aa55deb32c78ac7d3abb3310eb0e95be28b469a54cf9ea0744a0727211019a71

Analysis

user interaction
yes
max time kernel
122s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ggg.exe
Size 41.8MB
Sample260710-va915afv4y
SHA256 aa55deb32c78ac7d3abb3310eb0e95be28b469a54cf9ea0744a0727211019a71
MD5 6dcc4b896ec7446dce3530c5b0ca7c0c
SHA1 93112d9fcfa5bcca7d4e9e240d180059c9922f41
SHA512 ea3a0ca6da52fcf44be8f194896a62c3ba32e63b56b5870cbec4e699590af2bf719bb4f3585d1f4095150d4eae6b69d95937613b453f6526d599207293c16b0c
SSDEEP 786432:UmfG1cpJLqG3FyuJksHsRi4R+VPG2BmOTQwM1xhh5xU+ppNli/:UmfQcpJmGUuJksHqn+VPG2AOpwppNE
TLSH
T18EA733AD5BC8851AC49CE9F2F306C9A7F3806D36175F44E0624EBE0F63B8638A745B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.PNF	VBVoicemeeterVAIO_Setup_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\vbvoicemeetervaio64_win10.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A1A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A1A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A08.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A19.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A19.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\SET7A08.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\vbvoicemeetervaio64_win10.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{434aa255-61a8-344c-8476-d308c8e9c669}\vbvoicemeetervaio64_win10.sys	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio_win10.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\mp3lame\lame_License.txt	ggg.exe
File opened for modification	C:\Program Files\VB\VBVoicemeeterVAIOs\vbvoicemeetervaio64_win10.inf	VBVoicemeeterVAIO_Setup_x64.exe
File opened for modification	C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_ControlPanel.exe	VBVoicemeeterVAIO_Setup_x64.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio_win10.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterMacroButtons.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_2003.sys	ggg.exe
File opened for modification	C:\Program Files (x86)\VB\Voicemeeter\ggg.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_2003.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_win10.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_xp.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\voicemeeter_x64.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbusbgpi_uart.inf	ggg.exe
File created	C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_Setup_x64.exe	VBVoicemeeterVAIO_Setup_x64.exe
File created	C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_ControlPanel.exe	VBVoicemeeterVAIO_Setup_x64.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_win10.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_2003.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio64_vista.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro_x64.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBanana_Help.xml	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterRemote64.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_vista.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_2003.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_2003.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBAN2MIDI.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_2003.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio_xp.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_2003.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\voicemeeter.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBAudioLogoWhite_72x72.png	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64_win10.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_win7.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio64_win7.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio64_win10.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSMatrix8.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_vista.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_win7.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64arm_win10.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_win7.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBAudioLogoBlack_72x72.png	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbusbgpi_uart_xp_vista.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_win7.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_win7.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_win10.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBVMAUX_Setup_x64.exe	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_vista.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_win10.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\mp3lame\lame_enc.dll	ggg.exe
File opened for modification	C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_Setup_x64.exe	VBVoicemeeterVAIO_Setup_x64.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_vista.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_vista.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterRemote.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_win10.sys	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_vista.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_win10.cat	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio_vista.inf	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver.dll	ggg.exe
File created	C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio_win7.inf	ggg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	VBVoicemeeterVAIO_Setup_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe

Executes dropped EXE 4 IoCs

pid	Process
1404	VBVoicemeeterVAIO_Setup_x64.exe
2612	vbregsvr64.exe
1568	vbregsvr64.exe
480	vbregsvr64.exe

Loads dropped DLL 6 IoCs

pid	Process
4960	ggg.exe
4960	ggg.exe
4960	ggg.exe
2612	vbregsvr64.exe
1568	vbregsvr64.exe
480	vbregsvr64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggg.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1632	msedge.exe
4832	msedge.exe

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	ggg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	ggg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ggg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	ggg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	ggg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	ggg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	VBVoicemeeterVAIO_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	VBVoicemeeterVAIO_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	VBVoicemeeterVAIO_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	VBVoicemeeterVAIO_Setup_x64.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{A17E78FA-1D29-4DC7-980F-799EA452A396}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\ = "Voicemeeter Insert Virtual ASIO"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmins_asiodriver.dll"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\ = "Voicemeeter Virtual ASIO"	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{651635A1-BAD3-4419-B2B7-7E884E993425}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ThreadingModel = "Apartment"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\ = "Voicemeeter Insert Virtual ASIO"	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmins_asiodriver64.dll"	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ThreadingModel = "Apartment"	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ThreadingModel = "Apartment"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\ = "Voicemeeter AUX Virtual ASIO"	ggg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ThreadingModel = "Apartment"	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\ = "Voicemeeter AUX Virtual ASIO"	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\ = "Voicemeeter Virtual ASIO"	ggg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvm_asiodriver64.dll"	vbregsvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ThreadingModel = "Apartment"	vbregsvr64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvm_asiodriver.dll"	ggg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmaux_asiodriver.dll"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ThreadingModel = "Apartment"	ggg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmaux_asiodriver64.dll"	vbregsvr64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1404	VBVoicemeeterVAIO_Setup_x64.exe
Token: SeRestorePrivilege	1596	DrvInst.exe
Token: SeBackupPrivilege	1596	DrvInst.exe
Token: SeRestorePrivilege	1596	DrvInst.exe
Token: SeBackupPrivilege	1596	DrvInst.exe
Token: SeLoadDriverPrivilege	1596	DrvInst.exe
Token: SeLoadDriverPrivilege	1596	DrvInst.exe
Token: SeLoadDriverPrivilege	1596	DrvInst.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1404	4960	ggg.exe	86
PID 4960 wrote to memory of 2612	4960	ggg.exe	91
PID 4960 wrote to memory of 1568	4960	ggg.exe	92
PID 4960 wrote to memory of 480	4960	ggg.exe	93
PID 4960 wrote to memory of 1104	4960	ggg.exe	96
PID 1104 wrote to memory of 4200	1104	msedge.exe	97
PID 1104 wrote to memory of 4832	1104	msedge.exe	99
PID 1104 wrote to memory of 4776	1104	msedge.exe	100
PID 1104 wrote to memory of 4776	1104	msedge.exe	100
PID 1104 wrote to memory of 4776	1104	msedge.exe	100
PID 1104 wrote to memory of 3304	1104	msedge.exe	101
PID 1104 wrote to memory of 3304	1104	msedge.exe	101
PID 1104 wrote to memory of 1656	1104	msedge.exe	103
PID 1104 wrote to memory of 1656	1104	msedge.exe	103
PID 1104 wrote to memory of 2308	1104	msedge.exe	115
PID 1104 wrote to memory of 1656	1104	msedge.exe	103
PID 1104 wrote to memory of 2308	1104	msedge.exe	115
PID 1104 wrote to memory of 2308	1104	msedge.exe	115
PID 1104 wrote to memory of 1428	1104	msedge.exe	104
PID 1104 wrote to memory of 1428	1104	msedge.exe	104
PID 1104 wrote to memory of 1428	1104	msedge.exe	104
PID 1104 wrote to memory of 2488	1104	msedge.exe	105
PID 1104 wrote to memory of 2488	1104	msedge.exe	105
PID 1104 wrote to memory of 2488	1104	msedge.exe	105
PID 1104 wrote to memory of 4220	1104	msedge.exe	107
PID 1104 wrote to memory of 4220	1104	msedge.exe	107
PID 1104 wrote to memory of 2764	1104	msedge.exe	108
PID 1104 wrote to memory of 784	1104	msedge.exe	109
PID 1104 wrote to memory of 2764	1104	msedge.exe	108
PID 1104 wrote to memory of 784	1104	msedge.exe	109
PID 1104 wrote to memory of 1256	1104	msedge.exe	111
PID 1104 wrote to memory of 5964	1104	msedge.exe	114
PID 1104 wrote to memory of 5964	1104	msedge.exe	114
PID 1104 wrote to memory of 2308	1104	msedge.exe	115
PID 1104 wrote to memory of 2308	1104	msedge.exe	115
PID 1104 wrote to memory of 4436	1104	msedge.exe	117
PID 4436 wrote to memory of 2888	4436	msedge.exe	118
PID 4436 wrote to memory of 3900	4436	msedge.exe	119
PID 4436 wrote to memory of 1632	4436	msedge.exe	121
PID 4436 wrote to memory of 3900	4436	msedge.exe	119
PID 4436 wrote to memory of 3900	4436	msedge.exe	119
PID 4436 wrote to memory of 2992	4436	msedge.exe	122
PID 4436 wrote to memory of 2992	4436	msedge.exe	122
PID 4436 wrote to memory of 5624	4436	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\ggg.exe
"C:\Users\Admin\AppData\Local\Temp\ggg.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe
  -h -i -H -n
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe
  -fC:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2612
- C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe
  -fC:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:1568
- C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe
  -fC:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vb-audio.com/Voicemeeter/ThankYou.htm
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,16571844678264039737,7229726344886423397,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,256935666681235826,17905706415775596686,262144 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1504285354334443068,10747312426150826670,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7138216558501593703,3907139093971283628,2097152 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,6602138068384394235,2930585232300632227,2097152 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,1140063661755417727,14739414753380347751,2097152 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,17528850970512649336,9926884912311256014,2097152 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,10293366783459249304,17132003905981553264,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13302381063741493210,1307848771625982670,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,16512534980358519662,15437260380417842562,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16296484228231719196,8553927869151773661,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,16296484228231719196,8553927869151773661,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,329510686604960607,10938951154971642081,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8917094735788551905,5777444080791403158,524288 --field-trial-handle=2540,i,11217529151053259651,4911247520189274355,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,10194280927153737365,3615394906319226583,262144 --field-trial-handle=2492,i,888897774588071437,7651988949630293484,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,17753353186554212152,7507137812058946678,524288 --field-trial-handle=2492,i,888897774588071437,7651988949630293484,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
      4⤵
      System Time Discovery
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,9070263106905704818,16815374381842475371,524288 --field-trial-handle=2492,i,888897774588071437,7651988949630293484,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:13
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,8866524877618466350,2857043470809498102,524288 --field-trial-handle=2492,i,888897774588071437,7651988949630293484,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,8866524877618466350,2857043470809498102,524288 --field-trial-handle=2492,i,888897774588071437,7651988949630293484,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:5624

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{99848a28-0030-8742-b9ff-8913a1ff2578}\vbvoicemeetervaio64_win10.inf" "9" "43914f2f7" "00000000000000E0" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\vb\voicemeeter"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5192

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.inf" "oem1.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.4.1.7:vbvoicemeetervaio," "43914f2f7" "00000000000000E0" "df63"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBAN2MIDI.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VBAN2MIDI.exe
Size 320KB
SHA256 baf390d96ba8f0100af74007a52481bd3825949faf4bcbc259fe47492994d87b
MD5 0c2cf9740d7e27330a1105d7376364d1
SHA1 52c15fcad864d5fab096ceb2d911796c40d5248c
SHA512 74cbbb435c30b17d547ed18a24cce27e560c87ff31a39f6f2c94de070c492e3bb1fa2b86cb30133ad0af272b283658dd42b86f52850f524aa2133868e95a9a22
SSDEEP 3072:M9wULPR3U2miEbeVmT8Ma4MMub23oma61MOpC/yo2sdvpaV7I8:M9wSPROeVmT1aLl61MtJpC7
TLSH
T17864D3716AE644ACC766B03370F76E339AE79A35112D86079FF0C9F15B113A3EA1434A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBVoicemeeterVAIO_ControlPanel.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_ControlPanel.exe
Size 911KB
SHA256 082424386cb4afa8bf35fd54bd10ddff6a264b0d0540eef3bf7711e8ee93d61c
MD5 d773d44dc98035a368b8fd7419387f6e
SHA1 07a6b1b516b201cc234b433300cd7eb3c3ca157d
SHA512 6575190b788eceddc72bef428ce19f1f6ed19522bbcfde8cde85f45782c922c51e85c3f6e30ab7658da123e5301ceda05935a09a76b67225402cb547f3c86fff
SSDEEP 3072:qePIz7OyHc7S2fO8CU2DMzVcqYMUD4sQs2iBm1NRs/puUjw:+zqjfONU2DMzKqi43iBesu9
TLSH
T1DE15F6196252C369E867E4371477B961CCB8EC3B36A38C4E33443E5B0B32DB259617DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBVoicemeeterVAIO_Setup_x64.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe
Size 900KB
SHA256 28c6409a5ccebb1f83dc25660d800f95c22ca5eff05978f4e3bc780a50d37b61
MD5 f2add656a75cd81abf4a8980634e92a1
SHA1 e4d53b74d1a1abf41130c350490770226790e920
SHA512 d9925bdd348a97609a7a167ee1931bf875e3152904c4f447d8c2000af450e26e4433cea4485eded9c38f70b24d2f6a93c21308a9d6546b25e4ddd064190025ee
SSDEEP 12288:8mVqYhTZUI6HKhgS9APmGKRH3yMGhVBH22:lUYhTZ36HKhx9AP0RH3yMGHBH22
TLSH
T1B815F7E530623A03C9DC4536A518B7FDB8C41C44D625FA75AA3BB91C103A7D0B93A7FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VMStreamerView.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VMStreamerView.exe
Size 116KB
SHA256 5eee40deb81800710f80dd54daf47b6a1bb61909e9f06263bcca12add8224bbf
MD5 164bcf844f025ddb50cb81f4640fc62e
SHA1 0587fa84796d303dbf44296a2241dd27a68f13c0
SHA512 f5ca31da8ca6ef7fd714b1443179ba4a72dfbd8d528ed01e8f18e1b4f8763fcd68963e1b878210aec6644a74e4b793b269463d13b152c5b914f6cfb2b1e1ebc4
SSDEEP 1536:XC/337TLtaLKC7XYAFw6KJ6T/qiK4T8/dYgDXoVXgswt0I7AejHz:X237taR7IAFw3uJ4lYgDXoJwtRAejT
TLSH
T135C37D13F5D2C4F2E8824D71D4C6EE3E9A38FE6648598543E754FB0F6D31392922B24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemeeterBUSGEQ15.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSGEQ15.exe
Size 526KB
SHA256 54910065ce0530097d6c8cc1463fd208e4ced199868081528a3e4bc8f39d15b9
MD5 428f5d6c1ad8a8cc1ccb07b7de7b5836
SHA1 250252a7211ad9a4e5efc00f642197959751bdf6
SHA512 6d86d8db5e948892b16a21ad89df0939aa1bf85eb50322d0d7728724948ce5cf51c01cf4618b4a1ddbd792b00adcf5969a14ed96ee66c366955cf841cc59dbcd
SSDEEP 6144:JxMYwl1f5NZJaHUkkAOztiwCDKknYZZugBrBdbbb/uot65bbb3n6JPNNbbbb7bbL:TMRl1BNZIHUkk9VCDKknaZDZ/t6eF
TLSH
T10FB4F9C6690DEB3ED506EE384BAA0F320F740D14AD3754E696065E1C4FB4E23769F60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemeeterBUSMatrix8.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSMatrix8.exe
Size 157KB
SHA256 5e26c31db77526c7c76cd88117993772331883e6ab668601727ce10a7e418e8f
MD5 8f90b3cf9ae14522043edba0fe02d034
SHA1 d697d5b8c2130a5c99ab3ee043769a99c44410c5
SHA512 c90b81fd1c6bd8c07eba3f36432c42fabf013272dda7a359b6cdef0f663541083b9f6758a55b1b62eae24d3cd8fc8ac38af43caf188b3838c98da204e117b51a
SSDEEP 3072:HcrDZuIfdRchud4ujUpXQ1VAg0Fuw7sCssSiq9PCtFI3E:HykIFGW4ujUpXOAOqdiP+OE
TLSH
T17FF36B1572F2D433E4B205349CEDABE95D2878321B2A04FB37E42E6E4E703D12676766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemeeterMacroButtons.exe

Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterMacroButtons.exe
Size 2.1MB
SHA256 82ec62688ec027b3e0cbe742235f9a892df3c3ab53c87857c22ca27470e0b271
MD5 119f251cf9a108c746f80ccad8ca5090
SHA1 56c59123f9df655ce319f47475ea2ebb5eae977e
SHA512 363cb3e36bbd8fd4223f3df988a874b289d960f6496c73308f6582427eb11eacd33f0ae3bd082c450b0662082b974a1895234b0992f0abaf4b214b5eee867592
SSDEEP 49152:shUkCg3xtF8IIDhTgluVKOTIsxcAypVBGxyJ7zMTTdwfp5Y0CxO60JGoSDt:sBCg3vFNIdtVZEsqAkVB9J7zMTTdopbk
TLSH
T12FA51225FD41D02EC0A21572AAAF3BF3A4399D71332619D33BC07DA8AAB45E13577706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbregsvr64.exe

Path C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe
Size 47KB
SHA256 f2b62bef11048c74a7d1b2cd8e217738b3a7d627de6d001b298f034116626e6b
MD5 a8442fae07f1a7edca6fa2e0e94c2059
SHA1 d30851d5e11d9e87bb99ab4ecfaec2099b7e1156
SHA512 ca0de0d6e28864f84dd09ea38846eef0920a8cd63dcb950e9cffb9c0be057b0aa9cb59f209fe8181962c605924d2e77c837e2b3ed45fe700edd24a3cf66e5ac2
SSDEEP 768:S/xgTstByxlt03ivc8agWzJtv7kdn7kDbXyuuGz5BNntbVP:0xgTF1/Wjv7k9kD5rZx
TLSH
T104235B4B27A500F5E1A74730C8F29969EA33FC5367B5421F53A442AA1FA37C06E38776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvm_asiodriver.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver.dll
Size 104KB
SHA256 f29948019d4c4eb07b9a0ce5fef7cffb877617b1959fb5c90f52890be541eb64
MD5 a892e96083fc604983440f94fd6cc591
SHA1 68ea2da5591b9607074796ff5df8c0dd26ee311b
SHA512 92a9d802cce5552dd076a99d0162ed2db555e815daac1aa71164fea90ce145908983486d67dc7512e2b5dae16de2e28b4aa96693b33a1c290b9666fe8abb35d9
SSDEEP 1536:uaDrZKNTd1omHMEFB0Jou1iK21ct0IjMIrI:ua5KdNH0JoAiKnaIc
TLSH
T175A38D222591C7B2E557443329B7BA3BBA37EA512ADF4C83FB15C5051F213B0EA36207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvm_asiodriver64.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll
Size 122KB
SHA256 f8d17fb939f6cf7f2a4ea42ad1925bd67ec51c88e43dbbf4c4296aa4499b80a0
MD5 fc454e758b637695f756bff5efce6117
SHA1 33ee4d6bf58ad222b46366792e343563b7385f1d
SHA512 6104e0648a6a6c0cbf6abbe7043a8124c201a54505d8cac62493403d7cc5c59cd59d8d423bcdf0acfd48ef68dd818a662ab0eabb0f2e0ff88cebfa45b0f3ebd0
SSDEEP 3072:7YyMiDaT4z5X6hHZt5k8yOrjrBeWf3SiqzlIM:DTeT4NX6hH7O8zTB3KJ
TLSH
T152C35B8732A482B7E557427ACEF36A05D772F486137A4B8F6264425A1F233F17E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvmaux_asiodriver.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver.dll
Size 104KB
SHA256 075f0bb1449beb617ae489de09577ab30d1c7414f6541e26b975071995beb7dc
MD5 dd808d08690337397d0a789b4ea635b6
SHA1 23ffb973f6471b8fa4111dc2271826f4c96d1df9
SHA512 2a92be83080ac64b89a83f38336f2e2dad9e5dd8fd71ddfc22287aef8712986b715975747ba4d8b8fc43de5cc8b018e29345c05aef36540c9ad5d6e25909dc00
SSDEEP 1536:u0jLOYT9CohHMZDI17oCCwr0JoR1iLT1cG0I5Irc:u0WrnG0JojiLlPI4
TLSH
T11CA39F222691C7B2E557443369F7BA37B63BED112ADF4C83FB15C6051F213B1AA36206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvmaux_asiodriver64.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll
Size 122KB
SHA256 33fa84911f9ade10ba9c796f99afa3948ef0a6011e2e707289a50629af231ea8
MD5 ebb4e1068c19da9f75b30979d72b9fc9
SHA1 86788c9d610b1a68e76949fc7570f71d369a2606
SHA512 bb110169a79e924b7c630604a4fd733cb6a907d66b1e79ad45dd3ac68fd968422c93911b00ac3a6b03446195803ac600aaf85e9dbf6c15e1ef92e4e612e3e1b4
SSDEEP 3072:i55h0tO1VT0eZ7bXhmJtJP0ywFrjEB3gEirqfI2:m6OrT0O7bXhmrx03MBQat
TLSH
T198C36D4732A482B7D557427ACEF36A05E772F486537B4B8F6224425A1F233F16E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvmins_asiodriver.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver.dll
Size 104KB
SHA256 04bf4055bee6e494fbe6a5a70dc6171ab7888f06f5c9a500f28f493273a9053e
MD5 e84fef568e6bb6f1d5a19cf6d0ece326
SHA1 893a67b6132b3160c9b35d4efa55d5afb2b3db7b
SHA512 5b0f221c4eaae9b18483d6ccfabbaad01e12b6cf9b51d233402cb2fd586dc2bfb6733c9d40409a50330546e98e415ba4720cb284fdd0923c6a82ef08d5b9f0f2
SSDEEP 1536:ue+r9/5a3TW6om7Haf9Mw4UJo41K5zPEjKrulH0Iw9Irwp:uH6f3GaxUJoOK57V0C9I0p
TLSH
T10CA3BF3369D146B3E5864531B4D74A3BFA79FE120ADA48C3DB16D6161F213A0FA36307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvmins_asiodriver64.dll

Path C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll
Size 122KB
SHA256 d19d5e0fddd96f846c8bb1e606d180440fcc26eed1c4b5ca464d73da8e980c0e
MD5 19387222bd35f74adab6c1716f1033df
SHA1 1d49066d297ab67a105a6c67e12a171c041d2ca7
SHA512 38ddef4885a211ce131134616b518ac7ebf39c30ce9eecd65e281240193b7f6f140b5aa634d8d600fd655f28c3a455c69f7d918b42f9e9772cb6da6cccc79740
SSDEEP 3072:PcGu4/SCTqLC0n8bICNpxYy3rj4BfUzKZYBI2:JTxTqu0n8sazY6QB8L
TLSH
T1E0C37D8732A401B7D5679278C9E35A46E7B2B842037583CF5264479A2F237D1BF3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvoicemeetervaio64_win10.inf

Path C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64_win10.inf
Size 36KB
SHA256 ec0c3295284b35e977e6ccd1e964a98d50ef7c3c1f0ade722993ebfa613ecf6d
MD5 1156383213a6a152c29a24d991ccf663
SHA1 3c2f66cb67a1f046dac05a57a548f911e809d8ff
SHA512 98dd48bd503b1a7e916ebe46b3c84f316176db5780ef84a4dda4dd57333e2486cfd62bc30c6ead8c049cea3254e39cc4c2753826e73f1d0d51f469ca26700a56
SSDEEP 768:bXOIzXOIz4IUU4o89xMeYmc+Qu4IUU4o89xMeYmc+QBtELemJ9oIjfaCtxEE2beH:bXOIzXOIz4IUU4o89xMeYmc+Qu4IUU4b
TLSH
T10CF2CBD84BDFBC48C381E084CAA30FE0C9532AD6A4F717197B6AE14395D6797C365A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemeeter.exe

Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeter.exe
Size 5.5MB
SHA256 461b17e27e43bc9e1ccb0c1e20c2852bb5b3f774c87959e600bfe3eddad02ce2
MD5 7196d594a870692aa5ad2d4fe79e4fd6
SHA1 eaee2c717193394456b5f896bcd08abc2e16b1b6
SHA512 ecc41e8de1af5abb960b94ffcf07b292d3c82e208b8b141b331ea688190283653bd1c7bcaf318ff620f1c9b3c4efce2a79ca1a588a2fd3c5ecd7590637bee145
SSDEEP 98304:s7kNLMimuYvkJLnO5s3UDE6YCQNpbarp9PTm56ZffTJw5ZqtEtO1jB9uAgt4L7ez:sANLMbkJLnGLsnWPTmKf1wGtDpBEAgg0
TLSH
T14B461220FC82E126C4F744F1416E2E915C78BF34A36365FB36547A9CA9798E31063B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemeeter_x64.exe

Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeter_x64.exe
Size 5.4MB
SHA256 284a9366bde173f81499354f02230088326848f09a9069b6f78a42da0c900e61
MD5 e7df287056b67cdbad7b0cd8e456bce0
SHA1 f624525e9479750824048572e3bf469387329cb8
SHA512 e5ee7365441b997985398647319706c4396c8861af0f769fbff680958bf5d320f3564aa6347c29e3f34aeb71462a7919c73887aadc2ce0e943c62ef6b610eaa0
SSDEEP 98304:heFqZy6JouRigFiwqo6tvuJg7c80lMJw5ZqtEtO1jB9uAgt4L7euN2dPY:owlB7qo6tvc8I2wGtDpBEAggn
TLSH
T17A46128B959C50FDD02BA074C369B167E3B0B8418F516ABB16E0BD550F229F186FEB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemeeterpro.exe

Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro.exe
Size 7.0MB
SHA256 f1b7eaf3a6372aeb8a78e795ca7ad1f61f4023188f10844849309cddb83df8c7
MD5 7a7716ac35794498e031803b85a7840e
SHA1 b2e6ad1f21712880bf697944ee37b36c56713835
SHA512 99088361fd2f5e5841a71e080d5bb4e67bb4bc1eae8c9211bc57d116da314bf23dc0681cc0e1808bd2bf8e5956f02b0a40428760729c4a840d49c461430463a2
SSDEEP 98304:IXZdSJu4Ojnp2XFc4qdWz7TBHKVOD1yFtx1P2sX+eoTAUNieLMvI3wLPP38wZdNk:IpdCOjnpK7TQV00Ff1P2sXHUKINcdNBS
TLSH
T10C761213FA80D02AC4F36031416A2EA1053B9F75A3375DF737A86D64A9789E16073F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemeeterpro_x64.exe

Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro_x64.exe
Size 6.9MB
SHA256 f384446b3c4d56d77f8a690d299bb08169a877a522bde047c8dffd9bb7df8961
MD5 b228e6e208751a8bc978774ec70208e9
SHA1 0f2d0deab0e1f28d46949cffe1e337750a55472e
SHA512 8ef3eb74c838486b7de7673e22e8fdca25cb617f5ed8bb9e5876b0097240cbd07e4961254787e763f46a9ed27dce7d47f21c3ced28a53887bbfb690375c7ddd3
SSDEEP 98304:hiKEwyYLfOE97hmm17cD92UujLja5sB8a0zzPElMoTAUNieLMvI3wLPP38wZdNKS:h4qOy7cZ2v+W8ai0mUKINcdNBJ
TLSH
T11C761297A1DC50E9D02BA07486A67177E3A078408F246AFB26E0AD550F339F546FEF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2351ca827770f805b1ac474ba7f6a5f864e18c776bf62b44bc44cf94741520d2
MD5 f558952a158259116e9e3f9888fde77c
SHA1 6f84f8be34326eb9ff4eed402247132d7cd2f414
SHA512 a33879cc74a64c0b7a2d69a002a76026fa0e39a651af974aa0ce6837e057aa4b8900b28080a06417362589b13228d4cb5188f08755f0d0c96b225a85d3c26bbe
TLSH
T1C1D023D479387AE1D135303E91218301B6B94563312A8147A150CC0D5C3C5C6A7E77A5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5634d8a0c1aa4a28c69e6d69733536eb4dd9cd202af0c6d23ba1c7591f7a56c9
MD5 b054d70a73de7e8e717927b95f952882
SHA1 9c0866ab131d5c1a282d82f8c0efffcb07a2f9eb
SHA512 c77ab873f4c9ec693a62f1ff4eb079e4de40109c8b7a152aa36ceeb1517585cf869e663ec30c03b575b5f95a5b3b15e9b65ae275b72346bd3d98077e2975d565
TLSH
T1FCD023E47A383D51C33730356111C303B7F15655751DC4539070880D5C387D557DF255
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 339e02a13a641cd56d9b904c91171478ebd2b122626b3198b451793db6b3857b
MD5 faa5103a91e7d2cd4e6cb508a4b2bef8
SHA1 9e8fd764960ec7c28a7adc951024a00558191994
SHA512 ffa57094ad52a4b4cd66ebb02ba6603ffc93645b95849c75973e77741c37083472d8e7a05b820a0b3fcc443bed03b61407d77584170a812981cad53c29710e2a
TLSH
T16661C55EC32EA8E2C72490B315E208C9367484E1EACF2E9B82B6F57C940E795721433D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af2fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5af2fc.TMP
Size 3KB
SHA256 54d3c10f249fe9eb04162fdb947ffd6ae97b5eae6f4fb6483a6d788533a07b83
MD5 379d33f63cc2e18821430b54a7d755dd
SHA1 a4de63c8a0b9e16300f0cc496e929a8e3f61af6a
SHA512 a5fd889cd5022a87f986467433ff2a0781bc1898e063a44bd9c13991d666cc80af8840cf61f89e82e4ea65d0d703f00fcf29d1984b2be5c61f04a0e79a3c5ed5
TLSH
T15561C55EC32EA8E2C72490B315E208C9367484E1E6CF2E9B82B6F57C940E795761433D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0077c3fbf9e54afc2741a8e2a77230acd72a79b836fa7c90c56d55e2794502b2
MD5 66a50eb9beb77119e7d73f2760320472
SHA1 8c31f7d8eb25931971eef64b9fe552ee98a5eee9
SHA512 19acf4d827da6001870c52e0f1882350f6fff9a8f9296021e9678a1a062b5e98d612999420d4c127e569b947dc4dc4b4828c285c1fd4393fbc13f5ba93038555
TLSH
T1A4E0CD5414CEC569D35D78B38778734CC7E27587F7983E1A174E98947101B85B79B2C0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 b615a69a715ad3116adcf87b5ac16d5d2bbb1a7cd4d3d812a8ff754132cd1a09
MD5 e11bcee27d9c1806a0f36a50022f20c4
SHA1 9e16177316e0f0cc23070130666140b068f7217e
SHA512 ee9e05a70806c6553c02491434c329819e0106f2cfdd765e1a22836a9962505da008e8465c4644e40deb721736b454139293b458a45b63eb69a21237b9afe8f5
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjz8Dwu9HwdTehJres:uzBmw6QU1Pzi7H4Te3Cs
TLSH
T1159252474F387822EB412D7A292A0435CD3BE36C9F66EC5134A564224CF8492E47A8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 7f85632411b398def51bf085a83dccc12d0f30573b5fa83f4bc57db58f54d0de
MD5 d3c1708fc19582f67cc8e9a058f2d392
SHA1 d34b022954d123514fef7ec0cd7629fcddd182cb
SHA512 1a1b9e80572e55068417628402b53caa41f4233bb0e49b0062bad55917cc6404b65eebcb80a7471efc87d63795cef1a6dad24c1d9312a00b508d046a314d19a0
SSDEEP 96:r2WeKtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/RI7bbEOVpZf24JkMfXSFR+Cw:r2WeVH+bF+UI3iWGVoWN3qL/6VVV63
TLSH
T14B24114E5F342722CDBD913668EB44A35C7CF03F875366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 253087df4904c433579322d233def746deba6d19d4c39293fc441c3108ab1fa2
MD5 35b07935505fb7bc0871d35560c74d7e
SHA1 7f55f6258dd63b1c1fbf9a6c4d9b049be3e48947
SHA512 9476cc67a387b35719ae80e13fe3e8cbeb2aaf19bcbb43ca4ba83b058e82b88e04f41951f9162ecae929cfe022a104bffc533a7953326d24351c158542c70ec5
TLSH
T1E2E020A2A5DEC11DD78C207B4358770CC7B13487E68C3F451B49AC40B201704E7C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 8f45c3372a942e1fbc6d3e28cb99de285ef41957f6ab7b951a71a64f4f4eb5b3
MD5 d4aab86789a5d3b1c2147f18098b9982
SHA1 b32b6b36121c6383913bb6117476ba617de92a0f
SHA512 fa9fece3fe288de3201e1013b49a278e0f7d6ae40e29c1dda70c9ebdf0bc8ca23c2cb2486d992c28a3484a14a2f1bd15273e334234d3f4b3487b4410ce0ed6fb
SSDEEP 48:Txk/LopFMaty423w/a9NUuTAw6K0cJoMwp0d3NDTVuEeMUFc0cJmvZ46T:qDeMatha9WS0cV8kRTVuEeMJ0cEv1
TLSH
T1B7B2745D2F346511C1B18B77EDE044672EBC521C83A33959E51820F2CEE366BB902467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4f13cfffcec037ee1b0c5e2171d1390ed2b8b34447076e6dd874c4bfc963cd35
MD5 7ab5ffc5d41d51a624ed68445dfc908c
SHA1 4e1e19358c0369266fd139984cf601ab02aaf342
SHA512 b8ab3e9d6adad324288b3c85c089804b95fd468c89c21f194b03916e35c3fb9cfffb812db0fbd45c59ee98968c6c3ee6f202317bc4003c3dd422e5a72a619532
TLSH
T115315CF383F4996E8E1156F0AA286E2BCE1D0515432C3C6AC5D4AF2793E2471E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09ba4b4a918e1194c4a38398cd452dd0ff0f8b54defaaad570149f433333c2b4
MD5 dc4f588f3976eae28043bc5e61adbe4e
SHA1 ca65b0145a71d47ea9448eca595a7c1827fbd2cf
SHA512 a4fa4f27986afd1ab2901f3e17cf89b2d9cf3da57b8aee0c545d3bf4e490e21f08ce86b1fd9295ac679d1c1ca466d37ced7bff95ab6508cb963ad38c855bd320
SSDEEP 192:sxRHRWyM/jK1Ml8wC8/fKsdxSPsZp61vwzoA8pk1/g6+WNSZ9/Yx2JkGVIgtJ:sxRH888/fKsdxSPSKw/5e/BZ3
TLSH
T1E862D8166A249977DCDBD20DFA517F93D6F81573A2901E44AAFC8B0C40E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5909df94808cd476b6ab4f0efd5c01f7a2ccd427884babefdf8107a4c800e238
MD5 93fa43fde94b6f7774f3b039a82b435a
SHA1 8cbf3ccce438eedccceff1d5f16654b8b6c316b5
SHA512 899678163cf5cfef293c4845bc8c3749974a822d0de2afb3c5a3b470e1040c9192a9c2397166b8ce66c0e0be5db87017cc8334a9db433c23b1997c60e5740250
SSDEEP 192:sxRsRWyM/jK1Ml8wC8/fKsQxSPsZp61vwzoA8pk1/g6+WNSZ9/Yx2JkGVIgDaJ:sxRs888/fKsQxSPSKw/5e/BZK
TLSH
T18B62D8166A249977DCDBD20DFA517F93D6F81572A2901E44AAFC8B0C40E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 85dae9cea43acd368625b76ffdf1302bed7a8ae97928f55cae44707bba6fdb0b
MD5 3a9db156a1e6845aea94372bbb57c2c0
SHA1 ef0c9dbdc0f2a78890df3ffd345d45d7e930adb5
SHA512 c1b8acd1df211fb7d59543a45ebdab74c30cee64bb987aa5391bf5cd092240e3a88b084f9e7a51414ee29a2deedd34baf00090b4093488d6bbb0dd655180361e
SSDEEP 192:sxRsRWyM/jK1Ml8/R8/fKszWpV1xSPsZp61vvBzoA8pk1/g6+WNlDZ9/Y1bJxgVK:sxRs8M8/fKszWv1xSPSk8w/5F/UyK
TLSH
T10F62D816A924897BDCDBD21DFA517F93D6F81562A2901E44AEFC8B0C41E77ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6fb81bf6462d61856fee77d69de2e740ce2379137a4caa46225689117729dc7b
MD5 82be59a92830c689f5c8db57f49e97ff
SHA1 e422365036ac77b27df7c8d2f5dc4fbe1f354857
SHA512 9359fff4d540385fb6359d0ec9a3d184cdc329d212350f3fe1d4193ac2e3590f850d012eb53c1516297024256dee5cc1a19d86c0cd8b58cf781241518d2135b3
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVDBHrVA5roJq7GR:0xCyDQE7ijWgbrfM1u1jaUBHpAyJqiR
TLSH
T199E2DC7B680CCB7E4F404A9DEC297EDFADE802CB96D8C95447EA440C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 07151a8201b4e0edae37126a7ad29398d6ef4edef857875e18be0c18e972b818
MD5 5e8d1fc0c0e5dbcd8dd6a94a658c3c52
SHA1 0487b1ad9e6a441f1b773ff7a4170f3cf4963822
SHA512 7e906fba104da9f2f0149a1b1aacde975e4b1ebb1b48a82823896b9fb963cb7960150e9924859250aad7ef540f4d7a0824abc99c3fc40c79b7ad422b122debb0
TLSH
T14CE0261515CEC1BDE2AB24570324A70CC3E57447D3C83E467F89DE847142A08B2965A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 32eec1b59e11d0412677ebbe9ebb5e645944bff3abca5c077ccc0962b9f85c66
MD5 8ea55cc15b1c5146ac524c55dd3ff5fe
SHA1 a1ff4b3883ef005ebc412ae8d55352023e7da578
SHA512 8f5ab73480eb0cb8aadcd5ba6cbef392ee8915f1d78693a2ee0573f430a077ce012bcba36a1dbb1e4104579008abe478ee56cec57edf4295195233c28306959a
TLSH
T145B01280B7107A13C4CD06B20E454F609AF0F40110804623CD448F706F551547F01CE9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 3771f8e377d8a709676d11a2dc29e1735e08f05dc0b9bdf9a961257b711b1335
MD5 f88a714cbd92adabf3dfac534e76a384
SHA1 144795c319583362fcce65182e58a6c0c476e72b
SHA512 b037e2bfddde31188a7fe955360bd0b7ac75aecc30390092bd09962abcbb6ebe536b5d1dc16b81db52998c665dcdb1f6f11cdbb576ffe662a6f99503e8b12909
TLSH
T13FE092A115CEC62AA29A609B5314E74CC2B27442D7C86A257B09E994B2066447246540
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 8e1b08764fa6e0d89895249a66538b522d2094390162a9c848d33f6f25e54c74
MD5 4897253299b81a89e8e19a7492c29d99
SHA1 6daa42cda062b14c837dd121aa6c3ec80d3af1a3
SHA512 e6be5cbba8b785cdd84935d4f064f4c9f3e989b79edd6aadb291f5244f3b55230fd0c596916faa50bdcea90372621262fd5228690cdfd527ef720cdf09ea11ca
TLSH
T1C7E0267049CAC67DD2DA60934364A71DC3F1BC47D3C9BF0AAB0C5484B101600B3ABA80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ac5de300df4500797b3c88d1069a185b8b4615e58929208c74fc4ccbc5f0171
MD5 a8b17b2d10162bf85a78a5f193c68cfa
SHA1 7174360b84a6002e9288cb29d15f432c1e74e4f8
SHA512 ddec086fb83eeeba2e769d3c34b44bd30c6156eda28252a1076cb9d759a6b1c6cb27a313648a68b86917bd767b66e2ab3943163152105b3ff9573f8a2412b632
SSDEEP 48:KyOXQse8IXVhIpKKcM7ypGIPK/aUv1IxK+0Eo:KAVhWKKca6GYK/aI1iK+0X
TLSH
T1CD91CD52717A120239BD694891A4D616C6C275F33019E82F3BE840BA4F7BF424DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 bbbb7b4dea0b1f8ff195d37c9c08800c0e2e5935a157d450a69598ab026f8f3b
MD5 2ffc4cf451b8471eaa5f2bc47f95d604
SHA1 dd79d5ec5f13a3fac70bc8a38cd96bc49719e1b7
SHA512 4b2bf9eeadfea85a7918f863a3719a84e65ad328b132cd385dd496c1945b48420a73fc7e90201f1428a99908896f558b6eece49a32274a3cc404f5528ef0c300
SSDEEP 384:DNrRZyCSDnxTIC0hDHMEhIKyll7svbFKfk7:xFZJSDni3ayI1l7svbF9
TLSH
T11A44740A7B747001EDE6D9B25CB080771E3CB16DCF22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6aa576e-1f4c-4ffc-80fb-a85f8ec99d16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6aa576e-1f4c-4ffc-80fb-a85f8ec99d16.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f0ed1e35-a4f3-4371-8963-a882332c76b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0ed1e35-a4f3-4371-8963-a882332c76b0.tmp
Size 414B
SHA256 22232ee9d17f7fe1d1c2794a2e60fe1408ee868f5403999ad4c508e685c8c330
MD5 11bb70cfe5fb2ea0f380b3ad57abad96
SHA1 52947dfacb0374b471285c877a9f8a94cb0e6f14
SHA512 6ad3f6cc0c85055929266e48f8bbab9c9540e1e63f8c89a05ee141a05f78d5bc2c48b8fc51960e7796f93dd660ed805b0687e2215bde12e10e40646ebb9d3403
TLSH
T146E02BA6D821DD6769FD0B197065474BE64803272A40894F7B3D92088FF1236825AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0e72a9c81b81a7e2c347db91278ed362809e35508d965218cbbaaa9afe7e0b6b
MD5 521d35caf26fc02445cbbe6bfd92f836
SHA1 81d6e8942eb790a47e5ae0914215649389d9b447
SHA512 75746189078eca7a2c1938aa24af1ed69633908cf299730885e021e29a95dd8b7115a015c220a2f7317b02b0b041ed1cddfa876aa0951fe7632db124093fbd48
TLSH
T169218595F330C108E15A827A607F9B3A0734D8128FBCEC0F497A2064BE71B440D8B3E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 50ab363b096c8fd3ce3633cd48b480893712c870a7bd03003f977e84ae39ccf9
MD5 5b029fe9d77b9e2ee1b10fc77cb8b174
SHA1 d203420696293b7ad03c791dabf1808b29d18883
SHA512 46861faeaf88f53cdcc0f1c98935fb29f70f0259e3b55bd1443ab761db493327103e261dd67ef82fbcb8fa243f30dd8ab13693b7f2fe17322b358f9fb00e4a22
TLSH
T11DE0201264CDC55FE25530DB0375B74CC3D23843EB942F151F05CD547141B457B46141
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 26f70159b30647af2895f89f50b4417f0e040feb86af8bf4b011d43b2d8445e7
MD5 b2bc2e706cdab62821f1d09d7b2f9d40
SHA1 3865b33f1fe11f456c581a6d66a76d955cbe4c00
SHA512 ee50bfda66ea2b3f75556b84207ed19b7f4ed203e062fdaa99d6cfcd483879743685665249a274d3a2b5764c7e0434f3cc738e7d6abfc9308b32acf595fb8a25
SSDEEP 3:MsEllllkEthXllkl2zEflt4l:/M/xT02zo4
TLSH
T1D54404057FC00C15CD041174C051C3515371D4300511574334D104335CCF5400C00540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 07b6ba2bc831036027660f8af3ff01057158c2a429afae3dc592695d32815db3
MD5 77b8ce1d45b8b021591ca8b42e6696ef
SHA1 aad55c5bf85e99e5c5bd2ed9b03c3bd41bb6313a
SHA512 973267ac007e61c1fcb4913c28482820c83651d21adebadfa40cd8742934c0a0c3eb4cf5f7b0e2e4d705b140403291e395319a2a1415540c5d33e93e5d9d82f4
SSDEEP 3:MsEllllkEthXllkl2zEfliVk:/M/xT02zP
TLSH
T1D74404057FC00445C5001470C051C3715370D4300F1157C734D304377DCF5400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b98f1a0a90bb718256474ac88ddcd773925f8b288309da3ca865b7d174e81309
MD5 2a546536e08b68830a98210612d41f82
SHA1 db0259cf7188f3de58eb854cc3f6855d16e80063
SHA512 5c24432bde1efad57ab038f0c0e03bf1f6e8db6501d51f4839eb173a770a2d5318bf7f9cd7ee16192516e1b8dbdb9579895b06a284b6ed08172259eae52fd50e
SSDEEP 768:Pj+9j3FxkKL21jF669yrqUjWiIwwxMtAb9MZ:i9j3UdjF66INWZTMSb+Z
TLSH
T131F2AE30BC559EB3C9E6C786B2523BC3EFA411A386C80E8CCACD9B0D46875DC174752A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5bbd32cde469adb372aba127bc05132d8db3bb5b8c25ee6777177452df907a9a
MD5 a3db0d1887c3f371b8c175610d867be4
SHA1 48bb85f466c8874fef39cb7351d820132f7ec310
SHA512 04961d2c37210e0283646e27e6ee3b5c9d6c8fd2dc18e5de7ae83a34031efc8dc14c317467eb5dade134c03bb0f8ed7feb0d494fb9784c1fad5d3094b05531a2
SSDEEP 768:sj+9Q3HxkKL2+jF669yrqUjWiIwwxMt0MKs0xAb9MZ:r9Q3eWjF66INWZTMKMKjxAb+Z
TLSH
T1B1138D3CAC554E7F88EEB789720A2A66ADA44237C6F40D4CCBD9570EC27648DF743426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1db23736a6efa82ddcbc35dae2f99f6df0c40fc2f40c80b1bc9bf95cd58f9bc4
MD5 40a079d889d67e7f88c51f5468fc7c3c
SHA1 d6e50147a01a970d85932b3a7296dad33805d17a
SHA512 10d5d0e4a81d4b758a36c1fddd464bed62d5a7e69c11f9e23bf4dbf7475df75728ca603fa77a147efd90f96d1599cd4e27e2cc3c702e982c2f62d11a676dd405
SSDEEP 768:Pj+9E3axkKL2+jF669yrqUjWiIwwxMtAb9MZ:i9E3XWjF66INWZTMSb+Z
TLSH
T164F2AE30BC559E73C9E6C796B2523BC3EFA411A786C80E8CCACD9B0D46876DC174752A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ed22beda7909248525e072636d3d7127ed07eca4235d2d0e7cb73c2ade9a31fa
MD5 738d75cef41e14dc7afeca0c5ac2018b
SHA1 4b0ab2a3639afb9b43cc04d51c4f287a33ef0feb
SHA512 ea57e7c53dca9004dd775e551dd807ab9f0643794ddd0de2db419bc90b76498328b26db8112cb4be3666ed03e4cfc5a9bba9755e9931cce9ea278574422a81e2
SSDEEP 768:arv+4UNbdl3kPkKL2+jF669yrqUjWiIwwxMREUiler:absbX372jF66INWZTM2UsQ
TLSH
T10703CE35AC589AB3CDF2D28672437783BFB4509396C40B98CACD670D469B4DD2343A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3e7d70c6555ae2deb2360cc558d97f6fbf0cb5223c28e7eed1796b5bcea77d85
MD5 4e03c997444a17be73da183df35cb399
SHA1 c8aad72963c9e0519de3a9faa973710ac593ecd8
SHA512 8e46d7ad94e806e7453bc6469a37a14c6072c5246310ae02891e4f9d111368a945497340583c4d5d04b1c1ff1079ab065362988037f6b59c8cb37752e6b0cb17
SSDEEP 3:MsEllllkEthXllkl2zEfl0:/M/xT02z1
TLSH
T1DC4404047FC30505C50010704051C3715370FC344511574734D104335CCF75C1C0040C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a3814e1e-0bdc-4b01-aa26-63df8df454a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3814e1e-0bdc-4b01-aa26-63df8df454a7.tmp
Size 38KB
SHA256 5ff8b3e255dacae2d16775302685475b99fec3a59242abfd646ef8ee1e814e20
MD5 e939a3e5cbe2b046a5e4395f9f13af15
SHA1 bdb59e27ad85e6090d1d0153b7d6e8aa4e0d3362
SHA512 3ca01a943a4628cb006372dd05a5e4463b25cb2bc50064058738f1bd5ceaa022baf76012d16e62e84598087bf45b547b984cb672b24c4f5d138793c4ba8d2a4f
SSDEEP 768:2rv+4UNbdl3mxkKL2OBjF669yrqUjWiIwwxMtAoZI:2bsbX3DWBjF66INWZTMS9
TLSH
T16803BE30B8689AB3CDF6D685B15337C3BFB4109386C50F98CAC99B0D465B4DA274B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb7b5b1b-cd1a-4073-8e53-9ad6c0cf9a3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cb7b5b1b-cd1a-4073-8e53-9ad6c0cf9a3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1104_2044477037\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10.ini

Path C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10.ini
Size 490B
SHA256 b21f00f65c2725e237a3c269a8b3c02fce0090839018aa2ded817863544980d4
MD5 1ba0e61cdac9b6f36a50ad0284f082d0
SHA1 e5fd45c8b7ca6e9bef36e9013ef752e1a1fb5b4d
SHA512 eb1df256d9a90b95adb2cdea86072b0900ccc042c894a0c66622fecb390f0a61128fc505a5683b0e4f39284501932c897a60d84a65c09c77e28f68ad3c0dc022
TLSH
T148F0E9920325A258888974C2D9059E66C88DB1EB0013B79933D1506613FDA4E8DBF390
MD5 SHA1 SHA512 TLSH

Submit Download

VBVOIC~1.SYS

Path \??\c:\PROGRA~2\vb\VOICEM~1\VBVOIC~1.SYS
Size 289KB
SHA256 12ee8d2bc7309b519e967d48894028b2a4bf44857aeb3fd18236ba24d6463baa
MD5 9127efb0a17dd9a0ed1dd722b83fff64
SHA1 c6c19a223d5df63a584e9f7bc7dc48d744cca0bd
SHA512 5c8d989139a1bc496fa7647fbe08404c2a207d893607a41094e65ba80a1bf6b0c9ff2293e400c19ead6e2adfc8fdfe3cbec9b247d4dcb1d1cab40c4889640750
SSDEEP 1536:u3XlWe1lEfEDr+t3qrVgDkNPmVSeCOovakbDhyWfYANXxl0fBkfwrfiOfFaovy/n:X2r+t3q97aojHhysmI+hkoviyQ
TLSH
T167545F2ABE6DD0D0C41B20F4C87B8BA55A63ECC24A934E9712553B5E1D333BE2D27497
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbvoicemeetervaio64_win10.cat

Path \??\c:\program files (x86)\vb\voicemeeter\vbvoicemeetervaio64_win10.cat
Size 12KB
SHA256 964b04a45b8fbb62b97d012608453265d6d2305378a2abc8f95e5d23c93f30be
MD5 77f1688d4b28f657b08e77160418fdb5
SHA1 6f769f0034af7012d75bb14b6a4f2b7d2caf00dd
SHA512 bd64ef99b49a0f1045c19ce5a2b848d19827827827b5a9a62a4231f6dbd243e8d73e6121b9758aa79a6fd90edf91dc787e51b3f4e792ade73c395350b1b11244
SSDEEP 192:iejEQkETJCfPXWEwGJhYCQ2UHWX01k9z3A3BeAeY:igKP3h3FjR9zqBeu
TLSH
T18D4219A5459841C2F993AC6043F8E55B7C7E33CB680059AA16AFF71D5C633C8F72826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads