackselectonRmrwN3cnNg6eDpeeITrjG41iPbokHv8lMIXPADPlaypausebtnv2offGnbbMIXPADGhostlinesv2offMIXPADMidichannelrenamev2onMMBhLbdjXl9uR0ciY5ssAFWeEb2nUyzmE42hYmfgSwfjNMTbWZUlBNagIc3nJmxxMIXPADClipvolumedlgv2offSNBrRp0nBOFi -instrefdata refdate%3D1786178810%26referrer%3Dhttps%253A%252F%252Fwww.google.com%252F%26ref%3D%26ref2%3D%26ref3%3D%26kw%3Dmixpad%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder_9T5FK%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3D%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.On%252CMixPad.ChangeIntroBulletsToIntroFeats.Off%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.Off%252CM.Bold.MixPad.BoldDotPointTxt.VSTpluginsupport.On%252CMixPad.RoundedButtons.On%252CMixPad.RoundedButtons10px.Off%252CMixPad.IntroBulletBoldTxtDldLnk.On%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.Off%252CMixPad.TopDivAnnivMessage2.Off
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\MixPad-3148-2\vst3hostx64.exe
      "C:\Users\Admin\AppData\Local\Temp\MixPad-3148-2\vst3hostx64.exe" -LQUIET -instby coMixPad -instsvar VhunXOBfDrkjCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveonMIXPADExplorerbaroffMIXPADIsovocalonT7gtMIXPADEnabletracklevelduckingv3onT7vhFWCcJ3ixZpghFMspP0peL1jjOb9bQnaqBtsgVdbxAbhjMIXPADSofttbsoffWTvjMIXPADMixerhometbbtnoffMIXPADSearchbarv2offMIXPADCrescendopromoteonMIXPADMultitrackselectonRmrwN3cnNg6eDpeeITrjG41iPbokHv8lMIXPADPlaypausebtnv2offGnbbMIXPADGhostlinesv2offMIXPADMidichannelrenamev2onMMBhLbdjXl9uR0ciY5ssAFWeEb2nUyzmE42hYmfgSwfjNMTbWZUlBNagIc3nJmxxMIXPADClipvolumedlgv2offSNBrRp0nBOFi -instrefdata refdate%3D1786178810%26referrer%3Dhttps%253A%252F%252Fwww.google.com%252F%26ref%3D%26ref2%3D%26ref3%3D%26kw%3Dmixpad%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder_9T5FK%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3D%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.On%252CMixPad.ChangeIntroBulletsToIntroFeats.Off%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.Off%252CM.Bold.MixPad.BoldDotPointTxt.VSTpluginsupport.On%252CMixPad.RoundedButtons.On%252CMixPad.RoundedButtons10px.Off%252CMixPad.IntroBulletBoldTxtDldLnk.On%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.Off%252CMixPad.TopDivAnnivMessage2.Off
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:6952
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 1 "C:\Program Files\Common Files\VST3\Antares\Auto-Key.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 2 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune Access.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6524
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 3 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune Artist.vst3"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3236
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 4 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune EFX.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      PID:6904
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 5 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6852
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --getio 6 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4376
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --openeditor "C:\Program Files\Common Files\VST3\Antares\Auto-Tune.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6552
  - - C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe
      "C:\Program Files (x86)\NCH Software\Components\vst3hostx64\vst3hostx64.exe" --process 6 44100 "C:\Program Files\Common Files\VST3\Antares\Auto-Tune.vst3"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2900
- - C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe
    "C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -installsched
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4876

C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe
C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\Downloads\MixPadMultitrackRecorder_9T5FK.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x50c
1⤵
PID:2116

C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe
"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -runonstartup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240

C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe
"C:\Program Files (x86)\NCH Software\MixPad\MixPad.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:540

C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe
"C:\Program Files (x86)\NCH Software\MixPad\mixpad.exe" -extfind ExpressZip "C:\Users\Admin\Downloads\AUTOTUNE PRO Versión 9.1.rar"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\MixPad-2652-1\zipsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\MixPad-2652-1\zipsetup.exe" -LQUIET -instby ieMixPad -instsvar VhunXOBfDrkjCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveonMIXPADExplorerbaroffMIXPADIsovocalonT7gtMIXPADEnabletracklevelduckingv3onT7vhFWCcJ3ixZpghFMspP0peL1jjOb9bQnaqBtsgVdbxAbhjMIXPADSofttbsoffWTvjMIXPADMixerhometbbtnoffMIXPADSearchbarv2offMIXPADCrescendopromoteonMIXPADMultitrackselectonRmrwN3cnNg6eDpeeITrjG41iPbokHv8lMIXPADPlaypausebtnv2offGnbbMIXPADGhostlinesv2offMIXPADMidichannelrenamev2onMMBhLbdjXl9uR0ciY5ssAFWeEb2nUyzmE42hYmfgSwfjNMTbWZUl -instrefdata refdate%3D1786178810%26referrer%3Dhttps%253A%252F%252Fwww.google.com%252F%26ref%3D%26ref2%3D%26ref3%3D%26kw%3Dmixpad%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder_9T5FK%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3D%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.On%252CMixPad.ChangeIntroBulletsToIntroFeats.Off%252CMixPad.WideScreenIncreaseFontSize.On%252CMixPad.DldBtnArrowIcon.Off%252CMixPad.WMLargerIntroSentence.Off%252CMixPad.WMChangeNavLinkPurchaseToPricing.On%252CM.MixPad.ReplaceIntroSentence.Easyandisoftware.Off%252CM.Bold.MixPad.BoldDotPointTxt.VSTpluginsupport.On%252CMixPad.RoundedButtons.On%252CMixPad.RoundedButtons10px.Off%252CMixPad.IntroBulletBoldTxtDldLnk.On%252CMixPad.BodyContentH3SameStyle2.Off%252CMixPad.LargerBigHdrButtons.Off%252CMixPad.BigHdrKeyFeatNoBckgrndClr.On%252CMixPad.IntroParaTextWrapBalance.On%252CMixPad.FeatListDldBtn2.On%252CMixPad.ChangeDldLineTxtColor.Off%252CMixPad.TopDivAnnivMessage2.Off
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6248
- - C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-2652-1\zipsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat" -instby ieMixPad -instsvar VhunXOBfDrkjCC3jLLIBControloffInhxMIXPADDrageptaddfadeonMIXPADCurvetypeimproveonMIXPADExplorerbaroffMIXPADIsovocalonT7gtMIXPADEnabletracklevelduckingv3onT7vhFWCcJ3ixZpghFMspP0peL1jjOb9bQnaqBtsgVdbxAbhjMIXPADSofttbsoffWTvjMIXPADMixerhometbbtnoffMIXPADSearchbarv2offMIXPADCrescendopromoteonMIXPADMultitrackselectonRmrwN3cnNg6eDpeeITrjG41iPbokHv8lMIXPADPlaypausebtnv2offGnbbMIXPADGhostlinesv2offMIXPADMidichannelrenamev2onMMBhLbdjXl9uR0ciY5ssAFWeEb2nUyzmE42hYmfgSwfjNMTbWZUl -instrefdata refdate%3D1786178810%26referrer%3Dhttps%253A%252F%252Fwww.google.com%252F%26ref%3D%26ref2%3D%26ref3%3D%26kw%3Dmixpad%26theme%3D%26pageconfig%3D%26download%3DMixPadMultitrackRecorder_9T5FK%26clientid%3D%26platform%3DWin%26language%3DEN%26browser%3D%26screenwidth%3D0%26screenheight%3D0%26cpucores%3D0%26webvar%3DAll.DescriptiveInstallerNameAddRnd.On%252CMixPad.ChangeIntroBulle
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6412
  - - C:\Program Files (x86)\NCH Software\ExpressZip\7za32.exe
      "C:\Program Files (x86)\NCH Software\ExpressZip\7za32.exe" -LQUIET -instby fiExpressZip
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:6816
  - - C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe
      "C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe" -installsched
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3320

C:\Program Files (x86)\NCH Software\ExpressZip\expresszip.exe
"C:\Program Files (x86)\NCH Software\ExpressZip\ExpressZip.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6368 -prefsLen 36805 -prefMapHandle 5148 -prefMapSize 270331 -jsInitHandle 6700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2684 -initialChannelId {0c27b6b6-3ead-413c-b1ed-7be9e35f52a6} -parentPid 2496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2496" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
1⤵
- Checks processor information in registry
PID:2432

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7za32.exe

Path C:\Program Files (x86)\NCH Software\ExpressZip\7za32.exe
Size 615KB
SHA256 3c01370b6eb1f2cabac6e2afe6c9a0141544b554a3a2c146489f1111c41e39d9
MD5 81d94f5c09ba974ce676909fe5811817
SHA1 914b9cef5a6cea203b20658ebe6a9f696a337b82
SHA512 1c9e1cb31b4cbfd07d345bddaccfa6f56abb90f18bcce5583d287daa078cb73544293557e73f946355535ebb4de57b4207eee2a3e7dab8414d76c9dcd95afb45
SSDEEP 12288:+qXow95IWJLqGqcQFZjYKrdvYNeMXuyI0tK6oqVIsrtnPBXL:+iamLqRbEKrdwQMXuaU6lIsZnJXL
TLSH
T15CD4238889570296FEA55EF1829093C6EFBC5967B3D7A43FEF2585061F6031700E09FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arj.exe

Path C:\Program Files (x86)\NCH Software\ExpressZip\arj.exe
Size 264KB
SHA256 00ac8169236b8f9910c661e6d8b82c2f2e5800338a9c7775d691e622f3521ac9
MD5 014b712a9b591a14c84e7fa1dd199554
SHA1 857df15d9e55e018cc5b81c40ff4c1c649f3f01d
SHA512 f852e54a6725d5fd8d44ac07bd3ecf2519d707506beeda4d64fee2cbef0e280d0de30c4d27526539213454de272960d963d2f462c320d8d9b268865465284dab
SSDEEP 3072:HbY6WwI+F+3qDf/LDrzG7jn/AIn11i4CBzF7GGJIypgOzOhGX2fmzzVqqZJyx3aZ:G36DXBzF7WMTxzZ2xg+x9iWJ8
TLSH
T17E4429392490D13FD0A105F5A8488BFAED74EB640E4768F387E43EE1BB61466C22795F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

par2.exe

Path C:\Program Files (x86)\NCH Software\ExpressZip\par2.exe
Size 296KB
SHA256 521900b12c8734a6a56eba855c663cf49cb9b2b352c755c0cd747cbd6f18ee8f
MD5 bafe41bcaed61df51b17f390ae1cdfe1
SHA1 c6e502cddaf9031b7fa703a289be11121b01f003
SHA512 256338f880b5ea8f33a3b4a5b4db5341ec30c37a6c857a342bced7cc37400e51ca1678de6aec888af28f450fde90ca6381b7d8768b0162db1304689b5eddeeea
SSDEEP 6144:Q8iDMM6qahwh48fN4FCkNHXsavpx11QLcLC8JQhqZ/tiyeWboC5eNgGs:Q8iDMM6qahw5fN4FCkNHXsu1WLcLC8Jo
TLSH
T14354BF23F7D2C0B1E98315B51E99573966B5EA9809314FC3B3C8DA1CEB126F29637309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlha32.dll

Path C:\Program Files (x86)\NCH Software\ExpressZip\unlha32.dll
Size 371KB
SHA256 126f81c57d54c1ca6bbcdd524c647af635cdb408401a5bc21216b4a0a792dc5c
MD5 ae041e680ae569a4860e600188fa0adf
SHA1 fc86cff5f51df5cc08b9849100e56eee9738d0d3
SHA512 b2ab7e985f0de3dedaeccfac23d43c0b1910cba5401de19be94cf8cb3c7287c6f9a315776819c5a2c8c4c986a2de70ff568e0892cc7a277fcb37a0cb8b55e2b9
SSDEEP 6144:aiHwJpDyjXpqYeMwzSFMib+nxQfsZtwfm7TFxhoRB8nPY2n:rw7YX0YHVjshjhbDn
TLSH
T16C84D0126AC55177F8FF5B782573373DA67EBD22E630C60B4B94AA4D2430A05DB29332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unzip32.dll

Path C:\Program Files (x86)\NCH Software\ExpressZip\unzip32.dll
Size 308KB
SHA256 59b4d9afd66d8e33c7ba2e4b8617030f364ee905410610f8c96209df62a3a734
MD5 d636e5b90daa1596718081ede840d03f
SHA1 e5f54ee365a63ff0980f781bbc30547ed54eb12c
SHA512 35ee29b25c50ef2aae22fb53077234ca5f2c8c145f95cfa03fb226b736d8f26ff1dbaed3586e93d9ac82b4aa90c64aeea3c25a3930ace993cfa9447cd501c68d
SSDEEP 6144:MlfLFL8l8f6E+E70DVgQfcnaMBNw7RnKjaKvU4040Cr/GcKaiz:MlfLFL8l8fx7aVgQ/MBNwKbEDcGJnz
TLSH
T1C264AE012882A072E182417C66259732DBF976AA37EB25C7FBCC0AD41F013D6877A6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip32z64.dll

Path C:\Program Files (x86)\NCH Software\ExpressZip\zip32z64.dll
Size 284KB
SHA256 8e40c7805f57da244a20ee289ca2c018b4f3fbb9047fb06fa2fed954da237b67
MD5 ce5fb67da5c10a00cf502728c63b76e5
SHA1 97e927e8a670443be87bcde1989fd2d60d705434
SHA512 c678c0e960c8473c9712239ea31d5224baf7a0f7ed05bbe69d422c045f29b5d0b664a3811a5d11ab4b0b9d0b06ad51bbb03707cd21ec36859a4bec7b4f2cb41a
SSDEEP 3072:kHjbOZulsZmQo49DPyFdi9G//vgOUjNMEJKuKHhOskNZ4ivykhPZUZ7Xx1KcDPM0:zXZ8ybyvXcMI5ikT4iF05x1pIwEQrr
TLSH
T1D1548D113481C032F09A01FC131597768EBEB8A2BBAB95D7EBC00D955E124E7CB7679E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zipcloak2.exe

Path C:\Program Files (x86)\NCH Software\ExpressZip\zipcloak2.exe
Size 152KB
SHA256 39edcf477e1463ac9de52ffe4006128546cbf12a19d91b8aaf856f3c19d49aa2
MD5 aa7a48540eb79ba2280f81da93c1599f
SHA1 e8856c21151b91d6a270964d5541fc09f2f05283
SHA512 06ab843d9e8e017b1389282d5d2b005f52f5bb5a815db6f63238258888b03202adc72c415e0f682f53f00940f8acb093129254f69b638f897bd015e9c876844a
SSDEEP 3072:/bJ/rsJaoRK3ahrHrxFDMtBbr2dqfmB1tcCC:/bJ/XoHPctBbrdr
TLSH
T115E38D1A3C82D073E08701B5466087F59B7FB8A33B6610D7FB864B697B130E9467B5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-8DE8J.tmp

Path C:\Program Files\Common Files\VST3\Antares\is-8DE8J.tmp
Size 45KB
SHA256 00999004190475604537034d99d9a2cc84355579e4b199045dc6c8c3479e3600
MD5 6e03b680fbee54e69e52a15245989862
SHA1 0136100d693fa2cf4eba38ac0314951b7be22c9b
SHA512 1a2e8770e676bfe9c84f81185584fdf347271897637f18ccbcb1f1dfb7f4afac4cf65ab0d19d7f34044b5f5b304d7b54c9c85c8049fee0a4a3e4cabe3ae7c578
SSDEEP 768:bGZFQoWsxV75P4tkACEv3O7fF9mS0ZPdLwDiQ2lKS:OFQobL5P4tkAZv3wNQFdLw2QCKS
TLSH
T1E123ADD2A4491483E3AE1173C78571FE9CB4F8674273B5A6FB026DF80A6A736D709205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-GHT39.tmp

Path C:\Program Files\Common Files\VST3\Antares\is-GHT39.tmp
Size 126B
SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
MD5 798095cd31340606c8e81d0a5107d57e
SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
TLSH
T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
MD5 SHA1 SHA512 TLSH

Submit Download

Audio Editing Software.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Audio Editing Software.lnk
Size 1KB
SHA256 66a467d15893fd2bfbe4309da0d380dd8293e42608906a9269213c9a98b40c42
MD5 3039e31f17c2ac84cafecc8e123c7678
SHA1 e76b3d9f5187c98459f09e2d901218c712924797
SHA512 32e9583896b4e843e6727ff9d85a0ff02db4668390a1b84640e36f724162d661718cf47efb7cab60910ea993984032ba22d20ebcd828163a83349d3ad8569831
TLSH
T12D21E1201BD73B29F2F3CA329861621656277D41EAA88E4E018242544DE3505D879F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Audio File Converter.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Audio File Converter.lnk
Size 1KB
SHA256 365aa4a082d3d9608e02c3745926fb2891df0110c7def83c7ca4659fa35a5a95
MD5 b0110a7eab8a2985e15496311d3e7efd
SHA1 fda3c4116c355c8ff2013501b7dc5ddee689d20e
SHA512 997dc8734b0383158cf99912e9ba0832a46e8d9c64154472e3ea5696ba3dae8fa815ece2887f8b11bc28bb125f0a9ab331198b094410e4beb460bba492eb7968
TLSH
T1322100201BD73B29F2F2CA729875632757277D41FEA88F4E0182426448E3905D979F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Video Capture Software.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk
Size 1KB
SHA256 cf08b2fc401478ba23e26c1b5aa70fa0dfe442c2f5c820a7ee6edb4b6627dc82
MD5 4a32ac001400d710f3d3d4e58fb8edbe
SHA1 c90ff483e7aa0efb6ab5cfa182c38b5c2b96b443
SHA512 74630bdb2ae7a87b6531ad1d298ab01ebf84b2e1fbb72be3bf3f66c966410bd886d6d651aa78673afd16601c17eedb2eb67b63ca38247057ed6db45d9444ce9e
TLSH
T1162103201FD73B19F2F2CA729871A31766377D41F9A88F4D0142426408E7505D878F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Video Editing Software.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Editing Software.lnk
Size 1KB
SHA256 6543a10388f0bc1273487a6fcdb9f907987c9c09d90cdbd6ee8dafe55feaaf7d
MD5 1c0ba45980498130dcc668c72d84ccd9
SHA1 be6b6f195df0100e30778a62a478edaca7f5c1ba
SHA512 8816480c0ba90b82ad7ae95fad7418ed55dae2e5c11108adaf32d140cbd85e02c6df7e7498d2a1c10f0252dd340e8b3716dc8865bf4b11a16343226f71bccaa4
TLSH
T17C21E1241FD73B29F2F3CA729871632652377D41EAA88E4D014242540CE3505D879F6A
MD5 SHA1 SHA512 TLSH

Submit Download

AM Radio.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\AM Radio.ecf
Size 427B
SHA256 b98651a71fa9e5412199f7df29c41bd350be97e5b2d57f4076da3d6c8d662f6c
MD5 e4306615ba7865823ad5e03b60ac9a4b
SHA1 c59b2be4c66afec1dea836e888e46548b07b7d48
SHA512 3fb6316ed074c992894ad112d50da51cff00720fbadb4bc2a6e4376a48c0c00754ae4da7fd499d1a7c096cea8e9b479ca2aab8f760bddcaf5ccf62062b2b2bcd
TLSH
T1FFE0C932E7109431C43807362CE78F219FF4C49A1F476B0378052A31BCC3B8A4C70A19
MD5 SHA1 SHA512 TLSH

Submit Download

Alien.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Alien.ecf
Size 283B
SHA256 495cec973bbb5b01ac4bfe2018c6ec096eddc932b447797965842c5cbb7a977c
MD5 22d79730e80268a133d3d7fca2856f57
SHA1 d867981fd75347c8680ce625ae67678caf0fe451
SHA512 21edb942f5f155335c792fad2e335d60a57aa4e22f970de4e18500f272f7a2be3dcdf2dc798ff9650f34693afb5e822575f179bd1399d91e9e3279a7e1c5bad4
TLSH
T15DD00126C2052462C4084372582FCB2A4FE0A6A80B020306B80472223CC3B068E3080B
MD5 SHA1 SHA512 TLSH

Submit Download

Angel.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Angel.ecf
Size 262B
SHA256 79f23b427bfdd7da8c3e49a314cba3d03d634bf1c79fca0011238eaa235f8cde
MD5 be0e22081ef82985f053f624dd379be8
SHA1 616ca2466c8da1d6105ef282bcaff37712adca03
SHA512 03368a2ed82f3fcd4625f516ee23efbde06148c4edf67a3cb0a205a2d447edd6a4b6d138b304965245838fbdb2bbf5ea6e77879f6be374a8c1028e27213fe684
TLSH
T1A1D04832D3081027C4242335F8AFCF28CFF9E1681B286303B9211133BD827444B31807
MD5 SHA1 SHA512 TLSH

Submit Download

Astronaut.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Astronaut.ecf
Size 436B
SHA256 67b7022afcfd2d0b269a5f33cd2ddd8c8885885d7580b8e1b102df6eedcfc9cb
MD5 83ec682abaa49deaf2da2e7026c86680
SHA1 1ebb4ba963cf31003e05867a292677402653cba4
SHA512 2b30121b1e5d008ec6a1f6e691bf1b1987e158c684de27135c297a03c296fe1f6489a10d1a49648e8a62eb2e3b2fff07bfc9299da8fdc9b26ec47a12519f4a97
TLSH
T16FE0C222C3096436D8681336E86FCF258FF4D5681B546303796121373DD33494F3184B
MD5 SHA1 SHA512 TLSH

Submit Download

Auditorium.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Auditorium.ecf
Size 145B
SHA256 fecb4933e24c805aaaa350b97c7c72924fee66c5b434c3486ccf9bec728a34f1
MD5 c4ab0f9bc9b579e5faf586c39972c935
SHA1 60d1707cbfab0133f9973f915a7c4b8c63061522
SHA512 8b09be6648d1ef8b7979c13c597dd98aa2bed40e2db5e2efade31998974781833ba3ea4d6853826807335159702506003c347cd0c025eda41ebcb103f326469b
TLSH
T10BC0012DD21850A6C9A45375A8AB8F24CBE6A56517611307AAB1213B7DA23195B3084B
MD5 SHA1 SHA512 TLSH

Submit Download

Autotune Pitch.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Autotune Pitch.ecf
Size 400B
SHA256 f70d1a1fdfe00773a688ddd7cabdc57c6fbb0154d3609c775a24bf6594c3a326
MD5 a4d3076bae8e209abb1951503267fac6
SHA1 d240a641daf8ce510df7aa8dec4fc0bed9319249
SHA512 20b35bc57b31317dde8bf90ecd997d1bb9e0aa38f75298a2b6d4ac511ba64a7645dd5bd11e32e16a1cf0fe79bb3b8dd24b82df33c26c8061839e73aa8554c043
TLSH
T166E09236D2026023C4109335586FCF299FF4D1A80F241303B81021337CC37019F7290B
MD5 SHA1 SHA512 TLSH

Submit Download

Autotune Robot.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Autotune Robot.ecf
Size 319B
SHA256 a2387b291ef850bc975c9f14c4f248ffb5300eacb9781e5c1fd8962ec569c558
MD5 fc843919c2f620f38d4693427bc0729b
SHA1 60aa20c6518a2cabb68b460358d223305c338dbb
SHA512 543536823ad19163ce2588f83e7574a22dacd68a61ee73c25a310fcd03013553b118c953982f4c8166ef90fb271612f85510f633de20104401a46d0cd42b780b
TLSH
T177E00267E2455463C8145B32A97FDE248FF491981F696303781461337DC77844F7284B
MD5 SHA1 SHA512 TLSH

Submit Download

Bathroom.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Bathroom.ecf
Size 145B
SHA256 9670120b4b592632e0e214e261df0a687c0ea24422180ea8057d7b38d85c9de0
MD5 08d543903f4e2fce656162acf972520c
SHA1 cc50e5198d21bc0c5596a735dea4d4405d1d247d
SHA512 3e5058033902247426169e1821ce841d6d12a3df410a3b057f8f744939d3dbafbb196fe74d923f43a18c4e0314d330a0728be7ca9f3a247d852fa04f6df76898
TLSH
T1D1C00229D1145066D7655339AC5BAF57CBEAA65517441701A45091363D427115730847
MD5 SHA1 SHA512 TLSH

Submit Download

Big Guy.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Big Guy.ecf
Size 235B
SHA256 ca203a7722167249f905cab3ed71b410f07cf94103109a2e3e2a86a9d79f3814
MD5 a300a9ee5404ede1d7b441e8978cf914
SHA1 013986c2b124b49b39822c3cfc268e6264ef81f3
SHA512 c358b68cfc1d618566b3e432f58e48a1f22fcf71b3b79eed4e10c26a63ced186daae0df85f06fccf9313af7e117ad25c6091b3d23fadf2e3b425577a738fea06
TLSH
T12BD00867D20224B7C41182BA583B8FA28BF1D6A91B415B16B445B2323CC3B0A9E30D1A
MD5 SHA1 SHA512 TLSH

Submit Download

CB Radio.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\CB Radio.ecf
Size 384B
SHA256 e257142d6c41ff45b52da1f97d38793c0271050d398ea1c05537a3a4eee3d443
MD5 bc19b6efdaa4c346e1676ba62df6cc55
SHA1 e252cd8e2f1024672a498ce56f452466de27358b
SHA512 315be67022ec36354cdd394eaf21baf8506c0529324ba0ee819e559d21f2fcf1b7a28a71768bf37cabd9e552d56d43d9563376209d1cdd2d6d5612cc3305842d
TLSH
T1F7E0C536C6419072C460433A997B8F259BF0E2A80A511303B62632327CD3B0A0E71C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Cartoon.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Cartoon.ecf
Size 166B
SHA256 7aaa3eb9d07d276a2ad5690a41fb3e43b385697d1ad3e453be9ac3aebf51bc45
MD5 06db84ffd4b6a1a252eeb370be066315
SHA1 0f7104d00652d85d718b3905bdc0d112abe9e666
SHA512 9a845f971e5a5936e452c85282ff9b258a52116fe9f1e8cc96289f9764b7bf74724dd115f6848f82343f3b4bf283056369a7b6c54af71941f248b6a6f86d0db5
TLSH
T1D5C00127C20620B6C91092761CAB8F628BE1D6A80B511387F880B2223CC3B0A5D30C0A
MD5 SHA1 SHA512 TLSH

Submit Download

Cave Monster.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Cave Monster.ecf
Size 702B
SHA256 9f08cda5a9d8ffd01a007d4c6c7a1c063975a14ce503e8e1c92cba77f5b2e6b3
MD5 7dcf2d8cd137af487f282364f8154da3
SHA1 938de314e8a6f464b359b988a15d60461704a09a
SHA512 280d52771fd748ae690c70f4e1cd6dc578d0ddeb33f8ec9f82342e6d8bcae3d1ee9df289aa4809736293350b5e64910820f127fce5bd228e16f2dc65395927e5
TLSH
T16F019222D3005476C428473668ABCF218FF485A91F26AB03B9502232BCC3B8E5E3090B
MD5 SHA1 SHA512 TLSH

Submit Download

Cave.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Cave.ecf
Size 133B
SHA256 bc628b7fb40e2d1f4583f624e89a653771c24094b94a4d544687c04ec82b0512
MD5 20c450b921909c594169cf73c66c3e1b
SHA1 585bba085f55b91b23c29b10358e5f714b142dcd
SHA512 c62902d75137c2fb3da0e10125425ecc22293e311c9c9def74a1c9f46de1164491e60b02e186187c8e9fcd759fa9d1c580d38338568125e980d6f98383ff22ec
TLSH
T1A3C001A9E2480863D8740732785BCA34CBB1C5651B44A303285021613C873884F6589A
MD5 SHA1 SHA512 TLSH

Submit Download

Child.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Child.ecf
Size 166B
SHA256 2d2d0e88c4a0d255440ecb457eebff183ba061269d8f1f07299a962b4313ab7c
MD5 772f91024c53e6eee9d1916096c56f2e
SHA1 9cc93dd997a48a59c7a9e6a5feedb90cb3e9d28e
SHA512 3a06b28f7777fbd1190ffc2bb38b6bef6feea7f8eaef1150063283d384d4f7f54dd533fe16f11dc356e8c6ebf253c1b43e8790e93aa81339bf8f6df2b5071f35
TLSH
T1BFC0011BC51724B2C410837A296F8B228FE296A81B5513027A10B2323DD7B0A5A30C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Chipmunk.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Chipmunk.ecf
Size 166B
SHA256 d2e1b0d52400187e130b4ffe353dca3b1dd5496258f1da74394843071dae0190
MD5 37aa251e2e6e608509a138317436adf3
SHA1 a13b62aaed032b115cb060d3fb741bb7870f5b05
SHA512 c442762cac9d0b2d7b09815a06c9baefda4fb8aca3f9e1b98f750853fe66bcc361afaa21d466c8782ea101a890ba237c7ad92bb2f803bb763a5a16e6c021f981
TLSH
T17EC00127C5162072C050827A186F8A228BF197A80B9503027900B2323CC7B1A5A30C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Concert Hall.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Concert Hall.ecf
Size 390B
SHA256 a90aed3040bb1fba3b054dcdff5a8532a106cddf2dbdedbfaa08c5eba9e7c881
MD5 c99d091047b58b6dfa5efd9e104a7b4d
SHA1 9dbae76e1a0033e679b60f628888cf793f54e70d
SHA512 71d909a9175f07b4bf5d1def01f568961cec3410e358a7130b17d1aab08ffece7c23c898e08fd2c4f8cf952cb420e831a448cbaaf2c1d0f308cc0f0ed0315ef9
TLSH
T1FCE0C922D3045421C03C0735789B8F20CFB484522F076B036D611632BCC2B8D8D30516
MD5 SHA1 SHA512 TLSH

Submit Download

Cyborg.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Cyborg.ecf
Size 319B
SHA256 5e471ee18e8f77d6d2a0893825c24b9b641bbcd3e1640b979932219c02b1baa3
MD5 5c3b533753833d923d4b9aa88ae26fc2
SHA1 86f1c1dd8803302200abc3f8f0839ca71a397f20
SHA512 c1d218201019be78730e979cfc2034e09d97def1ec9863613cfad34f3d81011a3724a0494f8311ef9279b4a0a780cb69c44227521b4ab00bda12bf245105c1f2
TLSH
T17EE0022AD6045572C8248336A86FCF648FF091985B045307F89461323CC77446F7180B
MD5 SHA1 SHA512 TLSH

Submit Download

Darth Vader.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Darth Vader.ecf
Size 214B
SHA256 3f7b864b1521c2ca37d0f4b9f361f2aca58af30e5e8ec8486bc606705b35320e
MD5 73d355a3adb96c504febddb8dfcd078a
SHA1 02406c4c1080cdc166ccf0c3fd9b5503691de885
SHA512 708667e12a07e35db28c2fa83e5a7ad5e60963833031134a8b864dd07b94d0dde36d44b04cd1ae314d9c5cbe3492529d7f1fd7b86ea68b945df977827277f44d
TLSH
T13DD09227C1045062C00403316C3FCB6A4FF191995B0A2701B80071327CC77008A3080F
MD5 SHA1 SHA512 TLSH

Submit Download

Demon.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Demon.ecf
Size 368B
SHA256 83a161dceeecaa18fff7349696974fa1dc5d268b5bcb4293e41a56b1ca352347
MD5 89799667befa248232b04208008d2371
SHA1 8a20f66de505d7120a5898e57dffa67f98257de4
SHA512 1023186181aec3d82c19d2ae626b7f864e7b13e75e65d6ef9252a7577970e529e03fe5dc35a2197b3859cc2840bdf8ef606761e05d2e2f9cd67e41577899262c
TLSH
T170E0EA63DA055071C561537ADC3F8F228BE4D1AC0B551702B621A2727DC375A4A70C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Dracula.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Dracula.ecf
Size 368B
SHA256 edd0be6da187d3847f1c7537d7331fac46471aecb65129c2113acec6432451f2
MD5 d2a7643ed6890fb8ba7b02ed801234ca
SHA1 601f52d2c6744f1dde5ce6b80f2dcf3cd45cca5c
SHA512 1ea0d3eef73031046807481d11243e1e1e0042217cc770aedf50821901264672446942465769a0c84be79cdc6ce4ee25866cc30d4bdb65da4b1c885e6148623f
TLSH
T1CCE0EA22C60650B2D0105376983FCF255FF491A80B645703B51462723CC77054EB1D0B
MD5 SHA1 SHA512 TLSH

Submit Download

Ethereal.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Ethereal.ecf
Size 624B
SHA256 ef2084e3c55ab563a74d1d57267fc018e59c744a89b28f1f80a1c98fc6b22fb8
MD5 9ca42e1b4d98eda0d1fc97d712935a33
SHA1 2b7cfcbc657434f3d9c3a7e8dfba5a71f4c6dd00
SHA512 e7379742d616038744f345e8dff3c79e636744f37cf1e2b61091dc0499b967092f8797c19d142d32e32e847d1eb32335259cfbaed7e04d9e37e335dc56a7a542
TLSH
T146F0EC36D2004532C4385336A89FDF299FF454562F0B670268551232BCC3B454F30A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Fairy.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Fairy.ecf
Size 400B
SHA256 7ad54c52c3e9161516fb7912af6e7ceae03f7e10cb1dfe02adc8b2d713e790c5
MD5 15dade2a00f0f933a09654e4e82812ae
SHA1 2772403defd1e36e73394e58129619c114c9b5ef
SHA512 f11681ae51016298d2bd420e03685e6b01260821ec1a144a9abf6d9aa3caa9e0384ea82328ed383b5385a659be250052ec5c1fc873a7bfff349383c1a910a3da
TLSH
T1C8E06127D2412032C820633AA86FCF2A8FF9E2A80F142303B80062327C83B014E3090B
MD5 SHA1 SHA512 TLSH

Submit Download

Female.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Female.ecf
Size 166B
SHA256 04dbb0a1cccbee8d1681ea333e7b558b4f4c083cd88629c16f3de50ec2f3c167
MD5 c9d8bb80008861bf86f1b8ff0a282a28
SHA1 f511cff8e0e38474eb6c0b62b09641881ab28d85
SHA512 c202beb3ae6c7130f6ea80d546e5480f0dc50a52eebd98b877469ece637f6f4bbc1162a715826205b40629c0d836af84c813d107bf01ca507868bbed8921a8ed
TLSH
T120C00117C5562076D420837A296FAA228FE1AAA81B4513067910B2323CCBB0A5A31C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Frankenstein.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Frankenstein.ecf
Size 283B
SHA256 68bf8fc660373942e6c35d2dcb34d83cdd1adba85a7aa4962bb2c6bba5e2efc7
MD5 3bee27cc8913500b2d14040f906f28bf
SHA1 02c19be1c1750996c19f43ef33e4f770a0b4f26f
SHA512 f6e0dd1aed19f4926b85a94765fdaabe18afd6592226fba90bb4b91f43df473f9c5bd2dc57fd749e82580dfe0ed81ba0932f42874e6b7cff3508f756541ef904
TLSH
T159D04823C20620B3C0105336983FCAA59FF1A6A80B142B02B84072333CC7B058F70C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Geek.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Geek.ecf
Size 319B
SHA256 f7dbdb3651aaa4e0f1e8288541ef8b61fa8d019c5072135674a120b1efe6553e
MD5 758c2424871807b2bd5d65f4998deb9b
SHA1 a9cc204c1397dc3e4fdbbf018c2f2c126dac6739
SHA512 4701bdc363a2c2dec75ab8dc39a8c7b216f547c96d273a7348e6b4399bef6cd8b31e92cce8e8c3f187bdbe7ebf7a1f29b35fdb02be56f7c14d92ed1cecca6e53
TLSH
T176E0EA6AE1051423C914973269AFCF258FF4D1541B146303A9A461327C87345AF7190B
MD5 SHA1 SHA512 TLSH

Submit Download

Goblin.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Goblin.ecf
Size 645B
SHA256 d05685ab618b49b81b513c3f156c5ebeb9af0f84379d71b441e47fb626cebd9a
MD5 ad0d88668bd78a39d1326d9ee470357f
SHA1 c6aff925bd11824f65f0435e363e19712873330b
SHA512 9754a9fbf16a8d1a5037c83cbc56f72658fd59fdd0797994b5679d571138d8dbc28081a740b53fc3ffacf4fdb0986af57db096282afa2f203fa9fea707f53bdc
TLSH
T19AF0EC27D2045433C03853366CAFCF255FF484961F165B0278442232BCC3B494F30917
MD5 SHA1 SHA512 TLSH

Submit Download

Grand Canyon.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Grand Canyon.ecf
Size 133B
SHA256 f1f348ad40c09b1366876ee43257752694c3cd46bb8a4c5b91e350a8d098421b
MD5 ba874103ada1092552ef8cef2b0e285f
SHA1 9e879aea4d3c279067939f1a32a0d080bff2d6ac
SHA512 99183bde639e00dd3bde7660c42aabf18d5d43ad3d2a8f9f287eab85248a3588869afe0f2ef5a0f9fcec359a31e15147d92197f76a1a4e02e86b450b5af5a448
TLSH
T1DAC0012593485863D8640732785BDA209BB185562B44A702285126B17CA73854BB984B
MD5 SHA1 SHA512 TLSH

Submit Download

Hanger.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Hanger.ecf
Size 145B
SHA256 0353371891ad1f2f41fad8aa277c00aa48090d84d5b7ed16b14a68ab887a8602
MD5 f8323b770350c6f400e74b0d877d7828
SHA1 91b4eb6e88ac605ce54b499a07db52501a511c9f
SHA512 00c120525639ee9902485cf0b3a182283e73e2928a7a9bbe3da1b4d9b386e59fadbc15b0f1121860dbd7e9220f98ccc6173d21390720431e19362f88a8fd2b7d
TLSH
T16AC0112CC20800A2C0A00330E8AF8F20CBE2A02003200303AAB020333E8230A0B30C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Heroic.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Heroic.ecf
Size 528B
SHA256 579f63738d0e53d136254ce445186d7ff93d905aa4a0cfb80a277c6935df1fbf
MD5 722308a6d5617518c82057e0c4db746a
SHA1 a1cd28aa6c456656acde3a451b24719f51fd5e53
SHA512 f0bf5c316e38fbb9632c4b0e70cd027bb7742515e238cd362ccf247f0795d45edddb48d2923adde26429f3a0d480693d6c41f42dc2008e6a7fea78c49ba44004
TLSH
T18FF06727D3045432C038573A68AB8F618FF485961F465B1379162632BCC3B494E30917
MD5 SHA1 SHA512 TLSH

Submit Download

Impossible.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Impossible.ecf
Size 388B
SHA256 db09ffd87a973594004210e77eb37368c7a06a91789e28bfcb794f9a080c0783
MD5 0d8c8dde3b2f372964174a0cc93b36e2
SHA1 908ab3c2620500e4a89f12cef2cd9bcdcf5563df
SHA512 3ec6435a37ca84cbae1d2c049f50236e0636157597eb911f72aa678dfe729dd5f8eaa1a9b60d6b547f4e34e30321679d7396a46f71fc7925adf28e46b41a19a8
TLSH
T14BE0EA22D2452936DC245372A8AFCF658FF5D2A95B049703B45022763CC3B998F31D4B
MD5 SHA1 SHA512 TLSH

Submit Download

Jumpin' Jack.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Jumpin' Jack.ecf
Size 448B
SHA256 0bfb40881fe65375e6fe87d9df6f8e24b2424b3b0d96ffbcc4b455e1e3aec9af
MD5 a95f915ca78d78161f2e3a33b0bcc32f
SHA1 27dc62482a2fce48f1927b088003451c20eaee74
SHA512 5e0605a720d6dcc6f7e6a9eac7411494181d7826d8bc37a380e6631f6910fd8a4511c6bc92c9536d6e806c9290707d575807e03bbd18646c35d2997797cbc38a
TLSH
T1DEF0C215E6884823EC285B37689FCF309FF0C1646B05A30768A412723CC73959FB284B
MD5 SHA1 SHA512 TLSH

Submit Download

Klaxon.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Klaxon.ecf
Size 376B
SHA256 a2c50cd7c83dc5dddf6bc28e454acaf45233b10ea7e57937a91f57e2d060ddc5
MD5 93694f3bbc618f0f501939e064f1fa4c
SHA1 15892cc11fd1832d8b0980c24c6ca96b58c583cc
SHA512 1e51fc9beb3d0a12a7c2369de704fddc3476037fd1bc17523857b1e39c0c1fa0b8f98f894e7b91dd79880035e981fd1f7605821ba41dc4c159f5d42e58ba8fcc
TLSH
T18CE0C522D2451823DC24973258ABCF61ABF0C5A91F029307645426723C93B894F7185A
MD5 SHA1 SHA512 TLSH

Submit Download

Lost in Space.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Lost in Space.ecf
Size 388B
SHA256 2b2db3f2523f141e1c95cbe5cfae92a8daaf6eb92379a5576431c2cb8751d87c
MD5 413f82d70e9b6870a089b57e34516420
SHA1 15530c4f6a1356cab5f862ab6dae64b3f07fdda8
SHA512 f2daccbbc5408cd57edbfb12a6a0dd4b63efac7d9ad09f2cbde51675b0c36dcde02e568adfee5bfaf4342aea863b5345ffb9dcc25e2368b683a34646069c854c
TLSH
T163E0C526D305143AC8645336A8AFCF218FF1C5A81B105303766562323CC37494F3194B
MD5 SHA1 SHA512 TLSH

Submit Download

Male.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Male.ecf
Size 235B
SHA256 f131efcabedc449defea5d6954b2fc5459eaf9eee6e5f85abf1de84c336f905b
MD5 6107e5a84b1adeec7ea190efdf2d7d8f
SHA1 6a71fed97ba115fd6bb73353dfcd94d7be5d58f8
SHA512 16ab1ba70e5c19e6526c0f27d298f91d4a04fcb18abc27d6008b930e56042991be816183e10ecdb71d7b171c002c2fc4cfd188afaecbf2b15968ca65a8f33948
TLSH
T1F6D00267D6022073C41193BA5C3F8F724BE1D6A95B414707B544B2623CC3B1E5E70D1B
MD5 SHA1 SHA512 TLSH

Submit Download

Nice and Clean.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Nice and Clean.ecf
Size 342B
SHA256 2ab27383447d55c00a4f4520a774626d322445e28d40b5d6981bfebbd451fb57
MD5 309ca8c97cc326a6439311ce8c665d83
SHA1 9fda721e2b1e276b853375a75f93391d25a5485c
SHA512 6bd07eeedb083a075ee43e09f768249ef60555c0265e7ad58c00b2448d9bfeaf88e77ff909d1a90f1c6dabab2409e2fbb6610aa672f32a0772c9068f405c2cd1
TLSH
T176E00226D3005822C039077A28964F61DFB489562F47AB1369542631BCC2F8E4C30A15
MD5 SHA1 SHA512 TLSH

Submit Download

Ogre.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Ogre.ecf
Size 251B
SHA256 30431cbf34f454d7cbc5c8957fe151927ee0f86cadca96f9b58b29cbce59a8cc
MD5 1a6d9cc57536a510a37333ff685e71f7
SHA1 ac1882486cb93dae2ba8cb8f9a803a23cf6b8b6a
SHA512 0d331128faceabfb59ebf6e2da5466398c860b0d1616f66d9439e0e07692d590638fdbc13c351ce50aa0442bd5138a8c4dea1b5ce02dd40ed59dc32a33e8580f
TLSH
T1BED09223CA0250B2C010837ACC3FCF314BE4E2A80B400302B510B2B23CC371A0AB0C0F
MD5 SHA1 SHA512 TLSH

Submit Download

Old Male.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Old Male.ecf
Size 320B
SHA256 9a4ed708b820691e99d24db4a0b53ee20f78754d0ca4d4560c5e79e46e9f1dc9
MD5 b6fde4428cbbb7220f107b75d63ebb66
SHA1 ea2bddabe773c9c2758990b06c9d04fc169d0525
SHA512 fa726a8a6f78716cf6d28f10aefac9b2055f5da1e886d673831a25a9c7e65523b63566158a338a8a2dd52f9dba5d6b32dd1626dc84927bb2e76c5efe6c20f427
TLSH
T195E001ABC6022132D400937A983F8F628BF1C6A85B010707B98072223CC3B0A0EB1C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Old Woman.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Old Woman.ecf
Size 251B
SHA256 8480c8543ce45556f33c0740c81d05d90117a2d6f98710e28e0c30f36f9f854c
MD5 2e354e72180cbbb9357e8a081b18aef5
SHA1 e557528af3829d509420b82caefe14c526ff911f
SHA512 4cb4a9a89e22718cfdd93ecb9f7939bef97df3f250d435c199505e782c4b4992546427886698bee720b5bc2c155961f58a2ee077e265939795d14f793f2083f2
TLSH
T1DBD09227C50A1473C0004376483FCF618FE0A2A80B012382F950B2323CC3B164E30C1F
MD5 SHA1 SHA512 TLSH

Submit Download

Pirate.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Pirate.ecf
Size 352B
SHA256 aee4c6976932533d334001f72abf335afdc16b77e8cf71adcea3df01a5b5108d
MD5 f08d22349c44c0bf6b1c2c965ccec0e3
SHA1 bb34228e522fc32a38635e2a0187f2298dadcbf0
SHA512 1cee2fe023c4c39cfc4d65585f21eb38a7e4142ea13f71870be28234dcd17d1295c61a69d9b007a2dab7dbb888e7185b63d3706858f57e37a1cf01f2a356e1e8
TLSH
T140E0EC26D2066077CA10A33A586FCB2A5FF0D2A91B10130AB800B2323CC3B0A6E31C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Pixie.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Pixie.ecf
Size 528B
SHA256 18f8049501db9405d1227eee45092b30040667f8ae6d8569b820162d5a0c8692
MD5 90877a93c8f9bc3254d93d0f40f9e5b1
SHA1 723a8cf7a5bce9bc697d0134bec52371e1f880ba
SHA512 bb8998efc5aa6cf9062100dc2b9cd262cd498ffa72ecfb477bd436ea6c6b8c3b2072ca68931f48827ca497e07f9b98524ed149131adc3944d4676b9573c41b32
TLSH
T13FF06C33E3015432C428173A28AB8F259FF4C5961F176B03B8142632BCC3B8E8E30A1B
MD5 SHA1 SHA512 TLSH

Submit Download

Protocol Droid.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Protocol Droid.ecf
Size 283B
SHA256 1a960d8482d401ad651fa15cfc32eae7e490c29c17b2ab5cc83f2b9bf250665d
MD5 21e3b07c43dad0a8b9360d3c0320f795
SHA1 957513ed9c28c6926768f71b2e8eee5861eba0b9
SHA512 63d7bf343e070870f8521f3b3ea794fb29b3708a8e277b80f4abbc8cef0182336bc738752a21ad1a85f2c9a275baea45a1ddee0df02e421b8808c72844930c07
TLSH
T1C2D04822D5066133C040633A583FCB2A4FF0A6A94B1503027A00B2333CC3B495B74C0B
MD5 SHA1 SHA512 TLSH

Submit Download

Robot 2.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Robot 2.ecf
Size 331B
SHA256 fdf0878513727e1477719c01afd359fda6517fcbfdfdfca65918ab319c629de6
MD5 33625c087ea4ac2898b3949c3fb7414b
SHA1 65345c2e81004ebf6c026ae2dc3344b2b4dac710
SHA512 2009d0ad66f0706523b9037c18dc652ce4eb1a790a897275c600db12dd5f4f7869e85612f09fe2ccb10a91d551e95e87f840f14033ca3710f196315a732d87cb
TLSH
T1CAE00235D7055023C44453319C6FCF195FF491954B251306B52421337CC3B444F7180B
MD5 SHA1 SHA512 TLSH

Submit Download

Robot.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Robot.ecf
Size 202B
SHA256 8e3539057e13f990046cab6082d7fcc848a58394eaa9ca6d2fcab8c8ac9d55f0
MD5 27bf7eaa866ebbb5c408659c45a0431e
SHA1 f1570b373afb7ac9351f8e3f3e09a127ae160205
SHA512 724393c399fa889a075a281497416170461904f98fbfb662fdbb645706df72fde54ec86e58a7a6e7eaad356be6127567e4b0eeb4f777c378bbec12ff04b6c98f
TLSH
T16FD09297E1081433D8104B3668AFEA208BF486540F086302380062B23CC33458A7184B
MD5 SHA1 SHA512 TLSH

Submit Download

Squeaky.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Squeaky.ecf
Size 283B
SHA256 63743be39568bb4f2db622d2197aea5c2fd8f30b2d86d06b0ef104dd6df08f0a
MD5 1f4b3d5e8143864bcfe7725a4ea54af1
SHA1 1f34f22e1bd095bf0a7e25179ecb2e15aa3f2a6d
SHA512 15f02e598a27807b8c356d9868234043b8b383fc72536e4cd69107f43b5be7f8fb165df6ad91ac2ca3735919d384c83023dea749a875de85933215d222e9558c
TLSH
T132D0017BE1162023C4108336282FCF658FF4A6A80B182302B950B23B7CC7705AA7280B
MD5 SHA1 SHA512 TLSH

Submit Download

Stadium Announcer.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Stadium Announcer.ecf
Size 452B
SHA256 51388298965ae5d3a1a5aea5db9abbb584fd9d144b9aaab469d1ec6a200139c0
MD5 a294853ccb2134f1e15aacd6105905a6
SHA1 2035a50cd59b2013df4f014d0df4db6317ab6ca6
SHA512 1a297566d741af38397ad58eb5cae4aacff4572fccbd652dcbbdb6ebd1ad5f7da3c8d6e0dc47245417809a0de1f20e11e53217fafb610358cccb9dcf9163c44c
TLSH
T1A0F06C36D6085422C8141332E87FCF649FF590A80B206303B56512363DD73489BB1C4B
MD5 SHA1 SHA512 TLSH

Submit Download

Super Villain.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Super Villain.ecf
Size 447B
SHA256 1d2482f68ee8c92d4843bfe8cb6c35d6b17f1aaf42536248a45d0e6c940fd56b
MD5 727ffb108a15ea9ed16ae4ab4b62825b
SHA1 ea2c694c56c5da034948cef0bdd40a2c238a3a51
SHA512 c53201d15a2a2bde7887fead1438d622e2950b63faa7fff5013887f2b46590ab3962c7095c7c78af09b7cebd07eb4db05d88819a77772e373bf39d62e836adc8
TLSH
T1D5F0C923D7404832C438073A28DBCF218FF484562F07AF1338442A71BCC3B8A8E30906
MD5 SHA1 SHA512 TLSH

Submit Download

TV-Radio Advertisement.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\TV-Radio Advertisement.ecf
Size 214B
SHA256 d1773c850709ef94379437c0592d5b0a89f25aecbc78ef0bbc4f04859da045a4
MD5 8381a886966b0d2aa6de053d214ebd09
SHA1 2f711aa3d559ad48828068ebd66aa5d78885b55c
SHA512 c9ea0070885dc8c341592e3d1e934ea17ed6d0e9b9b431dce2834b7f329441ea6f949c2afe1a4d3ff51cae3fe2bb5af3ee09c51cd337eb7803326190e0a148c0
TLSH
T167D0923AC302107BC410033AA87B8F2C5BE4D2680A012307B81022233CC2B050E3898B
MD5 SHA1 SHA512 TLSH

Submit Download

Teenager.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Teenager.ecf
Size 166B
SHA256 e5775d5d999fc2f6da8d3cc060f803a89d9cbacff38a9964ee0062367988b94b
MD5 971d5099a227a2a6caee7078f71f00b5
SHA1 7a28d4fc1a6a9342188a8d95ef2070b66943406a
SHA512 1a3b237d490d9cf770a23cf44838f8e6546e6e666d3a6157ebbff7b81546f9eb1b78ea349e7bdeaa351c38bbaedbfd566c8e225757225e82d5b758bf127720c2
TLSH
T107C0011BC5162072C410837A2D6F8A228FE196A81B551302B910B232BCC7B0A5A30C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Telephone.ecf

Path C:\ProgramData\NCH Software\MixPad\en\presets\Telephone.ecf
Size 166B
SHA256 480044c85e0316d4511f8a4133203cee7b4a6e1ca432c3d05ba982d0bcdf8a94
MD5 b5706d250e75e627ceee9f47628f3bfb
SHA1 abf1aefbacae5a1975ac11d47a22965f3847cab9
SHA512 266a7a8a361fdaabb226a4467261a6215847767396dbb99b27ce2d381c42ffe8312a41acb5394b5ea0286dc81db4d7c1d20a6850bee5a4f71addeea0dec43673
TLSH
T1EEC00166C2162077C91093365CAB9B228BE1C6A84B401747750072327CC3B0A0E31C0B
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9267ca39fb50d75e1644d2a3d696dd6ccb217e6bf9e7569d932cd90aa7ddc3c6
MD5 3053e2c309efab6af094759a328116e7
SHA1 5d7903424cad814547aab0b24c905523966a4e3e
SHA512 e50de13a7f8638a26ab1291ceb7deeec0ee240e218416f04728511d55351ed30af33ec0e5c0080501730ddff8c78a910c56192116e7e3b1043719f834e9a713c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1C9B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5fd0dfd3d3bf3e7005f86201a11a7b14e5b70a804c20d2fab2dc7e18e83479c7
MD5 59dfe5a6038e1ae4c00480b3fa70dfbf
SHA1 d8b171ed62e85a9877f2b32db7bf807cb4576c47
SHA512 0cff21ef0bd37ce3d4f98e7940c908c3201d89cc50406b17dab09361007866bd0951b42f1ffce2eceef6f25882ea83f6afe53c995d82bb88973ce086556c906e
TLSH
T1BBD09730FD10A5A1D22A0071001006001E1404B220A782D1A024181CC9B8040C2EABAA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ccbd0b708eca3ca17e45a222ae656ecefac2dee651024681c150fff0afed8996
MD5 ac5c4d5515b1d3078cabc32570ac57f5
SHA1 01ec9729c4680b3957a1f63f2252c4474bd5cb7c
SHA512 5f6377cd331da096f77bc2f759569ab944951df45d363b45d8c489a8a79fc11dd8d275263cdf4531a010f7615286cbc5672b5662198034d44318c066c2476cb5
TLSH
T15D6181390D76E318F332637288FD62F930B2A2EDF1174C898140D87C1406BA0C796EAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a6061.TMP
Size 3KB
SHA256 28b296ef96f42eee7074d1bfcfbd6283765b780f3276021d1745e474480daedd
MD5 cafd4fd15f22a195114470e60e1d912f
SHA1 7be198d9f06a24826f35ffaf44c5564fed8412d8
SHA512 e984bc6b21dab9a87cf41f25f0d48d889b086ed19164aa6ac9e560c31b15cab8b6237e6c1f21e026e7ebfc389bd4e0e28e996f5519b64254163995214373b28b
TLSH
T1F26180790D76E318F332637288FD62F930B2A2EDF1574D898044D87C1406BA0C79AE9C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4df73f64fea20d1c0e0f709269e316114ec7e90f824060abc773838324656efe
MD5 f8b44b3b4556a9033459efaa29dd351d
SHA1 a9d60c817dcc6a1f555c9105307a0b9ffb185a0c
SHA512 70ab73b464c685ffe5f379fe48f918693f8f9006250095b1290d250e5880b5d156174974811af70256719ddcb3a34cdf52c82667a523d37f499ffda337aa6104
TLSH
T1C731ACF7C3E8852D891096F4A7186E2BCE2D0A15432C3D5AC4E4AE1F93E24B0E14049E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a88c911762bf949a64ac5866b8793de7006547721abbdaac212e15816421f12d
MD5 daf7a1d493daa312c7254a6b86632ef8
SHA1 21bb96e029421f5a79abbb86fdb8505f7231624b
SHA512 2ddc12f72ccf75a4828f6670e7ff6459b72e18694923cfbd79e4752b9fa61f4148393d024788fc5fe1a7949828238337341ed31837042a763ee882be06f307a5
SSDEEP 192:sxZEROyM/jK1Ml8tjv/fVsYWpVGE9bV5IdpV6Hpz6+WNGYP3R1iix6IgyJ:sxZEQUv/fVsYWvGE9MoHiGviEO
TLSH
T19B52E811AA34A977CCCBD20DFA55BF53D6F91422A2901E44A9FC9A1C04E6AED3217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 67791f2acbef6a4aefac385f726bab41dd81c41f5958df6e2ccda47cbb860c3f
MD5 431be400207ac5e5ebaab28d93200de5
SHA1 bacb86b1cb3060b2d3c19017399576f6f4bbe3cb
SHA512 3bd74c0f018503aadb88330b79ee58263d95bf45d813c163b46fb7ca3bf81c711f6bfe463f020b02dd076b12a066ac57996dff5e319271040453198897dbe9ae
SSDEEP 768:9tseJQxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXm8cLly0ppOrotX:9tseJQxWvhfynu1jaOm8cL88pFp
TLSH
T106E2FB3B280CC77E4F844E6CEC2A6F9A6EE801CB97984D5447EA984C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 74a970ff28f8ad40350fad03062c4f8b614afc2cd4128e21a82437f81ee29ded
MD5 c1b0323a55786e232e6cbeb105eadf26
SHA1 3148a77b0a6385f8af1699d5fe9459470ad097d3
SHA512 70f42ccc911a43bf37901ca8d526956c4ddcf4c457981c5bf3dd51aba54b9267a9a3193d3577b1b93a4471a96c06feac1aeea1de3b63dbcfe9b715f498d2ef0d
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EK:KYHIhKggkXyV7IlKIcg/ydfIlKwsww
TLSH
T12E911023353B02823C7D264CA2A7D53B4E4172A7745C64AFBBB900951E27E511EBC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b5faac8f3c4c3bba35737de35032d756f9a50405957898fedf96189cae30c60f
MD5 fd4c76f818a544f43e44d35de5bb7187
SHA1 23da8122ddbcd09ed93d479209abd946f7335af3
SHA512 fbda4bb759d35e215b2606ba1f7bfaeb7dcf51b3eede5f306ba522b45226df513380e77cff0f99bb92054daa0dc59fe785c1895ed484db116c2fdbdde3b5941a
SSDEEP 384:nfZcI3sN0Uy57w70StTLp+ugcRA8tQI1oZ9Pkch/r:33z2lTF8r8YZ9Zh/r
TLSH
T158A24BB0DC648DE784E6F1C5B589F2172EB80137C5888A5CF6F8BA3D345F5B8271681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1f15bf77ce927ad33eda2202363a17aef1a7b7c1e6445d940444096044f644d
MD5 9efb8176035f20d59ff27ff817d13e84
SHA1 d9b75dcd251d61f9ec14daa498f72826d2140d4d
SHA512 e329aad4bf42a5e7f7d61810ec37377e9cbe8351902535497caf4807847c0649daa42f6f83cda9254d25a5d89cb329367e39ec097af276dc4b5e0958b4ce9eec
SSDEEP 96:eqONkxQsjpflMoUZre5ih/cIPURHl8h4otop51AODABjPYvlCr5pgz6qNGeAL5YA:lONB6vMtPQmiUy3kThTXiSCV847lsU/u
TLSH
T19002F935AC785CBBEAA7AE45F48A23172FF4116FA5905B50EAE82F1C00D765C2303927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 49c1b81468c3672538f565b02010daaea660e58ce3baab5559affd0a18795d94
MD5 2233e1e13e8c65fc5af617f2fcef8c95
SHA1 778f60b8f7557ac6ecd21a1fd40e7ddd1ce02c86
SHA512 577160927511ada1685d18754c0d5bd845ef536bcb1dba2b9fddf01dac2ab69cdc3c7eec38ab78bc61e465effc71f136fe828c2d3b8f0b013f96a2f405d350ec
SSDEEP 192:tONm6vMYPQmiUyyIkJhTXiSCaS0u180IlqseU/u:tONm6UYRzLJa+ua0U/u
TLSH
T16012F971AC79DC6BA9A7B405F4CA23571FB421BB98848F50F9D82F1C04D7658370B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

b55b385c-52fe-4f13-8eee-f7004b513c92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b55b385c-52fe-4f13-8eee-f7004b513c92.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5311c7ab-2b21-437d-be14-e7b9c75e3d52.tmp

Path C:\Users\Admin\AppData\Local\Temp\5311c7ab-2b21-437d-be14-e7b9c75e3d52.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90ebbef4-cd7a-496a-be22-e5b98c104f0f.tmp

Path C:\Users\Admin\AppData\Local\Temp\90ebbef4-cd7a-496a-be22-e5b98c104f0f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

0.aud

Path C:\Users\Admin\AppData\Local\Temp\Default Project.mpdp.ProjectData\0.aud
Size 7.6MB
SHA256 0b85b3b79da16fb7c90b7ec6a5478a253c5caff22d5d4808870b01a3b2bbcccd
MD5 e12bb7827542845f7fb43d781b7fe278
SHA1 5f3f411675fa335b56f6ea367e466b4d8e05dfa5
SHA512 ceddbc91ccf11ee7c75e1c0d2066b594b054ef7548e57bfd8b8d17b35ce0fad8b7cf60b3403c24a0ad2f46b85200c16c7b6aed01fd699d2edce198922647aca9
SSDEEP 6:V300kFE0CkVn03tSnHnH0kH333kHEXkF0CUNCk0kF3kFXUnUCE3U9F0kFNSnkFU9:3
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.grf

Path C:\Users\Admin\AppData\Local\Temp\Default Project.mpdp.ProjectData\0.grf
Size 4KB
SHA256 9556da804aa4d2131d6b78540b74bf3e007143bc135d2117cfcfeef9194793a8
MD5 c4a171cdf287a74e8fd70ecc904b8111
SHA1 df0241dd6fd55a70264c55e30c9beac1aeaaf287
SHA512 d8aced86d2009172cf521442b051b0ca9a77b2531e9516269b075f466417be4e4f0eef80d4611eb2c683d65b3d74d0adc0fe1ebb28cc1f0ec9c506e88fe21504
SSDEEP 3:jf:jf
MD5 SHA1 SHA512 SSDEEP

Submit Download

zipsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\MixPad-2652-1\zipsetup.exe
Size 3.3MB
SHA256 54986dc3615088f1a1ec16476627c1e4109820f63279d9b4f1c3f6bda18503f2
MD5 32c083d980035215f6b61166e047e0c4
SHA1 fa0856181bee02d36c332e72fae2dae44fb106c4
SHA512 602f0004b6a5374b80dafdfc50082159dbc9ded3e3c0f8c1dba668cb44c6da1b8965252e5d560d7c6862c2141cb44f8e1df4eac4c997399a5bdbe189e2dc57a6
SSDEEP 98304:e3H3+G8jtNola01fKUvTOlADU6JIjlMnPtz:e3OGLlayCUvilAFIl01
TLSH
T1E4F53328026215DDF7312FF072E596B3BF55B62E970CED8F6910CA807E39573A1A48E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dllbridgex64.exe

Path C:\Users\Admin\AppData\Local\Temp\MixPad-3148-1\dllbridgex64.exe
Size 90KB
SHA256 77bbf0b48ac99ca30e3ffbad023c99d20e223057a789bd80035d0f941721f6e5
MD5 d492e9f17dd6e3e9894b09b5ebed11f4
SHA1 8a31c8022bcd7c6dffe5659ae13c74e27b75f016
SHA512 9cffc2c67d530e4ed63a11f8e2a9d23500783838435e82063ca65f78259708a3cd150adf1cd3838abec2b3356cb9f2f141ed750fe83d20c92675dcc6daaefe66
SSDEEP 1536:f40ANZWtL6Cb5SKYrsV0BVlCEQep6MENhrvcKx+dYXawaekv76I7Dh:yNw6ySNrsG/Qe7ENh4S+ekDXh
TLSH
T10593E1A64F240454FE761F7034E0D11EAF74B6B236A3C9DB622AC4248BD13516A993BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vst3hostx64.exe

Path C:\Users\Admin\AppData\Local\Temp\MixPad-3148-2\vst3hostx64.exe
Size 105KB
SHA256 b3c88bfc53c136dd096f8faca32e8492fae15cf2fbdcb4d5fa7d2ace8df71cfa
MD5 27cfc4424eefa65c0188c3b803eadf6d
SHA1 16192251ef533ad5205045e531d1a0b762cd6208
SHA512 1043d02871810a7912bda0e0ae25f8db4893be5351dd66b6a583b209c0ed632a808f33071ce34c37539fcdce16b46a9c5f688b5c05f4b8f86a1c66c99675c83a
SSDEEP 1536:a4z+jDnzqhEAR7UtpibK1pDEalXIwDSn2oa4Nxvtp10k1Rl5YWwI+MQ5Nl2E5c7R:qjDnuvhMibaJEaWwu2oL7XiETwhlCl
TLSH
T1F7B3F16A86F81414CEAA1E7034F8DA361F3472F71671D9CAB21AC421CF647419B887BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antares_Auto-Tune_bundle_V9.1.0_CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K1GDP.tmp\Antares_Auto-Tune_bundle_V9.1.0_CE.tmp
Size 2.5MB
SHA256 4cfcbcffe82bc6943890fa818ded2708f46c4f85ec368de00836ac708acdb080
MD5 ebbb655a85d61e4adad34d9ade0ea184
SHA1 41d3a5ab6de2cd4c45bd9545906c53ba9eaf345d
SHA512 a84a4104356c23fa5a618368fa4ba2793435832f3eefb6b243d1513d7ac586002449f127abc6bbb3cf199a930bdd718c6d1ec273738e1d9796d423ddb312eb50
SSDEEP 49152:3g2qPtc1e5OS7bPGoUl+x/grN4azvchYk2C4:3vqPCnrN4azvSY9
TLSH
T14AC54A12B285713ED06B2B36493FC6909937BE6179368D5A6BF40D0C8F355802F3BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.dat

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat
Size 261KB
SHA256 e43a6a390b64b60dd052996de0b0344636fe40f4abf25d11ee760f0c036b887c
MD5 b350eb76d83f79324dc282c9e68f5756
SHA1 ebcbd65a04d330a56dc80589694899712e72556c
SHA512 10f7dad35dd8751702d18a644f0c4d56a7f01b78ecce50772305e673b0d851d0a9d316ab108b42b3f0ddd1f14ad5185af1bcc8a9d7abfdf1d0a136abb113d6b8
SSDEEP 3072:CZnP2bqzTeFpCRKil2v/sJJfRhzOB+Yxt1Wm3cqdZQkZ73X/u:CdmqzSFIH4sJJfctwKcqYK73Xm
TLSH
T14444932BF3504862E01AAF39C8EB3F5DEF79B6006BA2662B1650077E3D533544F36616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.dat

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat
Size 5.1MB
SHA256 6047875a9b9766a7533536b314547411c499ba461444bc833fdce37aed1103ef
MD5 3fcb73d5a32d941bf3ed803dc5094df2
SHA1 3b1330c44f66ffc3020ae6203ee39e02c6555c58
SHA512 3af5ecf43ed3cab7c953699353e3b07d1b2d284cdaf27d66b2126eda38f7b4f12642ff47178dc615b91a73201562f244e0aad0d575c2ef54341c2be08a2bb4d3
SSDEEP 98304:Zz3oXVB2M9vfFwQojCu+8Jl7kNyCA5TlCuGU1RPPg:t3+VBEjCu+4l7gyCEP1Rw
TLSH
T10D36BF12F6B0C072D0B78074C5969BB6EAB575464B3096C7A3C09F2D2F237E5CA3A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
Size 10.8MB
SHA256 22b257d233568a84f9395d7ecaf552198d00ccd05dc629c9cf1219997b2fcd2a
MD5 bf06ca071eba5db6125abef14c426c32
SHA1 0a4e0821cb9accf3640ad2639901f862a9c51955
SHA512 6ae549fcf93370abfdddf5e357cf5baf6e6a4e60b10a563e92aaf236da2dfb49811f73e81bd9cc87328b79da94208057c750c829da150977c6878376774134a6
SSDEEP 196608:rYdFtGng4gBFOnqAPDd8bIixcY49BEfmNJ0M:rOt0gBF74B8kK6/r
TLSH
T1D1B68D02F7818671E9AD17B088FBB3696739BC119BF68ACB56943D2E6C713C11C34762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
Size 2.1MB
SHA256 f49a8c781b20df58e235aa20664558689c25f2362b6082dbff685f828725690c
MD5 e8a0467ea767d6cd41967c79e851de02
SHA1 707d7ab471a5024391e38d300665beaf96e82ab0
SHA512 d37cb4ee48da6869c046ac98a0430385af6e9ccc8bce794a54f672750fb4eaf8e7e0c766f0ce52216d8aba74a14e5edbd0d670cd7473964b08093a7279e22fcf
SSDEEP 49152:JWMDkD/bUT17SQHf9cE9r74b2whwqFNRa:JWMDwbUT17SecEB74bNwqFNRa
TLSH
T15EA57D2273E28864F5F31F70593626644A79BDE09B34C9DE5A503DCEED71A40E826F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.cab
Size 95KB
SHA256 7a2425ee85a01604f9e1f1d903fb050eacc2086e0a549084380bf3ac13b84aee
MD5 f741e89e6cc89da4d39013eb36741d2b
SHA1 f6475dea544881fa69e086b9960ccd7cd27d40fd
SHA512 826b3ab2809d143198727521e632f28ebd5530e4322fa1287297e8324d090fe239f1548e3c5b13b9f900b08d25ddcbc9832f6bcf042004dc587848054c38b130
SSDEEP 1536:FvaHS6uMytrRnGwyybDtAHXNcg9gXPPbbzUIAJaFxhAOnRV1A3Q0gnq+vPDiTpGz:FyyVNtrRnGJybKH9l93PaFxCawQ07+vD
TLSH
T149A3121D9DAEF307A72EE782B6B07A5DD5FE045340B87BD78F40221E6C611C6A086C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.cab
Size 4.0MB
SHA256 256cc1cc3c0f2a8508ff61a0d571e245b88a8a278fe93b627aac98b156aefb7f
MD5 c721593f23bb66a326c93ef4b58b2892
SHA1 1a9aea149173c57db643dba8cfa52734dd67fc4a
SHA512 5e9b13c3f4c95debd9a894d59457e8d3bf839bce290e286f1c21863e9debbda14386d297628e53b635a30f1729ab54effe5629315d696c4048d2361f689b6b11
SSDEEP 98304:G+IJUqRe2A7fRtBWnS/YEgZg9XvD3qa2vW612HJzLvjuK7I9EOM5iRYD:G+GVA7B9Yfa2ucCJzjarHM5iiD
TLSH
T1EC163330C388FAB85F5926FA93B39975C3168328EE496B975360E1FB1985CB34670D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5772_1006136694\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5353d14-ae29-4859-98fb-b6d97181a5ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5772_1530329152\b5353d14-ae29-4859-98fb-b6d97181a5ab.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Accounting Software.lnk

Path C:\Users\Admin\NCH Software Suite\Accounting Software.lnk
Size 1KB
SHA256 987af60e4462fc1f233411df145fff075669f59b320ee876fc14dd4c22c835ff
MD5 6d56aee47a0f6bcaf9437de42258c082
SHA1 fec13fc96841427069a386e87e68cf9f14d6e33b
SHA512 a4ad1d68ded4ef437ec08a643f7c8f1e1e418849cd135115100d017642f35a789d4143e680c50fc3f034cccbf6617506126ce0721a5136fdc68e840f92da4a08
TLSH
T1C62133201FD72B29F2F6CE32983173176627BD01EE588D4D0142422449E3C05DC78F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Audio Editing Software.lnk

Path C:\Users\Admin\NCH Software Suite\Audio Editing Software.lnk
Size 1KB
SHA256 e2c9e4940e912b3684e2c1deeaa05d0c55343340194659e727836979413aaf25
MD5 977794ec708c91d968c2ebca2a2ac994
SHA1 19d2bdecaf11258509f7618377df21eb9530c3b9
SHA512 fc43d6cc2dc6bf533a21df5d0e5e70078a6c2e8fffdee154c9e000e8bb00a8151b8ff98c936c527d6e3c91781445ad6dc2b218735dc18a5884b2548fba40b6c5
TLSH
T19C210D201FD72B29F2F7CA72D871B31766267D41EE9C8E4E018242244DE3905D878F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Audio File Converter.lnk

Path C:\Users\Admin\NCH Software Suite\Audio File Converter.lnk
Size 1KB
SHA256 3a415da5c81bb7b8d314d9258d256280bb3ef20e3112a6d7305e4cf873891277
MD5 29b670ef2091f1fe08c2edb3fc657894
SHA1 533650dc50814152b0da8b4a3e64472e0498a840
SHA512 f10b31b858858100d3dba77736575996127fe8776fe2190e0a0b37c25d3769b9fca0fc5ce786b758539d0be11ba86f7d6059d848c5e87e98ce2d2378e5cbd584
TLSH
T1E22123201FD72729F2F2CE729871731757267D41EE988E4E018242244CE3905D979F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Classic FTP Software.lnk

Path C:\Users\Admin\NCH Software Suite\Classic FTP Software.lnk
Size 1KB
SHA256 2689f1ba7f519d795b390cb5bbbad45f22628a0ca46d7bf306814a7bd5d327cf
MD5 faf91b2426ce9dd140ca01aac5fde6f9
SHA1 977baa223b11a2e84cf3ce516896617540108f05
SHA512 ba670f375794fbd0b9de57b2b5a74c1c10899ee4cd7f76d0e6a10458b7417fef7f423252a000578453f10fe07a3e8063083397ff8ab65f253a7bc2b0f6daecc6
TLSH
T14A2100201FD72B29F2F3CE729861731766267D41EE688E4E0146422458E3805D879F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Diagram and Flowchart Software.lnk

Path C:\Users\Admin\NCH Software Suite\Diagram and Flowchart Software.lnk
Size 1KB
SHA256 6d7689b98e588aad22cda994a437d6b93f989934b3e897dc9f39367e40b18af8
MD5 1f367468cd086df87f352e91954b4593
SHA1 5eb3bc1c20c2107dfae8e5280cad1de51e2e7eff
SHA512 c17bab505765d5170bf99399fdb4cb1ee6ee87bfe9a7ebcea6202858843dfd2c68d33420325a228855a5b2a3c09c6171dc3a3f4132c66f62231c302f64cb6e5e
TLSH
T16B2100201FD72B29F1F7CE72AC6173176626BD41EE988E4E0142422408E3905D97DF6E
MD5 SHA1 SHA512 TLSH

Submit Download

Doxillion Document Converter.lnk

Path C:\Users\Admin\NCH Software Suite\Doxillion Document Converter.lnk
Size 1KB
SHA256 de4df532f92c352a9a0b0c74214dafe25c2356dc1d89ac3eb15777ea42df39b2
MD5 820d625e47fbc712e6593e6c2a4637d6
SHA1 014f8f6dba27056132a0c20d77bfce9ebdd8f294
SHA512 12022927d2af8e1d5452bce0c985c6d1ff2b2b1ad3d5e22041dfc04cb3d88eed0ffd27bcde3481d9228d4ef90a243293160000eb85accda4ca0ba5dcd9acd505
TLSH
T1FF2133201FEB3729F1F1CA72AC75631356377D41EE588D0D0146425448E3904D97CF6B
MD5 SHA1 SHA512 TLSH

Submit Download

Express Burn CD, DVD or Blu-Ray.lnk

Path C:\Users\Admin\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk
Size 1KB
SHA256 45c71138bd51950ed1bbb76b49dcf5b983b6f63eba980873d61f11c8d8f28dc9
MD5 1a90dcea2a4be213c2e01d8727885250
SHA1 8ea0dcae87de413c734e86d3d0bef890ff0aec25
SHA512 ec57d4212ae506fa24b383d1573a6715e9275ccff93f013e78331ec49aae8e9c3aecf6b9518bb8c919b38568ce94178fe469023574642c6d32dae53dbf9bde4d
TLSH
T11F2103201FC72B19F2F2CE729861A31752277D41EEA84E5E0146426409F3905D8B8F6E
MD5 SHA1 SHA512 TLSH

Submit Download

House Design Software.lnk

Path C:\Users\Admin\NCH Software Suite\House Design Software.lnk
Size 1KB
SHA256 0a744b29dce31ef2a6a90de47c8e5abd4760e4006632edcd869d560dd8500e24
MD5 b79cb72357cebad463c8b0c21853951d
SHA1 88ff0f5c383062f13238e1f54df2c4fca422d2f9
SHA512 6098d8b2b5a799809e66e8b57fb52ddfbc61f4c6ff1ca0d83e93e0b3449c35d38ff19c16641e94cbee13c8cb4c3846ba684ada8c9744a3633facc4e0840956fa
TLSH
T1722123201FD72729F2F3CE729871731766267D41EEA88E4E0246422448E3905DC79F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Image File Converter.lnk

Path C:\Users\Admin\NCH Software Suite\Image File Converter.lnk
Size 1KB
SHA256 35812ec0ca5871f02f5a19eda77918061da2bd82794acbf9f3a44e241b44568a
MD5 712ff85d07edb295176663970c03e18d
SHA1 a4c821cbf3a9e925c04bac87ff846915399c792e
SHA512 e4e6200d0c054666422a43d5b0abe1b02749f8d60d244a7fc1c834330391e66b6832a000ec92cb082e6cc8f1de13d8b6d7c2c824bfa1cbd332f49a8250910099
TLSH
T1772123201FD72B29F1F2CEB2A875731756267D41EE988E4E0142425448E3505D87DF6E
MD5 SHA1 SHA512 TLSH

Submit Download

Multitrack Recording Software.lnk

Path C:\Users\Admin\NCH Software Suite\Multitrack Recording Software.lnk
Size 1KB
SHA256 0a3107b27765906e2f2c474e3889d0e5c700c34ece97187066ba05ad5606eb08
MD5 88d93777b6252d513d91752e51617b3c
SHA1 8be2e1d9581fee6619a576754f4450d3c2a94563
SHA512 c553e15ff5a1f2c857d2d1d492abdde5413ea19ed9e13a8bc16da5f200321b087c177013834d8a6faa74e62a8064e4a4b8f336290424ea238839e9b75b8e9934
TLSH
T1F52100201FD72B29F2F2CA729871731766277D41EA588E4E018242284CE3905DD79F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Photo Editing Software.lnk

Path C:\Users\Admin\NCH Software Suite\Photo Editing Software.lnk
Size 1KB
SHA256 be785f6a2dc0493ba23129574697c40245edf349b478f099a9169be7d2c399b3
MD5 a91bb244576a9aeebac01522da866531
SHA1 8b58799c9e6ffb00dda406d5f9d2443b192b749e
SHA512 f0d8f7134d87ad3d4d6f330f7f75f7936127a5ed308f8bb386a23f0bdfe4401e154d5185646b0c41b59f652a5188c3db6c4a5097eff92032a104207fb83f3554
TLSH
T1C92100201FE72B29F1F2CA729861B317622A7D41EA588E4E018242280CE3505D879F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Slideshow Software.lnk

Path C:\Users\Admin\NCH Software Suite\Slideshow Software.lnk
Size 1KB
SHA256 781773b2012b857d12e6fbc1843c19f0e7ee62f073efee64431fba66ef544d35
MD5 601526507cc1b9ffd7fdfc2be7a61885
SHA1 0487b1b5f215191b4fb85fda2dbeeb9555c3cea3
SHA512 938d3b2fcc56d01373c70e3176632fceefc8ab5a56c5458dfa72907f5ed05d340a9b3dea72d759b402c9dd59b264a527af61d8fb1000711a2f1acdb1c7ba8cba
TLSH
T1E62100201FE72B29F2F6CA729871B31766267D41EE588E4E0182426848F3905D878F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Text Expander Software.lnk

Path C:\Users\Admin\NCH Software Suite\Text Expander Software.lnk
Size 1KB
SHA256 4c3c0bb612b55bc707ace73fd0d399e7b90a89e70d4868e088c99aa081197e1e
MD5 3532a8fefcaaebff7e762c1314d27956
SHA1 ca5f7f389e1564baf51622153d5f93753c309a9c
SHA512 d069078ae439e181f290abff19a1862f610514a12bbeac798c81fa221423662b593aa9e55a4ad1e2926073d3f77ba26a90015737161983e96df9eeec8a7fb999
TLSH
T1FC2100201FD72B29F2B2CE729871A317A6267D41EEA88E4E0142422448E3515D879F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Transcription Software.lnk

Path C:\Users\Admin\NCH Software Suite\Transcription Software.lnk
Size 1KB
SHA256 e93249138814baa1231f242663eae00ed7c33e3031987e8194ce4b299ed1f7dc
MD5 e44150f3b3bead2a1875e965e5e8813d
SHA1 9a4b403321fba57f739c6d68e66dd9a6ef76f75f
SHA512 8652b865b31d901aac0f6587f48da94873fad674116ded501006cc98348659b9727bac30a46e7c448734838749046f9efc1165a2f12c9855fc015104fbb79a07
TLSH
T1FF21F3201FD72B29F1F6CE729871731757267D41EE588E4E0182422448F3905DD79F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Video Capture Software.lnk

Path C:\Users\Admin\NCH Software Suite\Video Capture Software.lnk
Size 1KB
SHA256 9800e615319a7ddfc9ec0d7c47adb6da892df396f0ad4e4c48f350561e367d50
MD5 9001a2a38c8f7d5444f75233b52826f5
SHA1 d2afe5d618c2ff32262e99fc4d61415183e70970
SHA512 65ef785331824ab0c6f89e36389da2aa98d4794c7cc85400e1c678e79ea51a5ca8979a35b27cd1c0098c33fbadd4d85161d3e916ec14b851f9f3553d1001d5de
TLSH
T16121F3201FD72729F2F7CA729871B31766277D41EE588E4E014242284CE3905D979F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Video Editing Software.lnk

Path C:\Users\Admin\NCH Software Suite\Video Editing Software.lnk
Size 1KB
SHA256 c49780fd32bcc1051b6d422e422040d324c74e41092b1606ce85fe96c85f6ad7
MD5 82f0c7514fa9e1c66d8c77ca1913a196
SHA1 7d83c2fd13fbe3688b35d14be3d0abe92976c313
SHA512 66b3e402a7846a0b14febc6ceaf27efa941d0607f9787ac96da08a39e1ff65964ca7f09a4f4f319100fd5759f21a940015bffb8c2feeffe579e49b13d65d6d31
TLSH
T1852100201FD72B29F2F7CA729871B31752267D41EA588E4E018242240CE3505D978F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Video File Converter.lnk

Path C:\Users\Admin\NCH Software Suite\Video File Converter.lnk
Size 1KB
SHA256 dc5746c6e748de08029b7cb2015cab83b9cf900bd5573e31a7977caee816f9d8
MD5 0e9b562e94340e4293ac1829e38a4b20
SHA1 0d12f1ff99fafcbbbe5c232da4096161fc6605d9
SHA512 51c853453921067ebfe952f61e32d56b41d2ac79278581b4ae409919b46001d3608c5c9c200eba8caa7e45872647fa2509a9a479914338d22fe3b77e5ec6ed41
TLSH
T1B92123201FD72729F2F2CE72A875731752267D41EE984E4E0142426448E3905D878F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Zip Program.lnk

Path C:\Users\Admin\NCH Software Suite\Zip Program.lnk
Size 1KB
SHA256 09ab59f9cfd3f78826d9afccff665517e4fa6db1f09e11203b5ad22c8cefd97c
MD5 a9a0336c85fbffef87748e9b1544394b
SHA1 8d734e3b974ccd0d16cfdde59c78cc715100b5c7
SHA512 c04d647afb40c66b9fa3d71aac9119dcac4c4d78a16174185a957b740a5a169852c95ff19200d598d6d67223e79b5d0b09857fe930396ca222872eab7b73a1bc
TLSH
T1B52123201FD72B29F2F2CE729871B317562B7D41EE988E0E0186426408F3805D87CF6E
MD5 SHA1 SHA512 TLSH

Submit Download

NCH Suite.lnk

Path C:\Users\Public\Desktop\NCH Suite.lnk
Size 1KB
SHA256 bcfe12b08b631fea17027ff6486a538b7be5abd751184f7d955443afa3d73640
MD5 cc10795f053b5135494da90c2388ec16
SHA1 bae8829423af1ece12699376b55df934d6845178
SHA512 936a1356c532d769960fc4f2aa07ba4148cdd1f380657e6c7d937145f2ef36b84b6ab502140688e319c4999d3e6c34c12980310a9c0abf990ed2302755bb8810
TLSH
T1EA21DD302FE70B29D3F3E57588B13201AA27BC81E6A48E4E018143189C57602AC1BF1A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2900-1827-0x0000000180000000-0x00000001848A2000-memory.dmp

Download

memory/2900-1819-0x0000000180000000-0x00000001848A2000-memory.dmp

Download

memory/3236-1775-0x0000000180000000-0x0000000184A75000-memory.dmp

Download

memory/3880-1-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/3880-7-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4208-1581-0x0000000006E60000-0x0000000006EB0000-memory.dmp

Download

memory/4740-1307-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4740-1061-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4740-526-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/4740-5-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/4740-9-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/4740-8-0x0000000000400000-0x0000000000683000-memory.dmp

Download

memory/6552-1787-0x0000000180000000-0x00000001848A2000-memory.dmp

Download

memory/6552-1822-0x0000000180000000-0x00000001848A2000-memory.dmp

Download

memory/6552-1830-0x0000000180000000-0x00000001848A2000-memory.dmp

Download

memory/6552-1834-0x0000000180000000-0x00000001848A2000-memory.dmp

Download