85169caca0cac605ac102721371bf63d9731efb1d2cfecaa80d66909356eda31

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MiniMeters v1.0.29.252 Installer.exe
Size 43.1MB
Sample260506-yaastadv2j
SHA256 85169caca0cac605ac102721371bf63d9731efb1d2cfecaa80d66909356eda31
MD5 5aa6c45bb431f70b6e93b67e0d3e40e2
SHA1 eaa7c0b98f3450dfcefef67ac0173a7b30be7f6a
SHA512 19513b46722788789c42d3ee9402efbb800680c86f4c720ffa27dbe6b54548b62bca649f136b15d2ede1f1f4207c6b893209bf5c3cfa68430758bcc4e95b9994
SSDEEP 786432:nMNs+rPcHg4iGs9+p5TtohAnBXJg5v3W4gFMoyd4X6MKU0zalU0upwccOcaH:nMLrUiF+fuhAdJ0WtMoyuX6fIVORH
TLSH
T145A7332212F1F596DDB7D33A49107F1FA05776DCADEC8500EAA6A44CDCBEE4B63018A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Audio-Server.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Audio-Server.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Loudness.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Oscilloscope.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrogram.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - VU.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Waveform.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Loudness.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrogram.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrum.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - VU.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Waveform.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\MiniMeters\MiniMeters.exe	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\MiniMeters\UninstallMiniMeters.exe	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Stereometer.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrum.clap	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Oscilloscope.vst3	MiniMeters v1.0.29.252 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Stereometer.clap	MiniMeters v1.0.29.252 Installer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2440_173434143\manifest.json	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3244	MiniMeters.exe

Loads dropped DLL 2 IoCs

pid	Process
2948	MiniMeters v1.0.29.252 Installer.exe
2948	MiniMeters v1.0.29.252 Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiniMeters v1.0.29.252 Installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225698258262772"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{797CEC8D-181F-4685-A29C-CA027688A399}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3244	MiniMeters.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3244	MiniMeters.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3244	2948	MiniMeters v1.0.29.252 Installer.exe	80
PID 2948 wrote to memory of 2440	2948	MiniMeters v1.0.29.252 Installer.exe	81
PID 2440 wrote to memory of 3484	2440	msedge.exe	82
PID 2440 wrote to memory of 4740	2440	msedge.exe	83
PID 2440 wrote to memory of 1136	2440	msedge.exe	84
PID 2440 wrote to memory of 1136	2440	msedge.exe	84
PID 2440 wrote to memory of 1136	2440	msedge.exe	84
PID 2440 wrote to memory of 2504	2440	msedge.exe	85
PID 2440 wrote to memory of 2504	2440	msedge.exe	85
PID 2440 wrote to memory of 5108	2440	msedge.exe	87
PID 2440 wrote to memory of 5108	2440	msedge.exe	87
PID 2440 wrote to memory of 5108	2440	msedge.exe	87
PID 2440 wrote to memory of 4608	2440	msedge.exe	88
PID 2440 wrote to memory of 4608	2440	msedge.exe	88
PID 2440 wrote to memory of 4608	2440	msedge.exe	88
PID 2440 wrote to memory of 4320	2440	msedge.exe	90
PID 2440 wrote to memory of 4108	2440	msedge.exe	91
PID 2440 wrote to memory of 3332	2440	msedge.exe	92
PID 2440 wrote to memory of 4320	2440	msedge.exe	90
PID 2440 wrote to memory of 4320	2440	msedge.exe	90
PID 2440 wrote to memory of 4108	2440	msedge.exe	91
PID 2440 wrote to memory of 4108	2440	msedge.exe	91
PID 2440 wrote to memory of 3332	2440	msedge.exe	92
PID 2440 wrote to memory of 3332	2440	msedge.exe	92
PID 2440 wrote to memory of 3228	2440	msedge.exe	93
PID 2440 wrote to memory of 3228	2440	msedge.exe	93
PID 2440 wrote to memory of 3228	2440	msedge.exe	93
PID 2440 wrote to memory of 4064	2440	msedge.exe	95
PID 2440 wrote to memory of 4064	2440	msedge.exe	95
PID 2440 wrote to memory of 4964	2440	msedge.exe	96
PID 2440 wrote to memory of 4768	2440	msedge.exe	98
PID 2440 wrote to memory of 3564	2440	msedge.exe	99
PID 2440 wrote to memory of 3912	2440	msedge.exe	100
PID 2440 wrote to memory of 1924	2440	msedge.exe	101
PID 2440 wrote to memory of 2636	2440	msedge.exe	102
PID 2440 wrote to memory of 2972	2440	msedge.exe	103
PID 2440 wrote to memory of 4768	2440	msedge.exe	98
PID 2440 wrote to memory of 4092	2440	msedge.exe	104
PID 2440 wrote to memory of 4768	2440	msedge.exe	98
PID 2440 wrote to memory of 4808	2440	msedge.exe	105
PID 2440 wrote to memory of 1788	2440	msedge.exe	97
PID 2440 wrote to memory of 4964	2440	msedge.exe	96
PID 2440 wrote to memory of 4964	2440	msedge.exe	96
PID 2440 wrote to memory of 3912	2440	msedge.exe	100
PID 2440 wrote to memory of 3912	2440	msedge.exe	100
PID 2440 wrote to memory of 3564	2440	msedge.exe	99
PID 2440 wrote to memory of 3564	2440	msedge.exe	99
PID 2440 wrote to memory of 1924	2440	msedge.exe	101
PID 2440 wrote to memory of 1924	2440	msedge.exe	101
PID 2440 wrote to memory of 2636	2440	msedge.exe	102
PID 2440 wrote to memory of 2636	2440	msedge.exe	102
PID 2440 wrote to memory of 2972	2440	msedge.exe	103
PID 2440 wrote to memory of 2972	2440	msedge.exe	103
PID 2440 wrote to memory of 4092	2440	msedge.exe	104
PID 2440 wrote to memory of 4092	2440	msedge.exe	104
PID 2440 wrote to memory of 4808	2440	msedge.exe	105
PID 2440 wrote to memory of 4808	2440	msedge.exe	105
PID 2440 wrote to memory of 1788	2440	msedge.exe	97
PID 2440 wrote to memory of 1788	2440	msedge.exe	97
PID 2440 wrote to memory of 2804	2440	msedge.exe	106
PID 2440 wrote to memory of 2804	2440	msedge.exe	106
PID 2440 wrote to memory of 572	2440	msedge.exe	107
PID 2440 wrote to memory of 5068	2440	msedge.exe	108
PID 2440 wrote to memory of 572	2440	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.29.252 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.29.252 Installer.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files\MiniMeters\MiniMeters.exe
  "C:\Program Files\MiniMeters\MiniMeters.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://minimeters.app/help
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7ffea93ec188,0x7ffea93ec194,0x7ffea93ec1a0
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6251475366004015523,9598858080880553907,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,12520545637191250801,7497796226451297037,262144 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,10808864480274200820,15565459796653167416,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,11970761422961060554,9364609463541046722,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,9010741756851117717,8701865427817574512,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,16077185630697254934,15644184077715308858,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,9811803636262282199,10338332696639585639,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:9
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4148,i,16571240830897634987,2685397028009387701,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4160,i,1989358744956739227,8445019863870620258,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,1592733418866969092,1507395975614197655,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5392,i,4177256714789552432,5724532733744670961,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3596,i,14693206428784139888,6256680713451580200,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5396,i,5344404799728651372,811937760384957455,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3836,i,18373972461401879230,14600915323888898912,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5368,i,15670622188622871214,17641820075439720977,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5332,i,5006219517239490972,10494198519322871883,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5324,i,6927149971099107114,8446427152760873717,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5292,i,11749048656796261210,6461355595180779905,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5360,i,11954294028085803088,13367951969849249503,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5364,i,5518039000868276497,11200885948487057376,2097152 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,6417610838214379060,10584329771288338169,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,143444639225761614,10023590324317435535,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,546040519370975137,17377495349049288213,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,16074631818649237197,265412418101207651,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:14
    3⤵
    PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,9291579078803330523,11266945578564199365,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,9291579078803330523,11266945578564199365,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8228,i,10128107780166283505,8464592111713405079,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:14
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,219613812450039593,16701815882020866614,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8416,i,18185722052658393166,12135107347633513989,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:14
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8712,i,16087189642397885228,16056755904800582738,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8544,i,10553295376349765321,15138038140653984731,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,13039013024919081447,9694471584018080535,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,6782996860810879215,8592544273662349659,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,16280422933601045173,1929298639074694003,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,11032134918763365713,1251651692904531359,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,807380211642609510,8262267792943706796,524288 --field-trial-handle=2780,i,10030127501672474696,4647976529887822051,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MiniMeters.exe

Path C:\Program Files\MiniMeters\MiniMeters.exe
Size 5.1MB
SHA256 7581de40cf04568463dae5a93ee10d025bc50b236a0079cec1db15873affb805
MD5 29a3293b8f83246ff25d2b0a7d411973
SHA1 ba78cb81cb06a36904baeaf6c8f9a65dc38b380a
SHA512 3ef54b84e19368dcef5cbf12138e8e5ed6cacdb2eeeb2ed7a046101cdf4c53d989af5b97e52772374128af002f4f8d6eb8f45a16afac535402c7935e7cb47b68
SSDEEP 49152:dENOt95pLbfFPlyv/TmFiT8TKO0hiSdMpXKRgzl4S7gxj2mkmcxb1qgJMcmWZ5WG:zzfOD7Lyzl4Qy2/Y0oq
TLSH
T1A7368D4B7166A0E8D535C0756287D01647327C8B0B647CEF21A18A763FABDE21FBE90D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

81e16e40d4f29486_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81e16e40d4f29486_0
Size 5KB
SHA256 3f7b893f286fd44dee2737b51657c4b4b8cbc5f9629a611b3dd4a10e8cef8776
MD5 ccbc357d40c472253435323eacad49ad
SHA1 7b2dca4c6abd698e609cd3a60a223eaf0103a438
SHA512 03b71f907ba2d6d244cd98ae9c7583885d2c4edeab9586f8541fe052e430d71f74c72dcc89f158847753319d1548401ba7e501be795c5e6be1797268e6fcf02b
SSDEEP 96:cXe9y1FItDHv5tE928i3XPG8VJ4Fbk1bIlwahhYUVjyTDymxQ2j/:+eK+P5t+ZYxQiI3jY
TLSH
T179B164C25B6D6E4ACD2213FE42958665B3B4520A2F83C33722D543716C5A3F74D0B907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 97f4cbb1a084050605e1699b79327ecb363d2ee92b885a4ba8b8cbbb05025b28
MD5 39782f9cbc7af813c7eb3c5b68460d9a
SHA1 636243fb0a7945ca6a17443026160a574287a6f5
SHA512 de4a31dba6b2587502f9d2a266c57e301b812460b85ff737a601cc30311529231bcfafe48b0f3aaeee43da7edf87b2aa66195c4760bbeae7e5ec4719c30869c1
TLSH
T14061F5A6D1918C6BE3F5337101EC265A7EE07E48813A1E27C6F109FEFB927BA9080404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590323.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590323.TMP
Size 3KB
SHA256 98fec402a0b531eec535d1779dd08e9117a01dc5aa8357a79009f022d62a5819
MD5 61e084748ba04b47d1778e81b723bf8c
SHA1 196ec07e1bb115c2be2eebfea3ed50b20843deb9
SHA512 3dc1f5866b697c9a3cb035f76d26ef72e25cbc16c29300326c46599387fbc0dc3c38827797b0e71fc51af3d302c6b66a6feba639f0102570fd71285cf87c7510
TLSH
T1B161F696D1918C6BE3F5337001DC275ABEE07E48803A1E67C6F109FEFB927BA9180404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25405987b085e43f40eda0085abfb2973f8ffbd3a9e03a2d72bc73f95633702e
MD5 188afc835691b33358edaa2339ac8f91
SHA1 7dcdd8e27d176b548e26bd9a7c8f3426e2b3967a
SHA512 3cd9776e649bdff227f0174e9fec3036b06475a9e1718e4d8bc84c0ecfc95dc2057ee94eee5081464cf1b6dbedcc7d5759d9d18090196d3a3ad49c3a0aa1453b
TLSH
T17551ADF3C7D8856D8A1156F0AA146E2FCE1D0A14432C3D5A89E4EF5BD3E3471E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7bc331cea61f38d7b9259160e3ecc7a54f5e2c5968bf16232fee7096e4821716
MD5 46aead91bd32d8a99e38bc16976df09d
SHA1 4a84830363ce4db06308e752003cb6c15f5e17a7
SHA512 cdaef3a719571a57d02ce8315c4579f66b844aa3839edfb5091f2e7cbcec9706e02e945f6372a49f3513017ae80a215613e6914679691a0b98a99386241b5bed
SSDEEP 192:sxZ0RAyM//K1Ml8Mcx/f6sq9sFWRexyOxiHIdpyQ/W6+WNI75/Y0XJuyeU+dBIgc:sxZ0e0x/f6s4sUkLiI//ba/5gUgc
TLSH
T12352FA15AA34597BCCEBD20DBA55BF53D6F95462E2900D4499FCCA0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 286b9f91b553628c94c25e417f2b22b59b3a069075b507d8be30ab2827647d8c
MD5 4f0f5a44810a41c3d792b1d9b5048976
SHA1 1941a3fe6b53362691f8632647ac4cf66b1efdb6
SHA512 0c2fda2fa7c82b0bb9a075eb12e448e1bb7d5aa0852be2a0f996bbb5af44772bcd2f59f423fed920aec6dfb35fdfd99bd90327c49a50eef8be5aa71996cf03c4
SSDEEP 768:wXTTF8J52MF7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3oStfLlw:wXTTF8J52MTEnYwWRmY4QPUu1jaKoSt6
TLSH
T16D031D3B280CCB7F4F844E9CEC2ABF9A6DE8018B9698C99447F9444C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b8dc326eb6167796a0127a28b5e3550cf5189a122fc29971cb1fab7b0228425e
MD5 62628363f0bd26d0d238feb7221d7514
SHA1 76fc3a5bd3062f9fffec4a59cfa1010c8b8bf9ac
SHA512 0d6735ced276dc3ac54d6ad444643f94b66186ce4182b3ac81d88789ecc088d0c7254286ad00a224dd00bdd3bc7d5eb8e77e79defa10600f176c363b0063ccfb
SSDEEP 96:KwzeKc4mKKQKDS6uNiK2IIHaK0ACiwgKtOF:YFXvVchr+
TLSH
T140D1FE91B33A83C03A7E249A91E4B47F16C330633018A53A77B911B60B6EE64DCFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

385ebd75-8adc-4b11-95e5-dba757b0d21e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\385ebd75-8adc-4b11-95e5-dba757b0d21e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 10126a3b73cfba111bd87e768e69c8fe438983c10227685cb0dd60def3874434
MD5 a040eccd0c81e47b13b48ad153fa7370
SHA1 05354cc48ead8e81b4249cf5c29f221fa1f74d10
SHA512 88b88a73b186f3d7517998e1555426d7660b31490077195702834d7f971b0a89dc675cee92a11a25b088acd0f6f6a22c3394e0c2eaf928398b543f5a12124ce0
SSDEEP 192:uu5CF8N5UYotMXQZJ7MGl5nQmiU1pAF74kc/TZ7+/XWFF5SRDgJqTkU8:no8N5UjMXEJVlPTIkkc/TZ7+eFeg5U8
TLSH
T15D422A316C799C3B59E7A645F04B3B73AEA41077AAC42F98C5E98B0C04CB39C271F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9953057a225812ff91e74f6064bd3d05affc8f849fe91155ace7f43cdcddfd6c
MD5 6f0d1c2ebbba31e1c9bbe25735e8d61d
SHA1 ac8019314d83384aaa88d4aff428d9e8411c82b8
SHA512 66b68573953a02fe1232e9acf68370fb4b59e1a0ac72fa0aa7858c806185da34401d4c7d9f93edfead88c803c86bc7cbbc051551e23c4c43638dbbfe69d87fd6
SSDEEP 384:n5iFBcXqnn8Na8TUNTUlIl4WPEJVlPTBkjDfwac/TZ7+eF1g5t1r55bYv7p:QFlnfwgCWEVtBJac/lJg595b6p
TLSH
T1A2D2A4F188D7893BD8AE4787A33E7E529EBCD163B5881984B7845E0CCC821BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 641151a932f766f04d93dcdccf976e76a2b46f432097f9d569b793518146cf33
MD5 373d3bb0c5eb117941b1a424344e09f7
SHA1 1d0c858ffdb5edcfe8561611295e234d37567c4c
SHA512 9efa82ebbbffde3d9cd637810599466652455f73771ea21783fd39c1489b544630fef42830f2c016091e5cd0c0e9714dae1601d0c129d480dd3445ea38bbeaf6
SSDEEP 384:n2cXqnp8N5U4WPEJVlPTIkkc/TZ7+eFeg5t1r55bYv7p:kpCWEVtI3c/lig595b6p
TLSH
T109827D715C799C3B88EBA689F05B37639FB021B7DA841F88D5E89B0C04DA7DC270B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52c1629eda24d2ba50471549c1dffeae1fff9042f8a23954b3d08af313b8fac3
MD5 3f7108d874e4fe90af299cf3bf4b5bd6
SHA1 bcc32efe5b83d819ff92844952da60f3f1fd63a2
SHA512 731ac0c0561494e3589d728fdfb4a88d37c687c4bd0d1a282b84b6bc01d7c76dc715b6d7db0c02f9a1d628f204a6d899634b4133bba73714890c422c842d464d
SSDEEP 192:DGNT6IMGYQmiUyp+ckxc/TZ7+/XWFFrS66gJqTkU6:DGNT6G4iNkxc/TZ7+eFQg5U6
TLSH
T1581229316879AC3B5EE3B941F08B3773AE941177AA846F98D5D45B1C04DB39C2B0B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48f995baa6cb95c42a557e1fcdeece51a1a54da8fc6418a2811f5c76748509ae
MD5 671749c5f3797a1a030c0262f1db566e
SHA1 b877bad0212fa99f2ef5f121b3ac4d264f7fba37
SHA512 78dd613ea69c89b5a5f17235575c8c7bbebdb7530049b8d7fe47743f9f3fa52a5942b48f2bdf59b9c989039c9809348eec30e10e2211766d9cb74a692b74ddcd
SSDEEP 192:lGN06IMGEQmiUypkTc6xc/TZ7+/XWSepgW6CdU6:lGN06GUikg6xc/TZ7+OgWfU6
TLSH
T13002E83568787CBB9EF3AE45B44737239F94116BA6942FD8C9E41B1D00DB75C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6a48f141-2b5a-4b09-bbb0-032c6fac21da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6a48f141-2b5a-4b09-bbb0-032c6fac21da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6460b63b-cea9-46cc-84a8-fcc0ca2fe219.tmp

Path C:\Users\Admin\AppData\Local\Temp\6460b63b-cea9-46cc-84a8-fcc0ca2fe219.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ba2d12a7-ea0b-4c93-8409-59cb9c063627.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba2d12a7-ea0b-4c93-8409-59cb9c063627.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edb58df0-4216-47dd-a43c-029560ce9b47.tmp

Path C:\Users\Admin\AppData\Local\Temp\edb58df0-4216-47dd-a43c-029560ce9b47.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minimeters_shader_cache_-5980775891053976249_vs_5_0_Texture.bin.tmp

Path C:\Users\Admin\AppData\Local\Temp\minimeters_shader_cache_-5980775891053976249_vs_5_0_Texture.bin.tmp
Size 1008B
SHA256 e6d99ce8e7c9063cc71da180189b32a3170272a0d56ad0a9755f2135223beea4
MD5 07f9aa9005e895a8e4fa18889c48f5d5
SHA1 68f28084b2ee4e5e870809aef14e1427c017651d
SHA512 6b735299fc329c85f11db0885f074ae557d02aa6c4372e45bdf93beee0151958421deadba74b2d2e057462cd5fe8cd53287b349c567ba8b8afd41c84d1e7cc1d
TLSH
T1A411460267C9DC67C63D93B188DB1342737BF0806FA39B67A444A6769D1A3C09B1760D
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu1113.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu1113.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu1113.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2440_1338230466\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansJP-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansJP-Medium.ttf
Size 5.5MB
SHA256 fdb4044741bc68f30ea8b92c1aefd920530a2d044f8753a6148148abdeb33958
MD5 818eefff2fa0b989124d9ba3a84f073c
SHA1 07ce11b5f8c64155d30fcdbf849b82e3840cb53c
SHA512 96483c07afd1a7b6177f00ba3794a2e6ba321ba7aa4ac57b491482308a106d0fd08f8735e2b5e9241cd13ab140702015678401875de574a0793364b5dbe19e67
SSDEEP 49152:Oi7/LBcP8JrdDMLDgAU0Z8J5CcIYsEfWLhM4zja/gomukguQYwQLWOPhK7TK:nbmkDKBc5CcRIC4aozukrwUWOuK
TLSH
T15D463987266D3D8BC1B56BBC554150BCF0CFC82DAB99D3F09DDBFC5A418A4421C42BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansTC-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansTC-Medium.ttf
Size 6.8MB
SHA256 6dab5509da393017701282da4f8373731ff5471bdeab05c08cf06be2a2738b1e
MD5 77bb826ea1eacfcd234608d3dedd1e2d
SHA1 0207e8e9dde26122d25e4880cc340ac9fdea5a9a
SHA512 c63711f90771a1dfde7f6328ad63ad2ac72f768fea2bcc0719f3df2e127a178711c083c17e8fcae00b08ac4411ed9768fe38fbe542bf43cc1ef91f9d4cc6a482
SSDEEP 98304:GqbyX/gAuQ9eEFUi2t2ZMp06WRWWzfiWvz36JzEEILyT:Bt8e7x1ajoEbW
TLSH
T15F6659C7165E39CB81A52BBC544190ACF1DFD82DAB99D3F4CDE7FC5A40964420C82BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default (Horizontal).mms

Path C:\Users\Admin\AppData\Roaming\MiniMeters\Presets\Default (Horizontal).mms
Size 1KB
SHA256 35caffbec000dfb1b488c1f3b00295a0ed8382797a1a444951e868c7e7a43221
MD5 094aa8cae1852e44de11ee406bbac797
SHA1 c8ed9f5a45e5dd4572268d315a235827a5c1d125
SHA512 4687dd11373b4d135cde17deb1da1ec5aca8b8d13d6839cce903adb19f7e989c9d6436bb90dbc483210e136d4aa86a21520e9f7e88e852591b059fe195a4f5a6
TLSH
T1AA31D453D2551E529D28AC468EB2591CBE18AD3740CF3C36FE4C833D6F097142BA4BAB
MD5 SHA1 SHA512 TLSH

Submit Download

MiniMeters.lnk

Path C:\Users\Admin\Desktop\MiniMeters.lnk
Size 920B
SHA256 bec4a4a0bc538140e3eeffa164d1bd8b228fed189e7c06f1c965b7a7902ce80c
MD5 f98e3766f5a557ae4f404962058440fc
SHA1 02f903b3aac3f37645c7478d7b88505387d159e9
SHA512 5f723e844e7fe8b7085d40fcd4834ef4859ead30a55d81900ee02465108504c740fcbd64959d690529dfcffcdddd7867c5ff5dd530f067c322175c5e7ce62e3c
TLSH
T1DC11BD0413F75A52E2F389F12971C318A72BB82CCB145B0E40E812890477404E578FB3
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2440_173434143\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1948-702-0x000002ACD6000000-0x000002ACD60D6000-memory.dmp

Download

memory/3244-725-0x0000021072F80000-0x000002107302E000-memory.dmp

Download

memory/3244-664-0x0000021072F80000-0x000002107302E000-memory.dmp

Download

memory/3244-46-0x00007FFE87FC0000-0x00007FFE87FD0000-memory.dmp

Download

memory/3948-200-0x000001C24F130000-0x000001C24F1DF000-memory.dmp

Download

memory/4184-282-0x000001ABD1320000-0x000001ABD13CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads