85169caca0cac605ac102721371bf63d9731efb1d2cfecaa80d66909356eda31

Analysis

user interaction
yes
max time kernel
163s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MiniMeters v1.0.29.252 Installer.exe
Size 43.1MB
Sample260506-yaastadv2j
SHA256 85169caca0cac605ac102721371bf63d9731efb1d2cfecaa80d66909356eda31
MD5 5aa6c45bb431f70b6e93b67e0d3e40e2
SHA1 eaa7c0b98f3450dfcefef67ac0173a7b30be7f6a
SHA512 19513b46722788789c42d3ee9402efbb800680c86f4c720ffa27dbe6b54548b62bca649f136b15d2ede1f1f4207c6b893209bf5c3cfa68430758bcc4e95b9994
SSDEEP 786432:nMNs+rPcHg4iGs9+p5TtohAnBXJg5v3W4gFMoyd4X6MKU0zalU0upwccOcaH:nMLrUiF+fuhAdJ0WtMoyuX6fIVORH
TLSH
T145A7332212F1F596DDB7D33A49107F1FA05776DCADEC8500EAA6A44CDCBEE4B63018A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\MiniMeters\UninstallMiniMeters.exe	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Audio-Server.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Loudness.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\MiniMeters\MiniMeters.exe	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Loudness.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Oscilloscope.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Audio-Server.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - VU.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrum.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Waveform.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Stereometer.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1912_65225124\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Stereometer.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrogram.clap	MiniMeters v1.0.29.252 Installer.exe

Executes dropped EXE 1 IoCs

pid	Process
6056	MiniMeters.exe

Loads dropped DLL 2 IoCs

pid	Process
4828	MiniMeters v1.0.29.252 Installer.exe
4828	MiniMeters v1.0.29.252 Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiniMeters v1.0.29.252 Installer.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2456	msedge.exe
3760	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225698744697951"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-643422742-1162610606-620613169-1000\{C09ED329-9A20-4E4C-8525-402DC0F2D9F2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-643422742-1162610606-620613169-1000\{8B034F6E-A4CC-495A-A325-3B801B71AD75}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6056	MiniMeters.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6056	MiniMeters.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 6056	4828	MiniMeters v1.0.29.252 Installer.exe	93
PID 4828 wrote to memory of 1912	4828	MiniMeters v1.0.29.252 Installer.exe	94
PID 1912 wrote to memory of 3624	1912	msedge.exe	95
PID 1912 wrote to memory of 2456	1912	msedge.exe	97
PID 1912 wrote to memory of 3288	1912	msedge.exe	98
PID 1912 wrote to memory of 3288	1912	msedge.exe	98
PID 1912 wrote to memory of 3288	1912	msedge.exe	98
PID 1912 wrote to memory of 2876	1912	msedge.exe	99
PID 1912 wrote to memory of 2876	1912	msedge.exe	99
PID 1912 wrote to memory of 3096	1912	msedge.exe	100
PID 1912 wrote to memory of 3096	1912	msedge.exe	100
PID 1912 wrote to memory of 3096	1912	msedge.exe	100
PID 1912 wrote to memory of 2864	1912	msedge.exe	101
PID 1912 wrote to memory of 2864	1912	msedge.exe	101
PID 1912 wrote to memory of 2864	1912	msedge.exe	101
PID 1912 wrote to memory of 2964	1912	msedge.exe	104
PID 1912 wrote to memory of 2964	1912	msedge.exe	104
PID 1912 wrote to memory of 2964	1912	msedge.exe	104
PID 1912 wrote to memory of 1352	1912	msedge.exe	105
PID 1912 wrote to memory of 632	1912	msedge.exe	106
PID 1912 wrote to memory of 5084	1912	msedge.exe	107
PID 1912 wrote to memory of 2524	1912	msedge.exe	108
PID 1912 wrote to memory of 4800	1912	msedge.exe	109
PID 1912 wrote to memory of 3696	1912	msedge.exe	110
PID 1912 wrote to memory of 1352	1912	msedge.exe	105
PID 1912 wrote to memory of 1352	1912	msedge.exe	105
PID 1912 wrote to memory of 332	1912	msedge.exe	111
PID 1912 wrote to memory of 5084	1912	msedge.exe	107
PID 1912 wrote to memory of 5084	1912	msedge.exe	107
PID 1912 wrote to memory of 5324	1912	msedge.exe	112
PID 1912 wrote to memory of 2524	1912	msedge.exe	108
PID 1912 wrote to memory of 2524	1912	msedge.exe	108
PID 1912 wrote to memory of 4800	1912	msedge.exe	109
PID 1912 wrote to memory of 4800	1912	msedge.exe	109
PID 1912 wrote to memory of 968	1912	msedge.exe	113
PID 1912 wrote to memory of 3696	1912	msedge.exe	110
PID 1912 wrote to memory of 3696	1912	msedge.exe	110
PID 1912 wrote to memory of 632	1912	msedge.exe	106
PID 1912 wrote to memory of 632	1912	msedge.exe	106
PID 1912 wrote to memory of 332	1912	msedge.exe	111
PID 1912 wrote to memory of 332	1912	msedge.exe	111
PID 1912 wrote to memory of 5324	1912	msedge.exe	112
PID 1912 wrote to memory of 5324	1912	msedge.exe	112
PID 1912 wrote to memory of 968	1912	msedge.exe	113
PID 1912 wrote to memory of 968	1912	msedge.exe	113
PID 1912 wrote to memory of 2764	1912	msedge.exe	114
PID 1912 wrote to memory of 2764	1912	msedge.exe	114
PID 1912 wrote to memory of 5272	1912	msedge.exe	115
PID 1912 wrote to memory of 5272	1912	msedge.exe	115
PID 1912 wrote to memory of 3768	1912	msedge.exe	117
PID 1912 wrote to memory of 1656	1912	msedge.exe	123
PID 1912 wrote to memory of 700	1912	msedge.exe	124
PID 1912 wrote to memory of 4400	1912	msedge.exe	125
PID 1912 wrote to memory of 2672	1912	msedge.exe	126
PID 1912 wrote to memory of 2672	1912	msedge.exe	126
PID 1912 wrote to memory of 4624	1912	msedge.exe	127
PID 1912 wrote to memory of 4624	1912	msedge.exe	127
PID 1912 wrote to memory of 5172	1912	msedge.exe	128
PID 1912 wrote to memory of 5172	1912	msedge.exe	128
PID 1912 wrote to memory of 4032	1912	msedge.exe	130
PID 4032 wrote to memory of 4896	4032	msedge.exe	131
PID 4032 wrote to memory of 3760	4032	msedge.exe	132
PID 4032 wrote to memory of 4512	4032	msedge.exe	133
PID 4032 wrote to memory of 4512	4032	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.29.252 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.29.252 Installer.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files\MiniMeters\MiniMeters.exe
  "C:\Program Files\MiniMeters\MiniMeters.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://minimeters.app/help
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x360,0x7ff87a43c188,0x7ff87a43c194,0x7ff87a43c1a0
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6395861472931066865,7652406836838603515,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,5909417636041051178,8721725285184612297,262144 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,13989521352291638169,14851877579238485731,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,10577978164123287671,4007646430410245573,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,489449312763787212,13503432585579412488,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,4191292120337203547,1834356304397057963,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5084,i,11994067919051163335,14391695885639574924,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,13200654771811662397,17857828747863952170,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5116,i,16618669834601047156,14762559347166019922,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5160,i,11000936045831181886,5202104281000076961,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5224,i,9657428464663289914,14969159919324654777,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5172,i,14570374054938319486,3612353432380560302,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5236,i,5075470638956160069,9395631406712295320,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5360,i,7956645247870644490,9411969586037748562,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5420,i,13600926711851238120,12427876869384328167,2097152 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,2997409580141189460,9127742783989695005,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,10310293561400650476,10299056285987066684,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,13269715622416551456,14556677703203774497,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,13269715622416551456,14556677703203774497,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8116,i,12929254872084373564,8428673346911894164,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,17087364556506891465,12565489024324575570,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,6003248257903379529,10280896655804525984,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:8
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8120,i,4003738942617770116,13811881765881586564,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:8
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8256,i,3955377319884515532,11040117620821053871,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,5680544001806047896,5835857583478265126,524288 --field-trial-handle=2292,i,12101365303997413615,11177726802638012813,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff87a43c188,0x7ff87a43c194,0x7ff87a43c1a0
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,3650128868380449566,15915934072362053817,524288 --field-trial-handle=2224,i,14783141668783908436,6909318993354731750,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      System Time Discovery
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,3267466003062362271,14619955919008591504,262144 --field-trial-handle=2224,i,14783141668783908436,6909318993354731750,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,6455346896253377155,18405864692913141662,524288 --field-trial-handle=2224,i,14783141668783908436,6909318993354731750,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,2440848820132208540,14670694632563384332,524288 --field-trial-handle=2224,i,14783141668783908436,6909318993354731750,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,2440848820132208540,14670694632563384332,524288 --field-trial-handle=2224,i,14783141668783908436,6909318993354731750,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
      4⤵
      PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MiniMeters.exe

Path C:\Program Files\MiniMeters\MiniMeters.exe
Size 5.1MB
SHA256 7581de40cf04568463dae5a93ee10d025bc50b236a0079cec1db15873affb805
MD5 29a3293b8f83246ff25d2b0a7d411973
SHA1 ba78cb81cb06a36904baeaf6c8f9a65dc38b380a
SHA512 3ef54b84e19368dcef5cbf12138e8e5ed6cacdb2eeeb2ed7a046101cdf4c53d989af5b97e52772374128af002f4f8d6eb8f45a16afac535402c7935e7cb47b68
SSDEEP 49152:dENOt95pLbfFPlyv/TmFiT8TKO0hiSdMpXKRgzl4S7gxj2mkmcxb1qgJMcmWZ5WG:zzfOD7Lyzl4Qy2/Y0oq
TLSH
T1A7368D4B7166A0E8D535C0756287D01647327C8B0B647CEF21A18A763FABDE21FBE90D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ceb411792f96dc33552b05fd12c152550f572df8d4eda7fefb9cfd19ba4cca0
MD5 05ce2a76c1953bf832fd5e6ab4b79649
SHA1 b2aacb53a5e13f67574e95cdcc5a6aa70a46185a
SHA512 bfc5ae6f147150a3c65a32bb9af9e112398ced079686f2bc3d849380e239a984153aa7c8109cd0d724b1a01be93126296f8b7d4b15a977a7ebc8bda50093e5c1
TLSH
T147D0A735635DE012D1AA04B6505141951E5EAD8A308B41D9D216804D4DEDE19D3D7182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 95cd5e68e91cc43393efe5eb764738552eb280c216b42669d2c231f671221eb7
MD5 5ce821b13683fd30c9f555948ee45ee9
SHA1 8ce81707efa496739ba8909e9785258ac29c3884
SHA512 7f19ce6e07c807737a2d1bc61cf29cfd5b62a05c108bd28620bc857763de57f798f303ae5ca59fa58042dde76bf79faaf286f2ca6ec7e14e5017b6112847b5cc
TLSH
T1A4D0A731230DE452C2AE04F6905046861F8A6C9B704B97855111C05D0D9AF24E2DB346
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 976661afcb139fa71ad1a1561d1ab101721cb7dcf262953bad1697966ef19c71
MD5 c921dedb8465cdd8b7d3073e534d5121
SHA1 d7c02832e9a8292bd523cb6118ce1610d3cbd7e0
SHA512 f40e455caec3fcb34e749bd15d4001b8c7636027a2030282a6078b87727e7fe9051a6a5b06bcea7b78df7721a39c79ab702f1591a15b10e03fd8e03c17550452
TLSH
T1DED0A731230DE452C2AA04F6905046861F8A689B704B97895111C05D1D9AF34E2DB346
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7cbfa18cb848e91d7294474e0f17d3a819a905da8da4b953f4499d4737182d94
MD5 301b92c799e02e5fef11ecf6a4bc84c5
SHA1 ff06931f80cfed80d923afd10ca9d903edaf2a5f
SHA512 8656f58529341e54c80be6a58f8ffdbb0be0fbe2124327a41cb3ffc82b6013895f17a2143065733ce941cb58b5901a44d103f5fd48e0ec99cc3f70f5f41704c2
TLSH
T178E022AAC825EC3B1CFD971870518B85EB5003172B90892F3B3CE21C8FB563A568B85C
MD5 SHA1 SHA512 TLSH

Submit Download

81e16e40d4f29486_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81e16e40d4f29486_0
Size 5KB
SHA256 6e33f32d1295b53514a4eab5d5b1a21a9542d707d52a9ec2fbb6a4519bfc38d7
MD5 cb3d0eac67e5e006208fcfd2970991d2
SHA1 7c1ffcdbba2afb9f233754121978cfacf052a0f2
SHA512 83c7d35a411e844f6c17c645630eb1411183a0c41573511f8a662aa42cd72679ee9dbe113558ca756928844cd19eb827e09b560bb6d768c600c9daf9dde931f2
SSDEEP 96:cXe9y1FatDHv5tE928i3XPG8VJ4Fbk1bIlwahhYUVjyTDymxQ2j/:+eKkP5t+ZYxQiI3jY
TLSH
T10FB164C25B6D6E4ACE2223FE42958665B3B8520A2F83C33722D543716C5A3F74D0B907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a029a26bb26d9c7d51ce6e1084dd43d612a3eec600b0a00af872c99704609ba
MD5 6e341538093a92621a17891ad73286cf
SHA1 ea884dea7d455e21c97b56776741b38b3a58618b
SHA512 23ea12abd3de92f997dd2c6bc26f90057ae384ca4b7cf9fede1f8cde3a8fcf892c8a9ae461b631b04aab2ae0b686545abd75658e6d896b2881641619974e546b
TLSH
T11961944AA286C824FBD5D2B56AD780257272F75AC24B0E4BF1FA443CFA1675120CCCDC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 536e9ee9d451d239e8dd3b4d0a1c1aa6956d1c36f9c701ee1ec03a8c659c490f
MD5 3001bbb95d13b4a6913433132b52b536
SHA1 3902d476b693047752dfca8ae8b629c502850c8b
SHA512 a7dca443ffb099ae3e22565c77482fa5ee62cf4600767aa2e254ee7c76a0d693318f7c89c61a8819cfb0ff9abdef5721c4288ab0328dbc83f79af5df221512bb
SSDEEP 3:MsEllllkEthXllkl2zE/l4YWX:/M/xT02zZT
TLSH
T180440404FFC10407C500113040F5C3501F70D4111713F743345104335CC57D00C050C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 e9db6e2281eba38d590de0a65374aac5d29d18ae9e405e84501c72705539850a
MD5 60f4df7baa3ae90583234ce284c30109
SHA1 34de14e39d83568d41398d3ff8f449881319c037
SHA512 29a222ca60be793b2403aef239af694f6b123168f39c1f256b4c3309868219f3e6760b68a1b04743f30d764d1db75d03761d8ab7bf0d0fb6eae3a506acbbf6e2
TLSH
T1A0E092987CC6C37DAD2136C353245709C2C034A2E696EF472700CCC07702741A289676
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 8292545825ffd8048cd163a829ca5ae0f84bbcb3d6608ca8bd49128c3e71b9d2
MD5 2281d9f41970968f562a5db62df52a0a
SHA1 a9c431244257911929b57e1bd17dbcc234e93036
SHA512 9ff3c1712fb926d8d0acb5bb46760b8993eae2e43c498bcd671911367acea9c7e15dba6d2badaac8a6a03112e6ac708485dd7b1bb822fe3f6a53a271507d4eb5
SSDEEP 48:Tyi+7f+UZD4jJ/Bhd0WxldzzcCLm+wVt+:GLnD4jJ/V0W0mm+wP+
TLSH
T105E2024D3E11F511C8EC337DE1C1C6E0AFBC686C4A5DB57151389872CD92662F59E50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 37735c4e26153df82164588722cf28a450a14aeccbcecedcf6dff516545ff613
MD5 8ee7df75f58253a4f8a2b12f30ded026
SHA1 e06226c7c4f91b8ac8b0c735ae274d94ac886bd4
SHA512 3b49ceee94ecebcb75bfdf91d2672005e55e5caf81deaab25b7fedafaf376810ee7f6f3c2239c04167f4638cad60ab4fcb9a6667a6865870a7b4ffbcc0fba1b1
TLSH
T10BE0264854C8C37ADD386AE7836D4B09C2D03412B2883F47570ED8807202B45E3FE2F4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 96f83ca11fd80b4cc767d6d6ea38e90f21abaebedf320663b0170b646f6fa194
MD5 0dcb72df09bc1df7dc3a2425e03b2ae9
SHA1 bba9316b68a6f1648ef868c535cbfdaa529dfbc5
SHA512 737f2c3c6e13832e34deea6d3d66552f473a4124bf7c82a9089227114d2e2a2f80b90da450edaa385507db1aed255abe8cab71430353877fe9dcf588ab7cdc75
SSDEEP 48:IzBmw6QU1Pz+m4hEWVo+Va5R1nq0o7EPLVtk2R0nYC017u7C0ScWg0pF:UBCxDfWRVa5R1nggPLVtjZC0lH
TLSH
T112B2F5874BB83923D7161F3E280B483ACE3BE35CAFA74C16341154619EF649AE0358EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 ab53f0d5bfe3de82106400f72b9e028b5b9676732d10deb9d2d03f238a754b41
MD5 cab044d9c42aa3f19ae42c52323a2e77
SHA1 f5dc69fd79ddb65fd79f4039d3bad5a74e42ef5b
SHA512 d7f6d2eb070faec5c7822bd375ebfedb547c9a556e12beaeba2a4c87559ce1c5da3817ae28b04b4a95d6fc75981bc4f16a307fb40e2e179f973c0fc3e027037f
SSDEEP 96:Z+qIU+bGz83uy3+u4tgp4DLjGQLBze9z30jBHMsDEuspU0wbtqrOQpPfR4J+MCXJ:Z+qf+G83uy3Ct7XBBKIH7DXspU3iD
TLSH
T10A14214F4F352322CDBD517669E744A35D6DF03F8B1266DA686114B4CEE3A42A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 71178506106f96bb8a57503fa983f4908f3ef918a9a99eccc07f7f0959512a7a
MD5 374219e2ce2d1660aca85f232e711fdd
SHA1 166c6010d43bbbfcd6d3f9b0202e4f05ebb8fe5b
SHA512 6434e666096b07edc66a676077fc260350e6756adf4dc02b37845894740b5cbb536394a92716e62a1ff8f7bbb22b3aea00d4f380d1e027ff9abe0a63fdda42ac
TLSH
T12241BCF3C3E4856E8A1195F0AA186F2BCE1D0550432C7D5A85E4AF2BA3E3461E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd3e8aa3c027e844643d5988be8df69ee98b6a78cc673e2d6ecf111702803250
MD5 e1af6c8a2cc1479a33df2d73cf3993de
SHA1 512d5201063dde203a62644447c481a8e5a2e5d6
SHA512 5452b169cb0fef72ed20a2291948f0fe562294e9c0465450ce092fa3fcc6da019920231f1d05186e2309bb7c39ee8f04113d5814e5189bced2c7e7dfffdebd77
TLSH
T16C41BCF3C3E4856E8A1195F0AA186F2BCE1D0550432C7D5A85E4AF2BA3E3461E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5b0abf9c8887247c17c4c737d434cf140a9de1084a0cfec340218d16e150b855
MD5 ce54d07c5f19e7ac404252378de539dc
SHA1 6a96399af0b1afc8d73dcb2b11b5346873aee3dd
SHA512 45db9898be61e39aeac470423b856c4f95a5515d86341a005975fe32b8a64e59d56fad45ee07a90f3d1ddb2c3a0644a3a7dacceabf4e9a8875ad1d7e424b8595
SSDEEP 192:sxZ/R9yMqZ/K1Ml8gjA/fesiWpV0hHVCbO94LzodpdHHW6+WNSJ2sZYvNg3cqYse:sxZ/uZA/fesiWv0p74Q1HbIZCp96Wd
TLSH
T1DA72D816AA34997BCCDBD219FA457F53D6F91522D2805E4499FC8E1C00E7AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b97d5201fa5f7fd4343ec953927dd58b52c2252fbbb4461da5b056e6df797e11
MD5 42bf87d435f8af548f3180f33811a116
SHA1 f20a80f5c949076792ae8abecdc503b0d2b36cff
SHA512 e9543ea766c7b32ff55d8b82947208749c176cc33377ad8da1692d7613d8269a0ff32b7eccb7d4d1417b8aecba6351818dba1cdeffd07b4eddda256563bf3ba2
SSDEEP 192:sxZ/R9yMqZ/K1Ml8MjA/feshCVCbO9hLzodpdHHW6+WNI6B/YvJg3pqcscIIgjDJ:sxZ/u7A/feshC7hQ1Hb//CmUj1
TLSH
T15672D9156A24997BCCD7D219FA457F93D6F91573D2904E44A9FC8B0C00E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a45417355526f3268a47a9998aa2202de0ecb8ddd3d5abba55de64472be0ad1e
MD5 bb09902f4910ec2dd6be670e038c21e6
SHA1 49f2e8099f0fbd6bba1a4585cee2149224e66a2c
SHA512 52c53b1e8b713a9ca518b4b433d3448c566d469463005aa91df571f4a760a607791210458679749c51df4b85e96ac43dd17e7b1aba7101ff1716113436da2294
SSDEEP 768:KJ4Z0+27pLuL/8MWv80Xo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRYsLLlXZUJRroO:KJ4Z0+WE/8MWv80Xou1ja8YsLLxyJqqH
TLSH
T162F20B3B6C4CCB7E4F804E9CEC2A7E8E6DE8028F9698885447F9944C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a5d03c1c0d460da2d6421b355fcff529a5955b31a6f0d9e29de4cafcf3a86a3a
MD5 978d32eea24dce62d9e34d55089603a1
SHA1 b5a3eb3b9240169460baabf44068f7f50f06c630
SHA512 fe54691edcd04f9a3c89f3ade230898e9ba726620641f5c5b9791bea910890ce0fa3feeb7573690773f8c926e809956ed6f970570fb1a633b9849ea1fd789f2f
SSDEEP 768:KJ4Z0wU7pLuLn7MWv80Xo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUYsLLlXZUJRro7:KJ4Z0wYEn7MWv80Xou1jahYsLLxyJqTf
TLSH
T1ACF21C3B6C4CCB7E4F804E9CEC267E8E6DE8028F9698895447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 62b767e3a15e8697657dfc486cd6eba0fe2275b20c4ba67ecdd0eadd9e1b07e8
MD5 d2c888208748ff7b56d1306fb82a8970
SHA1 6a359e8b93802a7bdada3cc5310c600af0063efb
SHA512 f1b1ed547ed2e5d71bcd95622d8314c0d6db680d6b4f15fe686bd02fa88de7403e12ef3958a1665adbda9da1b9c3252dd110d80116bdcda5b8a73206bbcfaed3
TLSH
T10BE04F5819C9C379A8752AC303A4A30ED2E4742BD7CC7A566F54CD4462C6A44B7961B1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 72c02af0badd94e505285981af0f8a74b8f09e5f6142379d208f1056df216f1d
MD5 7a06f47a31b34e936d0db038a391caa1
SHA1 19ff5fd4e17a77093cf281cc30a668050c16a20d
SHA512 7af0e78202212b6eeee73c1da72834d1c2dce6500c9f57deca04bcdb4e1e64d8e0b7cd83f3afd82ec23f6027eb424a8179174b5f39bdeb966bbe6ef5aad16ddb
TLSH
T122B092482B208201C4A90A31BE898BC0A314A08210524662C8089B72DD142BC2B80C84
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 8217354e25b18373b6062986d66744f98ac2da09e6aa03c64cf9c1072ea5f820
MD5 0c2da8b08f74a613633f08e1927e1079
SHA1 889085ecbbd0077e3916189239f6129304d5eb7c
SHA512 de65fc4838137a7516ad198cc8136dd01de908a4efd7d077a83bf78215f91d94ac6d82bb393253050160d85e946e50f2bc2f3744aa77e12ff8c03263ca54fa9e
TLSH
T1ADE0D86425C9C36AA96525CB5364E30EC1E27403DAC8AE653F18D880734624073C7570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 7fe89c1c6ab267f93592d4f695912fc7736c2fc367de450f66cbfd18e9168634
MD5 04d9181dc81a9c5c0de5a35553171273
SHA1 d965ee8305d45fe4e73fb3fcea03ee89f946fbf1
SHA512 37ebeca4f372843fca359a3cbd37e9f503f42ec932ee312d32e78edb888137efb28c661695e472b8c6e3d6dae0e2e98df0ded13024c18b84a070acf482819e00
TLSH
T1D8E086B455C9C33A9C6469E34365970EC2F3780797C87B9A6B089884B281294B3EA9B0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 46b5249270afb9d0f33a29afef632157084ced850747092aa17456b5f2c98942
MD5 986bf77a6a1ac30f3f92aa566440dac4
SHA1 c31062ca3d1e09351a320c35c6ef9fa1942ccb29
SHA512 7a711258d669b254d173ccdf722519360ec544b4d19e0cd84d5c265698ddb1efee0a1c16d779ce4dff080859684ff3a8965f3accbca9415c92c8a5558e98e04d
SSDEEP 96:K4n+K0cCmHyKcI3IgKdG62fGKssvAAKdKi+1OKew/Em/mK4omaQwKBySr6KYY7OG:ANtDrpn3F2E9FHwgRBL3WDfSZXW3Lw
TLSH
T126B24C11717B02813E7E299E8195B46F52C231633198B92B3BF814B64F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 71e19ebaeec1b92fd5c880118f5066e57b8ba2bbb5fb1d7bd1bbf10c4455e590
MD5 94daa76752e8c3f6637c6e6fef1ab39c
SHA1 4beda0d42c5e5cd1e533d23d3ab75c5826a3c7c1
SHA512 9727eac7d81054a75c8b732c45854e68930984200e0da393b73390c8911ac0ecdebf96894370813ac6663ec4ff2c66be12012d44068d44abd3136a20769ce2e0
SSDEEP 192:ANtDrpn3F2E9FHwgRBL3WDfSZXW3LmXFBPg:AzD9n17lw8BrWLSJW7mVBY
TLSH
T15AC24615317B02D13E7E294E81A5B86E56C231633158F92B3BB804B64F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 23a999c992a31d180201cd44384b0cb11ecfc110da6e84868a07cafb4c49da51
MD5 7d2771491b646c254ffd1c047f938dff
SHA1 83688c59f8def48fead868bc36da0156eac620cd
SHA512 67dc61b225c2aa7839aaffdd07666d235743e1c82ac96169f21850578390957df92f78b3a5b0d05407a77b6c13099af37c7dc7bf6c2d354e1b5e26e92dd1ecbd
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgjsHsvbGt:DEK3tjkSI5IUltGhp22iSBgTW
TLSH
T1CE52DDABEA342312DAF553709AC101E5BE2F513D8FC2EB0274E910115BB7951631A99D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d80ff0cf-fcf8-46f3-bcdf-27b389c8db97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d80ff0cf-fcf8-46f3-bcdf-27b389c8db97.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 4499cbf7ef5cd956b8536c88308b32f56b778d9fbb6d655bebb84148c3600d9e
MD5 f5904a361c0331846324e79d1fe0ce95
SHA1 0834a8e2f3339ba7ce2f41f740bfeea489328034
SHA512 9b3c752fa5d74607483a432d1ab95a0a1684b7be48f364959207abdc5f5acf13a09acd91858067297e23acd02ecd22e397de014157dc461d2d01fe5763e8735e
SSDEEP 192:rxOHOAs4lrqxrs/G/PMl7AKQPIII+buMIM0NYcYVn:MH3s6is+sAKQPIII+buMIMeBCn
TLSH
T12652841927151F33E15E5F77026A8A925BCAC8834A72226E34211C1F8DF3F578BD52FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3b7210c9f6d0c4e92d97385576d533b70c649e5d6177a5611d7052dafb44ab2c
MD5 dd2e10e284cdecf85992c06ff4c0dba4
SHA1 012de9e114947de6c9e4613150fdddc91d8fc6e1
SHA512 6f858c1a8a92339c7d3daacfdab76e2c54380d5e1692d4ea78fc26dc1fa1698185ca77e03cc1ca94d5b525d0b321e5cc16d8dfff9d95095dbf4c3c37071e1b87
TLSH
T1BCE0485465C9C7FEE86421F70256434AD2D23517FA886A991F0EC488B14165473D9171
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 848dbb263ed6ba969f6e8e791a2a43496d4192d189929416b8364979e07694a7
MD5 67559d9020f2ea6f4127721fa1428aa5
SHA1 a0a4ca7a9abaac00cdd8060a95c7ec6a3250382e
SHA512 2e0e3a0257d1ef81f6178e0df8e578a4490e1178bf90f30dd0df959fb348ecf0eb9af7bf1163264840a9d8673513606b61cc1e21addcade52a0d83e27e69cbf0
TLSH
T1E221BF55F320C249E18A967D942BA7351338E8129FBCED0F507924292EB2A001E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 de891f45e74051a604cd5cb0ce6e31fa295d19ff0d4e411ca356624415468a0a
MD5 861670cadd15280db7cf7cb80d8a9201
SHA1 356eb9f8216d897994775e1005cdf159250eec09
SHA512 30110cca49206ba243452220cc64bcf6cea66919703bcf4d886cc2bb8bd48f7bf302a3f5890854da6b0103b4424b60489afa148be232ec103f74a82b75060f52
TLSH
T1FBE04854B4C5C7AFD46421F302669349D2D33857FA886F551F0AC888A64165573DA171
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e0fba296acf419c39c1d83357ff9f4fc5e60c5c3d6dee2ab27c002973ed646ea
MD5 30181ac29e8674d4a1addceff5f68cf2
SHA1 117a5a4ba8015e526e7049b34426bf64223365c6
SHA512 6078b2008c5e26e24b4d59735c9c485519f36485dcf968170b213ba1b51007911406ce57473c4b6cf856acda4596d2df38e29c8d5506da4c0231b0d4ed438313
SSDEEP 384:niiFrcXqnY3sNl8TUNTUlI4bSfTJvuxOyVEQqvfq8ztQAF7KmXt1r55buv78rN1d:pFzY3MwgaSVmxii8rKmX95bA4d
TLSH
T16DE2C3F598D78877E89E4B87A37E2E42AAFCD163B4480984B7C45D0CCC861BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2dd079a0b7ea95736935f09b9037ab6e1c74acb992a82459abdbca6b6218c170
MD5 250f9e93d805fe9a2709669fd8f33342
SHA1 7b2dd438c54b5d80037e2d4a0bc1e2a58a93a416
SHA512 f637c77d8d642e76cc7d2255083e85725a3eda052e2aa8a6e7b0263e2bff7aaf6be42548d5d4b6f75f86fd93b47c01e03627752991c1214ad6ed024b5fa6028d
SSDEEP 384:niiFmcXqnZsNl8TUNTUlI4bSfTJvuxOys5Qqvfq8ztQAF5nAAST/ov5bd4e0Hmth:pF0ZMwgaSVmxgi8pnS0v5p4e0G95bA4d
TLSH
T176036DF594D79CB6D89D8BC7537EAE0269BCD123B5484988B7E4692CEC4B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4d914c120442ce82cad009d7cc799e2106a0da0259f19ac3eccf5a34c85039f9
MD5 b877d9558883e3802b7e26d14922f197
SHA1 06d6be7cd025cf8184dbab98f6203dd0c653acf7
SHA512 d76c9202657a593b4a76d236e5ce6d14b426a458fa98492e85098eeb27b7a19920aa2a33dfb690c9cb6ddb05d5974d1c602b9c9fcca00dd6fc2b463e0ef67e6b
SSDEEP 384:nmiFrcXqnh3sNl8TUNTUlI4bSfTJvuxODtEQqvfq8ztQAFimXt1r55buv78rN1ky:NFzh3MwgaSVmxpi8SmX95bA4d
TLSH
T18BC25C36D899CDABACEB4BC9E74A3283AEE011A3C98C4EC8D9C85E4D00D75DD174B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fb1ae2f33666cbb148aee1d87852b896cac925cfb8922cf2972cc5ea6af6d145
MD5 3ca90faae7f84b99bbf6e213b00f4ad7
SHA1 80ea512b4d990d2942a950b8b268f599ddf899da
SHA512 fbdcacba7968b6d14554f66586c30f87d9c0a476eac174bd5de80fc01f73fb55ad57f47eeab7bbd4af6772f19e46da28481bbeb5a2c9b6643e0f0a0fcbb52d1e
SSDEEP 384:nciFavqMg3sNR8TUNTUlIm2TJvuxOi8oNLqvfq8ztQA5r+RYV/Vw1mRiCe0brN1j:HFayv3IwgzmxVd8Pr+RYk1mo/0/j
TLSH
T1F6C24A36E858D9ABEDE74FC9E7497A07EEE40267C99C49D4CAD81E0E00D719D1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c8f1e6754b7dace7371d9117663e6d4a0792c061486b8d4b3bb92fe79e889f37
MD5 2e412d227f266ed8f85531ec092c1e41
SHA1 f4410504c39a2fc27302b31150f747c26c766a21
SHA512 6977842e1672040c32cadcd2a9f8429fac5123f8d577de9ccf2128a970ba9950486c95b544768735a805b82cae6df1e1ab825f9da4f6713aefab6805ab3646e9
SSDEEP 384:noiFavqMg3sNx8TUNTUlIm2TJvuxOfyX9qvfq8ztQAFimXRYV/Vw1mRiCe0brN1j:zFayv3cwgzmxjd8SmXRYk1mo/0/j
TLSH
T152C26B36E859DDABEDE78BC9E7493643EEE401A7C88C8AD4D9D85E0D00D719D270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 888c19a69906b357e6593d3f9cfc1cc60e4696819eab5fa265cd86d297c134dd
MD5 7dda89a331847e3fbb4e46a88e29c2cc
SHA1 b056e5dc99013e7302a3cbca4368a54f8cbf659f
SHA512 f3f747223a56b1be05cf108c8ebcd1244983f7cc4c913efea314cc4a19b41624b7cc04c99bb64e287246798307fbde3d960b8b476457b2349d8bdd2af488eb42
SSDEEP 384:nuiFrcXqnh3sNl8TUNTUlI4bSfTJvuxOytEQqvfq8ztQAFimXt1r55buv78rN1ky:FFzh3MwgaSVmxai8SmX95bA4d
TLSH
T178C24C36D899CDABACEB4BC9E74A3283AEE011A3C98C4EC4D9C85E4D00D75DD174B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ca67780b3947b809b922172be6e9dba89e8da136b29cfc6a377ed3612b5cf7a7
MD5 da75d78b789dc0de1c8904fb094eee61
SHA1 05db9d8492b8d175572e78d5c49cda83986aa9db
SHA512 d620ea03ae2c122205c9053544e8c0350871093eedcf8525bca47e728600771a3264a846aa0718975678fc86f0963ba714ff41cbc54ae743893566a44fc3595a
SSDEEP 384:niiFmcXqnZsNl8TUNTUlI4bSfTJvuxOyl5Qqvfq8ztQAF5nAAST/ov5bd4e0Hmth:pF0ZMwgaSVmxLi8pnS0v5p4e0G95bA4d
TLSH
T1D8036DF594D798B6D89D8BC7537EAE0269BCD123B5484988B7E46D2CEC4B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 5dcb0edd516755f667633c8e8bbc263b88f7f385f2f2c00781f5c2d16b29394f
MD5 2ed5aaafebc65f4dd5a27daf850c47cc
SHA1 2a315acaaaa5561e7cb404bb77ebb10830d5afac
SHA512 a65c2d93ab50e6565f2f30db47366720ec304cb8d95637d23df6a61772b1ab243926b4b866008f29e1b452a893b56851bb96055b53fc3aa078fe678aaf884c6e
SSDEEP 3:MsEllllkEthXllkl2zEW2:/M/xT02zE
TLSH
T10B4404047FC00507C50410704071D3500770D411071157473C55D4137CD55F00C170C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d3036a813c2957822771fc0e3472f68eb0f714297eab5171df42d873b97da4a
MD5 6a47a479fc5005edeec9e454fc1101e2
SHA1 a416f66cbe666107411757bcd4c4b8cb95e8d10f
SHA512 1ab6cd88dd71d6086c08e1cf1abe9c4701e7892bb09ba1d96682c9a345193e9cc597accd3e53d5e16d4df18f1d31930c6eba8dc2b6076074fa62735535c92f6d
TLSH
T107411898A6EA1158B3B36F66ABF3596D487BB8772F0A915D00110E4F0B66B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

minimeters_shader_cache_-5980775891053976249_vs_5_0_Texture.bin.tmp

Path C:\Users\Admin\AppData\Local\Temp\minimeters_shader_cache_-5980775891053976249_vs_5_0_Texture.bin.tmp
Size 1008B
SHA256 e6d99ce8e7c9063cc71da180189b32a3170272a0d56ad0a9755f2135223beea4
MD5 07f9aa9005e895a8e4fa18889c48f5d5
SHA1 68f28084b2ee4e5e870809aef14e1427c017651d
SHA512 6b735299fc329c85f11db0885f074ae557d02aa6c4372e45bdf93beee0151958421deadba74b2d2e057462cd5fe8cd53287b349c567ba8b8afd41c84d1e7cc1d
TLSH
T1A411460267C9DC67C63D93B188DB1342737BF0806FA39B67A444A6769D1A3C09B1760D
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5967.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy5967.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5967.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansJP-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansJP-Medium.ttf
Size 5.5MB
SHA256 fdb4044741bc68f30ea8b92c1aefd920530a2d044f8753a6148148abdeb33958
MD5 818eefff2fa0b989124d9ba3a84f073c
SHA1 07ce11b5f8c64155d30fcdbf849b82e3840cb53c
SHA512 96483c07afd1a7b6177f00ba3794a2e6ba321ba7aa4ac57b491482308a106d0fd08f8735e2b5e9241cd13ab140702015678401875de574a0793364b5dbe19e67
SSDEEP 49152:Oi7/LBcP8JrdDMLDgAU0Z8J5CcIYsEfWLhM4zja/gomukguQYwQLWOPhK7TK:nbmkDKBc5CcRIC4aozukrwUWOuK
TLSH
T15D463987266D3D8BC1B56BBC554150BCF0CFC82DAB99D3F09DDBFC5A418A4421C42BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansTC-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansTC-Medium.ttf
Size 6.8MB
SHA256 6dab5509da393017701282da4f8373731ff5471bdeab05c08cf06be2a2738b1e
MD5 77bb826ea1eacfcd234608d3dedd1e2d
SHA1 0207e8e9dde26122d25e4880cc340ac9fdea5a9a
SHA512 c63711f90771a1dfde7f6328ad63ad2ac72f768fea2bcc0719f3df2e127a178711c083c17e8fcae00b08ac4411ed9768fe38fbe542bf43cc1ef91f9d4cc6a482
SSDEEP 98304:GqbyX/gAuQ9eEFUi2t2ZMp06WRWWzfiWvz36JzEEILyT:Bt8e7x1ajoEbW
TLSH
T15F6659C7165E39CB81A52BBC544190ACF1DFD82DAB99D3F4CDE7FC5A40964420C82BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default (Horizontal).mms

Path C:\Users\Admin\AppData\Roaming\MiniMeters\Presets\Default (Horizontal).mms
Size 1KB
SHA256 35caffbec000dfb1b488c1f3b00295a0ed8382797a1a444951e868c7e7a43221
MD5 094aa8cae1852e44de11ee406bbac797
SHA1 c8ed9f5a45e5dd4572268d315a235827a5c1d125
SHA512 4687dd11373b4d135cde17deb1da1ec5aca8b8d13d6839cce903adb19f7e989c9d6436bb90dbc483210e136d4aa86a21520e9f7e88e852591b059fe195a4f5a6
TLSH
T1AA31D453D2551E529D28AC468EB2591CBE18AD3740CF3C36FE4C833D6F097142BA4BAB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3768-399-0x0000027F12CD0000-0x0000027F13025000-memory.dmp

Download

memory/3768-398-0x0000027F12CD0000-0x0000027F13025000-memory.dmp

Download

memory/3788-914-0x000001E1B5660000-0x000001E1B5709000-memory.dmp

Download

memory/5936-184-0x0000026A09460000-0x0000026A09509000-memory.dmp

Download

memory/6056-46-0x00007FF8549D0000-0x00007FF8549E0000-memory.dmp

Download

memory/6056-698-0x000001D5B04C0000-0x000001D5B0815000-memory.dmp

Download

memory/6056-382-0x000001D5B04C0000-0x000001D5B0815000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads