e8b8490a1e1dbb059a2ee4613ecd31195f24331143cf1f212997375da1a14d1d

Analysis

user interaction
yes
max time kernel
74s
max time network
77s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoundBoardPro-Setup-1.1.exe
Size 78.7MB
Sample261104-x7azeacy71
SHA256 e8b8490a1e1dbb059a2ee4613ecd31195f24331143cf1f212997375da1a14d1d
MD5 217478ed38e2867177db30bf05f7f715
SHA1 39df91e908bf324c3020fdc57da0eadd692fb356
SHA512 e29349fe3a7e6fae3f5db6caeb9c85ff59ea916f86ad2507017d42b8ca01cb657724e864ea52cdf5184b18bba8e7f76fdbce63902b97b8da65e43809a934efaa
SSDEEP 1572864:RoNWkE+itiGav7oLAI4FIdMKEUHLlrljHBb3PIJajuf1ef6JKWU77mLW:RoIkpit9aEcxS2Dil9jPif4f6iSLW
TLSH
T16908333FB29FB139F876093B7ABAA510153B717151128C419AF884ACDF164B12E3F687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5340	SoundBoardPro-Setup-1.1.tmp
3692	SoundBoard Pro.exe
3720	SoundBoard Pro.exe

Loads dropped DLL 43 IoCs

pid	Process
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4168_954399581\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SoundBoard Pro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SoundBoard Pro.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoundBoardPro-Setup-1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoundBoardPro-Setup-1.1.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3664-0-0x0000000000D20000-0x0000000000E02000-memory.dmp	innosetup
behavioral2/memory/3664-175-0x0000000000D20000-0x0000000000E02000-memory.dmp	innosetup
behavioral2/memory/3664-216-0x0000000000D20000-0x0000000000E02000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Colors	SoundBoard Pro.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000645dbb9b14004c6f63616c003c0009000400efbe2b5d627c645dbc9b2e00000090000000000002000000000000000000000000000000005375004c006f00630061006c00000014000000	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c004346534616003100000000002b5d627c120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5d627c645db99b2e0000007c000000000002000000000000000000000000000000b98623004100700070004400610074006100000042000000	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	SoundBoard Pro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	SoundBoard Pro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5a00310000000000645dbb9b100050726f6772616d730000420009000400efbe645dbb9b645dbc9b2e0000005bc4010000000d00000000000000000000000000000000537500500072006f006700720061006d007300000018000000	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 6600310000000000645dbc9b1000534f554e44427e3100004e0009000400efbe645dbb9b645dbc9b2e0000005cc4010000000d00000000000000000000000000000026486a0053006f0075006e00640042006f006100720064002000500072006f00000018000000	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	SoundBoard Pro.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{E0F4ABF0-B5AE-4F11-A17A-14DC455CA78B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	SoundBoard Pro.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData	SoundBoard Pro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	SoundBoard Pro.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	SoundBoard Pro.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3720	SoundBoard Pro.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	SoundBoardPro-Setup-1.1.tmp
5340	SoundBoardPro-Setup-1.1.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3720	SoundBoard Pro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3720	SoundBoard Pro.exe
Token: SeIncBasePriorityPrivilege	3720	SoundBoard Pro.exe
Token: 33	3728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3728	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5340	SoundBoardPro-Setup-1.1.tmp
4168	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe
3720	SoundBoard Pro.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 5340	3664	SoundBoardPro-Setup-1.1.exe	88
PID 5340 wrote to memory of 3692	5340	SoundBoardPro-Setup-1.1.tmp	89
PID 3692 wrote to memory of 3720	3692	SoundBoard Pro.exe	90
PID 3720 wrote to memory of 4168	3720	SoundBoard Pro.exe	94
PID 4168 wrote to memory of 1304	4168	msedge.exe	95
PID 4168 wrote to memory of 4884	4168	msedge.exe	96
PID 4168 wrote to memory of 3360	4168	msedge.exe	97
PID 4168 wrote to memory of 4884	4168	msedge.exe	96
PID 4168 wrote to memory of 4884	4168	msedge.exe	96
PID 4168 wrote to memory of 256	4168	msedge.exe	99
PID 4168 wrote to memory of 256	4168	msedge.exe	99
PID 4168 wrote to memory of 6024	4168	msedge.exe	100
PID 4168 wrote to memory of 6024	4168	msedge.exe	100
PID 4168 wrote to memory of 4468	4168	msedge.exe	101
PID 4168 wrote to memory of 6024	4168	msedge.exe	100
PID 4168 wrote to memory of 4468	4168	msedge.exe	101
PID 4168 wrote to memory of 4468	4168	msedge.exe	101
PID 4168 wrote to memory of 2320	4168	msedge.exe	102
PID 4168 wrote to memory of 4976	4168	msedge.exe	103
PID 4168 wrote to memory of 2320	4168	msedge.exe	102
PID 4168 wrote to memory of 2320	4168	msedge.exe	102
PID 4168 wrote to memory of 4976	4168	msedge.exe	103
PID 4168 wrote to memory of 4976	4168	msedge.exe	103
PID 4168 wrote to memory of 1116	4168	msedge.exe	105
PID 4168 wrote to memory of 1116	4168	msedge.exe	105
PID 4168 wrote to memory of 2604	4168	msedge.exe	106
PID 4168 wrote to memory of 2604	4168	msedge.exe	106
PID 4168 wrote to memory of 2604	4168	msedge.exe	106
PID 4168 wrote to memory of 3324	4168	msedge.exe	107
PID 4168 wrote to memory of 3324	4168	msedge.exe	107
PID 4168 wrote to memory of 2336	4168	msedge.exe	108
PID 4168 wrote to memory of 2336	4168	msedge.exe	108
PID 4168 wrote to memory of 1496	4168	msedge.exe	110
PID 4168 wrote to memory of 1940	4168	msedge.exe	111
PID 4168 wrote to memory of 1940	4168	msedge.exe	111
PID 4168 wrote to memory of 244	4168	msedge.exe	113
PID 4168 wrote to memory of 244	4168	msedge.exe	113
PID 4168 wrote to memory of 2424	4168	msedge.exe	115
PID 4168 wrote to memory of 2424	4168	msedge.exe	115
PID 4168 wrote to memory of 4888	4168	msedge.exe	116
PID 4168 wrote to memory of 4888	4168	msedge.exe	116
PID 4168 wrote to memory of 4696	4168	msedge.exe	118
PID 4168 wrote to memory of 4860	4168	msedge.exe	119
PID 4168 wrote to memory of 6048	4168	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\SoundBoardPro-Setup-1.1.exe
"C:\Users\Admin\AppData\Local\Temp\SoundBoardPro-Setup-1.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\is-UV6Y7XKBDG.tmp\SoundBoardPro-Setup-1.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UV6Y7XKBDG.tmp\SoundBoardPro-Setup-1.1.tmp" /SL5="$50042,81299104,868352,C:\Users\Admin\AppData\Local\Temp\SoundBoardPro-Setup-1.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Users\Admin\AppData\Local\Programs\SoundBoard Pro\SoundBoard Pro.exe
    "C:\Users\Admin\AppData\Local\Programs\SoundBoard Pro\SoundBoard Pro.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Users\Admin\AppData\Local\Programs\SoundBoard Pro\SoundBoard Pro.exe
      "C:\Users\Admin\AppData\Local\Programs\SoundBoard Pro\SoundBoard Pro.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vb-audio.com/Cable/
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x350,0x7fff2940c188,0x7fff2940c194,0x7fff2940c1a0
        6⤵
        
        PID:1304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=848,i,4645080686580897542,5541927811235265840,262144 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        6⤵
        
        PID:4884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13332750926949781212,3298867210485676614,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,2940702278075748827,10906579010608230428,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:13
        6⤵
        
        PID:256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,9573316974346232300,14449608373197616929,2097152 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        6⤵
        
        PID:6024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,2394335735898555443,1040260540647225890,2097152 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        6⤵
        
        PID:4468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,10430345729910921974,1480436352263380014,2097152 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
        6⤵
        
        PID:2320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7431397793973404558,14732238971720450483,2097152 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
        6⤵
        
        PID:4976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,273417540844400505,13511906707615552003,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
        6⤵
        
        PID:1116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5448,i,6497154486348033996,11017114131803574208,2097152 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
        6⤵
        
        PID:2604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9139950193207054560,6062447431352777856,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,3711384272843897335,6748161601434960833,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
        6⤵
        
        PID:2336
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14806629889110610645,11416000968381458426,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
        6⤵
        
        PID:1516
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14806629889110610645,11416000968381458426,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
        6⤵
        
        PID:1496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2014432463765604818,10364972723107923031,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
        6⤵
        
        PID:1940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3517454762851722826,13521827931701234393,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
        6⤵
        
        PID:244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,13485764747870612308,16289888713233969149,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
        6⤵
        
        PID:2424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,13995193540526296393,9312975325285448488,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
        6⤵
        
        PID:4888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,14496939814427741509,16871254597300970003,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
        6⤵
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14707937198402215787,3611594011810861251,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,7069285171066538807,10776668372179672733,524288 --field-trial-handle=2264,i,9391673804953129225,17273333700237732899,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
        6⤵
        
        PID:6048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

215bbfed-12ec-4e74-a1e9-3fe36e826560.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\215bbfed-12ec-4e74-a1e9-3fe36e826560.tmp
Size 38KB
SHA256 ca4e45b4910e43777826223de7d27bae867dd80a68d47065d4be1959191f1aec
MD5 0d46cbeb58b47a1c79fe7ee563b23f46
SHA1 558d1dd55593cc32e1e4337c1a1fe1d0613c7e15
SHA512 585665da011136143415f0509cd348ff4ea340641a7ac8514be76e442b2087c0d7fa7b95ead90a5b7d78b2e58008e87263a52f732d5aaf5ac07de70ccbf2e1ea
SSDEEP 768:S/UxvxjgC+k3cq5ybNbwbrOeRFZD1fTos7RCO/+Pu:XZj3+k3cEYY1fT/RlKu
TLSH
T1DD03BF39F8E89D338CF6E244B24AB78BBFF015B389C51D9849D95E0E058779D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39913028-954f-4e4c-b115-c3dea3f362b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39913028-954f-4e4c-b115-c3dea3f362b6.tmp
Size 33KB
SHA256 61103b1bc5885a91434aef5aee271c192b468ff4fbdfdb25830315970dc5291a
MD5 6db64233ec330c89dbc7faaead41aeb2
SHA1 073e1b220eec30169fa8257a336a3af3df9075bd
SHA512 d3010d4f14b7b7e6d738b50aa69f446f4c28cd01c89ed57d4064a16661a1f9070dbeb608b29d154b711b5a891fa1742aabc2557e5ed0580703a6fdd4ac6d12d3
SSDEEP 768:Md3ecPybNbwblOeRFZD1fTos7RjOE75EeL9:Md3eEeY1fT/RakBJ
TLSH
T114F2AE35F8D59D334CF6E240F24A7A87BFF455A3CDC9098499D85E0E0487B9E274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f5e7e5d-20a4-46dd-a26d-4f3d4576309d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f5e7e5d-20a4-46dd-a26d-4f3d4576309d.tmp
Size 33KB
SHA256 25747c8308befcf4aaa555cef3fe71f36988246e3fc6f69d4c508d121864ae98
MD5 419dacba7c6c45ecd774ae0996cc08f6
SHA1 20d65c559ae89a0c8897749fd1a4bb998d59336c
SHA512 da3c2bddfe9e3ca517f6541da482a0550597141015f957e0a7cba62c8a29da792b4b273fd72629fb3dc8cb1a61d8a74fb3c90cb7f85bd2cdbf4b6f8f81a3f6a5
SSDEEP 768:Ad3zoPybNbwblOeRFZD1fTos7RjOE75EeL9:Ad3zgeY1fT/RakBJ
TLSH
T148F2BE35F8E59D334CF6E240F24A7A87BFB05163CDC9098499D95E0E04C7B9E274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

0ec3dea6-884d-4c0e-b453-f454a344b7d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ec3dea6-884d-4c0e-b453-f454a344b7d4.tmp
Size 12KB
SHA256 e0fe8d577bd6f8cfbc0ecd5685fbf89f9291875bc1fd0ec194e7364d92aa80bd
MD5 77810c89addd2b2b2aa5577b932e4577
SHA1 bbaa725761aba822f3eda82d48903057b8b366c7
SHA512 537bcc377792af6f8f74145c798d416fe4f1de54f2d08f76669b5963e5919f62f6616bf2fe58cbc5ac99125b98f9c916ee84f9085f1c1290b869e60141d5c5aa
SSDEEP 192:sxRDRWCb/fLscmZL8r0nzoA8pkW/g6+WNSRp/eI45rI/VIhJtYDB80+G4IgVvHJ:sxRD7b/fLscQY3H/5i/e3rIVt6Np
TLSH
T11D42C856ED68A93B5CCBD219FA55BF17D2F91022A4901E48BBFC891C04E76DD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13274587-9e67-45e4-b6ef-652ea566453e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13274587-9e67-45e4-b6ef-652ea566453e.tmp
Size 12KB
SHA256 299d22356aab547ca0ccfa34029af8da2abea1b11b7b33185ff2445236d97042
MD5 e25ec4ad0aaebb5a1ec9f4539ad38f2b
SHA1 513f26ea63b5f2c7717332c144d9391737a37cf7
SHA512 edb323733d52761544287ef237dd0072e4118c0397e77838758eb21aa2006beaa6fe250de777c3246dbd7e820ca60ae3c044fe9e8e5902374c5c99fca3bc21a2
SSDEEP 192:sxRgRWCb/fLsamZL8r0nzoA8pkW/g6+WNSRp/eI45rI/VIhJtYDJQ0+G4IgDXvHJ:sxRg7b/fLsaQY3H/5i/e3rIV16zp
TLSH
T14052C856ED68693B5CCBD219FA55BF27D2F9502294901E48BBFC891C04E76DD720380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

378d136d-7095-45fc-9dc0-8f2b76745fa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\378d136d-7095-45fc-9dc0-8f2b76745fa3.tmp
Size 29KB
SHA256 ef0b77a42988cf7322ebd7684e4f4d62beee2e9289318e21f88eda57e7f40991
MD5 aa3dfb1a9dab72a49188871fcd2a2076
SHA1 84367a205bcf505d1c38073985377a062b356110
SHA512 e03f43dfd8257e0dd6408b2caf733e834348d79d5ec7370bf1a98ac40d21bbe7de4764ffcd63a1b23de36e0ccf37c8deb4e9ce9c7c9f6661466c47455590c951
SSDEEP 768:SzYbn57pLuLj7UWgasfM68F1+UoAYDCx9Tuqh0VfUC9xbog/OVQYP8WSMroGxzLY:SzYbnPEj7UWgasfM6u1jaHYPtSXgz0
TLSH
T18DD2DA7B640CCB7E4F804ADDEC197A9E6D6802CB96D8C98447FA941C03C6BEF511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 221KB
SHA256 e30e4d4323d87473d3dc6e87c82185dcc5e672cd4254150b10ebbe4037754908
MD5 e6dd76bffc8544196f404f8d23a11543
SHA1 ebd476526a1c5c7d3727d8adfdac62c151a1e822
SHA512 f60a9774283fb7b88efe945da7aebae96e08c90c34998b9d82bf4c5ce1fbbf363b1b79d19d7688f3487c8eb6f2f9f3c3e2c020c68960ed24be0328779894cb8f
SSDEEP 3072:VaiyiIh6ELxNkvRXpifyQB6h8O+0S3cP+eoC/FVd3i0p9s5Vb0Sgloe2BHa80Hsq:V97VexNkvRXpifuH+0SsPewRy5pgeSJ5
TLSH
T1852423BA716DE746AEDE9682A07BEE65330314F802F4CD81F0D868D99C07FA017C59B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 24KB
SHA256 f952164b400bc7e54d850b7b635659634e5476118e92db71d890d7cb3746a752
MD5 2c9dc0d986c40dca6ad876df9f82c30f
SHA1 e2b0e066cebafb885714abc5f1c132c84b3be149
SHA512 5d124b2ec071470c3f1e0cac833ce68073d399e5120ae21a954a0ba4e8ef369d74650deeb427b86f9915c9b7eeed41e3f0f6637a641084570c6729327c411d96
SSDEEP 384:Qwj0y+HsS7Slm4o44Ad7YK0kwh+IDJHNpLyphVwpthFvamWW6tQ0MqMbC2axe2z+:QwYevo4/d760IlHNpWpPwoW6tjvX+
TLSH
T1D6B2D06879C6787CB89214803CF1D94FF9EDB00F8925D167B435E24AB3E5006E9FE498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 23KB
SHA256 ef20463543b78cbc10e1d33fdaf6602a0cab1aaca780c96c9d1c99ce36746d58
MD5 97c971c47d54009eac98e2db4d3325d7
SHA1 4f0580a8ed2ed5221abfb2443e193d9f53f881d0
SHA512 38c46ae7debb6a67000361552c5a7f694c42baa59cf69074f32e76284337fa05c6eb37ec8a7834ee3110b0f1f0f2e523844917282abb66180de6b67c5dcb420e
SSDEEP 384:n1I6eETe+mmAJYKgFFDV0hE+KqFlafXnDwvk98HJyyUfC5xGwdI8LVdJJyscn8s:OdEq+FBdqFOEBJxUfCxdJksm
TLSH
T18EB2F10C1E3043ABF03F21055146DF4D6AF5CABE8F1D8ABA50B2B4E7167B8193495EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76016a120468e5f3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76016a120468e5f3_0
Size 336B
SHA256 bf0f89904fcf13d7031f6ec35c0a1e40ca0c7d3618bcc5238027725f4a04714b
MD5 3f829e296718f9e3935bd50c2f913f15
SHA1 e6a08fdd9a849575090df0fd8a0bff537c578e7f
SHA512 4391bc522d9c10e8530ff2f24f7b9cf6384fa8f4d4f42f9fd541aa6e6031aa67028db9d4e3911aca71dc3bc50d04a18a72f1945e3453fa276ce9c4bae745bf27
TLSH
T1FEE02D2301B088CCD16D10F888AE100C7B0B408484CAC8F36890A19A71AC8B1BA1AB21
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 063dbef190714e1090cf6a35fa9de1208f9285c3b5fbff3442b8ec7216591391
MD5 c4fdb9fb002d4ef5990fbd6834257293
SHA1 46f267da26dbce32d9e63737c1f8524451652949
SHA512 a555e80f5fd399e28b239975661d1206e9d6f50ead86b0f39bd80b3d21d16fbc27d30313ca181931c838bd1aa35c5b3c8704655716e6605b8f25fd3803ed8a05
TLSH
T1E741FC48FFAC64E6F79A053150CA3707F634ABE1C9CB1F5A102CD5FE5B0672002803A6
MD5 SHA1 SHA512 TLSH

Submit Download

e32385b3-7170-4371-a876-a9b072f992f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e32385b3-7170-4371-a876-a9b072f992f5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

2485558e-da17-4e30-906d-b6cc467a7e40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2485558e-da17-4e30-906d-b6cc467a7e40.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

86d04887-8511-463c-aa75-5445b976e669.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86d04887-8511-463c-aa75-5445b976e669.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1e9e95d437a7a9c845fb331121d94f022338212de9305b5f5d4edd6705f1bfdd
MD5 0cfa795b3255cfb825858ce90794434a
SHA1 728da9e1aa2d71a5fab039c9f5907214eab75c0c
SHA512 d2594a81f42a17c6a1e1d465b3bd23617b2d8b70c78df3e0de08a43779b80a6f3bcacf5ce1bf8ce514ddb56b6c6472887fa6102bf32554d33af50f2d92533a01
SSDEEP 48:KYfIlKI8MHyNfIFKc0YsTI1KEsQryVrI9KQ0okK:KYfKKI8u+fGKc0DTqKEs+GrWKQ0TK
TLSH
T125C1C0107A7E020039BE290981B4D72F525277737559EA3B3FBC50A59A67E086DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 97a82710cedbef4e326747cf8f9e22032363e17e9024d2d787d842d44d3b4518
MD5 a3df2d764eb11d6e6de5bbba20aa5348
SHA1 81011b64c557688a47770298d320426b2b148a8b
SHA512 441459cec2652b201e24c8ed1c17e9cad9dec4d25ffadd6f0cc57c78b99bb5a1a871bd62aa8ded5a68ce8bcc823c9d469c7c9df4c9ac6d30facfaf14630f8309
TLSH
T193C08CA7102008EA0BB06AE13020B20DC02B8F084CCCCDE8A208708225B8A234C42860
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 152B
SHA256 7c87516f1ac889103e1e35c7930f12ab93e267c46adc08a20830e1f452812035
MD5 ca136be76bae512f213ddafb3f4a894d
SHA1 e6d49595453cd9425942f9f19b849d86a1385e40
SHA512 32c24b41afc4109d181456804278ee3b7ea639f10d14994b98f07ec68936c657de24b5d84228794d5f9463bb59f4b3719be61efc021946bf4b0687ab44d1171a
TLSH
T1C1C08CE7111048DE0BB0AEE43120B20DC01B83084CC8CDE8A108604219B8A230843960
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aa006ce1-1d18-4f1d-b2a1-b9c2e8935fda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa006ce1-1d18-4f1d-b2a1-b9c2e8935fda.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c5188bb2-f5b2-4bf4-965f-58d620fe1d2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5188bb2-f5b2-4bf4-965f-58d620fe1d2d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec90e1d2-7753-4260-aaa7-8b9b9316ee8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec90e1d2-7753-4260-aaa7-8b9b9316ee8e.tmp
Size 12KB
SHA256 31d3406c43caa6e967372b35a05e167249c71e6ed7dad130c9291237cc9da2da
MD5 157e94f4caa4f3cdb22016de8d40b06b
SHA1 e992b194caa6c96e9f35e7d04cce33af047b8008
SHA512 66917e80b0055f20a08d4506a75f6c54b5a71c2a5c2d2ae1db9c902e63d100bf71a056f123e9131ebfea366fcfee426c8a03d85f9c98e4547f2a41e1beaf8762
SSDEEP 192:sxRgRWCb/fLsPmZL8r0nzoA8pkW/g6+WNSRp/eI45rI/VIhJtYDB80+G4IgDtvHJ:sxRg7b/fLsPQY3H/5i/e3rIVt6Zp
TLSH
T1CD42C856ED68A93B5CCBD219FA55BF17D2F95022A4901E48BBFC891C04E76DD720380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a657d5c1-6cce-4d11-808f-e39263c1fe31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a657d5c1-6cce-4d11-808f-e39263c1fe31.tmp
Size 37KB
SHA256 733bde692663eab91ae0e35267b4c89d2bd9735b7f43f864edf3ba92ffc98749
MD5 916378d2529931221275d1758f617664
SHA1 db6d853c8dab1278a0fb76e18dfc1bfa1d6ac642
SHA512 6ad1b1c350e0c1e8bb28a72ea94dec2c3339ca3f9d99cef0ede069456038f2bb124c95819f0d018aaaeac2ebe960c6ebf08515dedd9d5204546d2df4dac1c4f3
SSDEEP 768:z/UxvxjgC+k3zxpybNbwBOeRFZD1fTos7RzE/+Pu:GZj3+k3zP+Y1fT/RoKu
TLSH
T11F03BF3AF8D86D338CF6E244B20A764BBFF415B399C91A9409ED6F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfaa8266-deb8-475b-9b54-2f3072900bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cfaa8266-deb8-475b-9b54-2f3072900bf6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

89f27ba4-df1e-4e2f-8ba7-d341b96cc096.tmp

Path C:\Users\Admin\AppData\Local\Temp\89f27ba4-df1e-4e2f-8ba7-d341b96cc096.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\PyQt6\Qt6\bin\MSVCP140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\PyQt6\Qt6\bin\MSVCP140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\PyQt6\Qt6\bin\Qt6Core.dll
Size 10.0MB
SHA256 39175459c4837c8cc0f709a637fb6eadb25d696785109c8393559ec876f02703
MD5 6738e0873f704de52e7669981f4d27f1
SHA1 94badebbd0922975a6d73cbfb99eae116cad68f8
SHA512 dd78369dd1ed70f1bfc5a93c604a082693f0a8fb27f5873f2fffa66c45f450ceb42f939d5e9de9ab1139cda1faf9d3e0172353dd9e2128954fb5b19c4007cf64
SSDEEP 98304:hCY1zeqYZypgOaKFdu9CwJsv6trYlJMAhA/3S:r1S0yKFdu9CwJsv6tr+SAhA/3S
TLSH
T17BB62A1766FA0141F5FBD634CAB65122DBB37C86673196DF025822291E337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\PyQt6\QtCore.pyd
Size 2.6MB
SHA256 e1f485f6ed7357874309f468b34886ff55853f156712555e2cd5a9611cca17e7
MD5 3f8e9a7b1ec6022c58fe293e5467330d
SHA1 dcd458818ac1c53f23224f3de4b301dbe3190111
SHA512 bc3daeb631cc97b9af138adf3e549dfe53db57c75549164e8bd9aa44f51551d185bdf9fe6ab62603aa4ab36e42dcc468aec4ce54118647b6a43e08d74983b5bf
SSDEEP 49152:6xcv9L0kVlvXuO/12TDuUAbiOmVRUAKZGrXynlKC6OQav1aUH/WbRFtPHzd33Dpa:tvXuO/12TDuUAbiOmVRUAKZGrXynlKCt
TLSH
T1ABD51893936450D9C1EFD63AC91B4A0EFAF230500762A7DF46744B992F27BC656BCB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\PyQt6\sip.cp312-win_amd64.pyd
Size 108KB
SHA256 0c7c7abf5a9d1cef66c6b566a74c1ae38bffa7e1ab4b3365fc0085f2b191ee77
MD5 022e49df77c967852b957edb8d506697
SHA1 133178faa03247a5349bd6155658ddb7ddf99e79
SHA512 0c0c353bade6af72d95f7053cda8c892d96da6e0f5426f156441efea244e54f9478f3324c190fc26343b8e60e93f328855b39bfa4631c2e50b80a2949f16b017
SSDEEP 3072:i0fruqnnBpr0v+wSD59SqWLwtzMBtod/Z7Vb:iaiLLSLOY/v7Vb
TLSH
T135B3295A33D81085E6A691BCC9736517D3B2B0A02B1167CF01A0C75A2F97FE63EBE741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_bz2.pyd
Size 82KB
SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
MD5 fe499b0a9f7f361fa705e7c81e1011fa
SHA1 cc1c98754c6dab53f5831b05b4df6635ad3f856d
SHA512 60520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742
SSDEEP 1536:ZWNz7JrA+VLsS53XtGHagwIF27YuLw8emTayR12FIvCVv7Sy+xJ:0Nzdb53XfoxKrbTBkFIvCVv4
TLSH
T161838D53E39566F5F86F80BA5AC10366E731B954075083EFF348C2692F02F826DAC369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_cffi_backend.cp312-win_amd64.pyd
Size 177KB
SHA256 9af5e4f68a41f26b726f2e9424f9d58a4f5666189f6a48be95f406b257102aec
MD5 507d7acaac822c99f2f574d354af43b0
SHA1 bbe267010c80e0988937d0cb35852081dcbd3395
SHA512 a2236f07849144bf6842c3a48f5d816944d5505168b11edf1803ac05140c1de9af8321777e94dac0babbd26a315d902bfe5e297b1ee56c69230c7314c4fb8136
SSDEEP 3072:knXfJh2GStDfSNvGh+8JYCJ/QXIlv6g6g0h3Vcv2dxQsGsdwofbP7clSTL7Ku3AS:knxvGhD0uv6g6g05Vcv2JGqHfbAlSTLt
TLSH
T19E046C5A329C11B6D5A2517886579B43E3B3B421170197CF01B0C7B62F1BBEA7A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_ctypes.pyd
Size 122KB
SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
MD5 302ddf5f83b5887ab9c4b8cc4e40b7a6
SHA1 0aa06af65d072eb835c8d714d0f0733dc2f47e20
SHA512 5ddc2488fa192d8b662771c698a63faaf109862c8a4dd0df10fb113aef839d012df58346a87178aff9a1b369f82d8ae7819cef4aad542d8bd3f91327feace596
SSDEEP 3072:4LIBXrBDuYifTbergyzjsckxf/EfCODh1NlL5IvLPJjL:XBbBDuBf2HfUxf/EfBDn0
TLSH
T124C36C1B739400A6EBA35179C4B32E17D7B1B41B171093CF12A4C69A2F637A36E7E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_hashlib.pyd
Size 64KB
SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
MD5 0abfee1db6c16e8ddaff12cd3e86475b
SHA1 b2dda9635ede4f2841912cc50cb3ae67eea89fe7
SHA512 0a5cae4e3442af1d62b65e8bf91e0f2a61563c2b971bbf008bfb2de0f038ee472e7bfcc88663dc503b2712e92e6a7e6a5f518ddab1fab2eb435d387b740d2d44
SSDEEP 768:mHhSlKxOZdShtmgHbGmZOEoSK3Ic0V3QBdIvOI25YiSyv/AMxkEU:CxO3I17DZRoh3Ic43WdIvOIM7Sy3xg
TLSH
T1EF537E0AA69144A8C9778178C8A35F57F9F2F1411B10A7EF4368C28D2F237C3A6BB755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_lzma.pyd
Size 154KB
SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
MD5 e3e7e99b3c2ea56065740b69f1a0bc12
SHA1 79fa083d6e75a18e8b1e81f612acb92d35bb2aea
SHA512 35cbc30b1ccdc4f5cc9560fc0149373ccd9399eb9297e61d52e6662bb8c56c6a7569d8cfad85aeb057c10558c9352ae086c0467f684fdcf72a137eadf563a909
SSDEEP 3072:kf7P77jrFDn7NjQDRX17znfV9mNoHnIjN1VbHNiFIvZ1AB:kf7j9OD9YOH+bHNiJ
TLSH
T173F34A96A394F0E5F7628C78D6624F57E7F5B809032092DA01CC876D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_queue.pyd
Size 31KB
SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
MD5 941a3757931719dd40898d88d04690cb
SHA1 177ede06a3669389512bfc8a9b282d918257bf8b
SHA512 7cfba5c69695c492bf967018b3827073b0c2797b24e1bd43b814fbbb39d1a8b32a2d7ef240e86046e4e07aa06f7266a31b5512d04d98a0d2d3736630c044546e
SSDEEP 768:g1zRmezk6rGq17W45IvQUcV5YiSyvRfAMxkE4:QRm0lGY7W45IvQUc77SyhxM
TLSH
T193E2AE93BA94481AD933C87194E24F35E971B387470187DF2229C24D2F327837EB97A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_socket.pyd
Size 81KB
SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
MD5 632336eeead53cfad22eb57f795d5657
SHA1 62f5f73d21b86cd3b73b68e5faec032618196745
SHA512 77965b45060545e210cdb044f25e5fd68d6a9150caf1cad7645dbafcf1ce8e1ccbdf8436fbdcbf5f9c293321c8916e114de30ed8897c7db72df7f8d1f98dfb55
SSDEEP 1536:3OYxHEUZql2HLSyypHb9/s+S+pzG8iFWmIHJqKN5IvLw767SyZxqND:+dUZqzyypHb9/sT+pzG8CxIpdN5IvLwD
TLSH
T111835A11A69050F9DB63C0BAC2635E23FBB5B4C013D5939F1166C66A1F33783BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsndfile_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_soundfile_data\libsndfile_x64.dll
Size 2.3MB
SHA256 22518c16f9d13eda5ae5adf999c4740d7d16cc2d6b178b36dd4ac2f759a38559
MD5 2bee1d9184b256144dadaf8af2786dec
SHA1 e74ec895f4dcb2ac5e4531feb14ceff9f52fa62b
SHA512 c7229aeafe5017e656c6c7165e644c8c69911584c504aa324362e4118ec353456462c44c53acee58a88d0f029a38bf3827094a4f5d7ae9fa98534b349c23f971
SSDEEP 49152:kvDPF0OjGemRTXMTIcOSC6L53AMmdCHRcFcQbCTfxK+LzG3y:25QHC
TLSH
T1B7B55B02F2A25CE7D3E691354152F52BE630786C835216FB2B94A6B87F637C01FBA711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_ssl.pyd
Size 173KB
SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
MD5 eea3e12970e28545a964a95da7e84e0b
SHA1 c3ccac86975f2704dabc1ffc3918e81feb3b9ac1
SHA512 9bd5c83e7e0ab24d6be40a31ac469a0d9b4621a2a279a5f3ab2fc6401a08c54aec421bc9461aed533a0211d7dbda0c264c5f05aeb39138403da25c8cda0339e6
SSDEEP 3072:V1l+KugCpMRjN/ft6X6k7GxOnvvkKuFBZd4rYcvsswCfyX0NoFFIvC75/:V1QKugCpAJHt6X6nKvv9gF5
TLSH
T11A047C07B5542EBBD813E4F9C1230913DBB1F055331257DE48D5D64A0F07B4AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_uuid.pyd
Size 25KB
SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
MD5 48c6cca2fdc2ec83fa0771d92bf1d72f
SHA1 723a8bb6e715616da003d7c658cf94fb129cd091
SHA512 42fdca831e8398638c06cd54186c63cb434da78234a23d80e0f400c64d4e0e4ef8fa307d115b3775b4f97248bd3ce498d764c6befe11b078ec9fcdd270e8f324
SSDEEP 384:BxIQyiAWFIvZw2bHQIYiSy1pCQB+J8AM+o/8E9VF0Nylxr:cQy3WFIvZwm5YiSyvB3AMxkEFr
TLSH
T17BC26D56AA605C05DD278AB1B4E24E26EEB9BB514B5083C72358C1550F323C37BEB3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\_wmi.pyd
Size 37KB
SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
MD5 fda7d7aada1d15cab2add2f4bd2e59a1
SHA1 7e61473f2ad5e061ef59105bf4255dbe7db5117a
SHA512 95c2934a75507ea2d8c817da7e76ee7567ec29a52018aef195fac779b7ffb440c27722d162f8e416b6ef5d3fd0936c71a55776233293b3dd0124d51118a2b628
SSDEEP 768:kEkKWSx+lZb+7iNEpPlFIvCiS5YiSyvxPAMxkERJ:kE9W5XyiNEvFIvCiQ7SyJPxj
TLSH
T113037E56E7940854D937CABD88E64E27F9B1B5925B11C3CF3314825D0F32381BA7A3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\base_library.zip
Size 1.3MB
SHA256 fc1f22412766351b905e3e4b00071bee18d6d8c782e1318d6b2ac02a854458d0
MD5 81f9f55f19b1a56cb3da244270f67d8d
SHA1 a83dc21dca5578862b455a05ed8253d02fde67ba
SHA512 3d03d6ffaf8d140248c2a0912d5f791a6fb120227420e844d3275bc9963bcf05560eee503d32c3dd2a6299624a6be794df326e18e9076f1fdd64bec598571824
SSDEEP 12288:IpHbP+dm52/HyV9O3nVTVihlyixmpvQXMHYf/RS8lJGUq0NRx/SquMrmn9vfaM:ibP+dm52/Hk+hqg8lJGUZr3N693aM
TLSH
T18555D6817A92A5B3FC84F3BA04260A0EA3658571BF44C747389FC5E56F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
Size 19.6MB
SHA256 ed4f167a5330424524f45258e7ca2c8d7f03c0cba1f30ee4985553ac1f88ecf8
MD5 82ba43e5b624b4b1f83b381e20d3fa3f
SHA1 549bfd3445945b58f7739d65e0491ac494956446
SHA512 4f303db36b13985e7849b6db082b921063a3f5cacd19c7774e5d9c329c3e57fa8187315a143c6c008ae01032cccf9f41a76c85035d7f2be5b035f45acbe989cb
SSDEEP 98304:mAyUa5wmFI8shyp4S+A6LNVkFvTNVkFvxaV/2vLaVf2vAjZLwwgDKURHSfOzPWER:cZLwwZURHWOzPWEwQLaJH1P/UCVW
TLSH
T13327E687F5A250D8C47BD4B4936AF533BE60780DC53839665F81CB202FB4F50AA6BB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiarray_umath.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\numpy\_core\_multiarray_umath.cp312-win_amd64.pyd
Size 3.7MB
SHA256 9c10617e66e992b5ac6d9f78fe7cedd0011618e1c2f89d09a185bb63073e2c90
MD5 03c747dfc63a721e798bbc5654525598
SHA1 d4df4434a139e7968e942070687c25065e100cc7
SHA512 be102cb31efcadec83fba4d49d8f0d656459a6b049479e3a6f173e78f3189e2b27bf484da961da997318f04d4c9a02a13b83ea31125c972128e65a391b37a7eb
SSDEEP 49152:XNZoaUAkGYxCjDsgnSE/2kTnYJyzMFadxZ/76DkSVNckDu1xDJ/+6sLql3wV2yXx:z0yzr0u1X33wpXdxZ
TLSH
T16C068D5B92E611EED16780788A7BE107FB6234260B505AFB21D4CA252F23FD917BF701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_umath_linalg.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\numpy\linalg\_umath_linalg.cp312-win_amd64.pyd
Size 110KB
SHA256 03bc9de2d6d8e2d9ea3ec781f3c16bcbc9960095cc02ca588f4229cd1560c661
MD5 2163657c427aca7037e76931ecde7254
SHA1 cbc7e42a4ba78a7df1c77dc2b203d8734c4051e3
SHA512 9161bcb1711a419dc7b4ef539ea8e4c25e4906ad830c1de5d9e1e59cef7d1af19f607df3085ca2948fbbea8975fed7dcbd52fa7a8d9824c16aecfac9f31fb522
SSDEEP 1536:Ym0GLQVRVLH10mmFGOp5Q0cHf2QyRV84WfjxzE0h+IdnjXRA6ZVPBA3Nt/29:owMVdfD2tw0Idni4Q3Nt/2
TLSH
T1C1B3387370C512ECC576C1F8A9462A57FF53788A432027EB13E0CA942E6BE616E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\python3.DLL
Size 66KB
SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
MD5 2e2bb725b92a3d30b1e42cc43275bb7b
SHA1 83af34fb6bbb3e24ff309e3ebc637dd3875592a5
SHA512 e4a500287f7888b1935df40fd0d0f303b82cbcf0d5621592805f3bb507e8ee8de6b51ba2612500838d653566fad18a04f76322c3ab405ce2fdbbefb5ab89069e
SSDEEP 768:XV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/c:XDmF61JFn+/Oi5IvL0b7Sykxr
TLSH
T155637052BB54F8A3DBFA69FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\python312.dll
Size 6.6MB
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
SSDEEP 49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
TLSH
T1BE666C567358C0A9C96B90B4CC13C68EE7B27C517F60930B70ABB71E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\select.pyd
Size 30KB
SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
MD5 7e871444ca23860a25b888ee263e2eaf
SHA1 aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA512 2e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d
SSDEEP 384:TRVBP9tKLhuosHfwTgDo90Y5IvQGsHQIYiSy1pCQzpuKAM+o/8E9VF0Ny33H:5FyMHfv2H5IvQGW5YiSyvIKAMxkEtH
TLSH
T108D28F536FA05885D963C972A8A64E26ED31B7568710C2CF3368C15D1F227C27FBA3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e6c2\soundfile-0.14.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

e12c773d-6642-45dc-b49e-17774179b105.tmp

Path C:\Users\Admin\AppData\Local\Temp\e12c773d-6642-45dc-b49e-17774179b105.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoundBoardPro-Setup-1.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-UV6Y7XKBDG.tmp\SoundBoardPro-Setup-1.1.tmp
Size 4.2MB
SHA256 3fb5a12b2600d5a76042bcda57f9b9f8a2e0dea30d803e6ee7afa9a64d07e886
MD5 e846d76169d484c087fd1f381c15f1f2
SHA1 cdeb447ff833dfec95d20b5a84af78d2629cc712
SHA512 0a2fd2d641030879b44b5e4c90e6275b36d562d29ecb2f2ec926208ffcc8b2c99f374874b446ba313b2f23cb48ab02f64fa37b01e8e22430547e3b20643542bf
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JE333u:HItJj90Z6RgKw8
TLSH
T121168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4168_1660204178\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4168_2052359594\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

playlist.json

Path C:\Users\Admin\AppData\Roaming\SoundBoardPro\playlist.json
Size 99B
SHA256 5f64e7b49d4596c49dfee8efa66edb3fe66464f9e9f68c16708939157f16f06f
MD5 e250368d0346f6866d7f0f3a9530e497
SHA1 4fad79314ed008f82661075ca39cb6239b367a17
SHA512 ce403a2709dd2cd29ddf68fc4507f554dbef4e026366f81cefa810ac0e6fccaf43f120624834ab4280d89e341efb036045ce13232615fb030ddc9f3c86135195
TLSH
T138B01230C0551CDF21F0632070762703F50005F117A2BC1131F1000C5B734410008DC4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3664-0-0x0000000000D20000-0x0000000000E02000-memory.dmp

Download

memory/3664-216-0x0000000000D20000-0x0000000000E02000-memory.dmp

Download

memory/3664-175-0x0000000000D20000-0x0000000000E02000-memory.dmp

Download

memory/3720-434-0x000002E269FA0000-0x000002E26A23E000-memory.dmp

Download

memory/3720-429-0x00007FFF29C30000-0x00007FFF2A11E000-memory.dmp

Download

memory/3720-435-0x00007FFF2B640000-0x00007FFF2C9ED000-memory.dmp

Download

memory/3720-410-0x00007FFF2E940000-0x00007FFF2EBE7000-memory.dmp

Download

memory/5340-212-0x0000000000EB0000-0x00000000012EE000-memory.dmp

Download

memory/5340-177-0x00000000019C0000-0x00000000019C1000-memory.dmp

Download

memory/5340-176-0x0000000000EB0000-0x00000000012EE000-memory.dmp

Download

memory/5340-6-0x00000000019C0000-0x00000000019C1000-memory.dmp

Download