ed8f2429c736aa6a82a625a5b908ac9c8d64a0a5f82652cf4eae84f65e5fa997

Analysis

max time kernel
87s
max time network
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MiniMeters v1.0.30.358 Installer.exe
Size 43.5MB
Sample261026-wsf2fafx2s
SHA256 ed8f2429c736aa6a82a625a5b908ac9c8d64a0a5f82652cf4eae84f65e5fa997
MD5 fe715e9f747484643162521e8a17ad5f
SHA1 dacbef7a2a93e33039e6a0fb901995d3c775ca0a
SHA512 1c48bab3b27a3e627f2e89f3ee07cffe9996678d6cbb8c8b611ad84616e89d76ee6e31a534dfb103f25dd43c2d1baf78fec8a81c28aa7b827e57195f8894a3c1
SSDEEP 786432:Wmja+rPcHIljnDEB6aQhlQeyv76GhHIMSbnDq6+430odiknjJTkZoDmlD73fqoLV:Wm3rvlXEB6aQ4rv7BRIHDqu3eoFTF07b
TLSH
T139A733414174FA0BDCABCF35AC052F4BE0532ED84AD8D6D2C972D68EC4EFE235AA5854
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Stereometer.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Loudness.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrogram.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Stereometer.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - VU.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\MiniMeters\UninstallMiniMeters.exe	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - VU.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Audio-Server.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Oscilloscope.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Waveform.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Loudness.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Oscilloscope.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrogram.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Spectrum.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Waveform.vst3	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\CLAP\MiniMeters\MiniMeters - Spectrum.clap	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\MiniMeters\MiniMeters.exe	MiniMeters v1.0.30.358 Installer.exe
File created	C:\Program Files\Common Files\VST3\MiniMeters\MiniMeters - Audio-Server.vst3	MiniMeters v1.0.30.358 Installer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5952_1499286021\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_1362645787\_locales\et\messages.json	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	MiniMeters.exe

Loads dropped DLL 2 IoCs

pid	Process
5884	MiniMeters v1.0.30.358 Installer.exe
5884	MiniMeters v1.0.30.358 Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MiniMeters.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MiniMeters.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiniMeters v1.0.30.358 Installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{13B2B64E-3D9E-4D25-98C6-A584DEDE7ED9}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4516	MiniMeters.exe
5952	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4516	MiniMeters.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5884 wrote to memory of 4516	5884	MiniMeters v1.0.30.358 Installer.exe	91
PID 5884 wrote to memory of 5952	5884	MiniMeters v1.0.30.358 Installer.exe	92
PID 5952 wrote to memory of 1572	5952	msedge.exe	93
PID 5952 wrote to memory of 5456	5952	msedge.exe	94
PID 5952 wrote to memory of 6024	5952	msedge.exe	95
PID 5952 wrote to memory of 6024	5952	msedge.exe	95
PID 5952 wrote to memory of 6024	5952	msedge.exe	95
PID 5952 wrote to memory of 1756	5952	msedge.exe	96
PID 5952 wrote to memory of 1756	5952	msedge.exe	96
PID 5952 wrote to memory of 2912	5952	msedge.exe	98
PID 5952 wrote to memory of 2912	5952	msedge.exe	98
PID 5952 wrote to memory of 1300	5952	msedge.exe	99
PID 5952 wrote to memory of 2912	5952	msedge.exe	98
PID 5952 wrote to memory of 1300	5952	msedge.exe	99
PID 5952 wrote to memory of 1300	5952	msedge.exe	99
PID 5952 wrote to memory of 4256	5952	msedge.exe	100
PID 5952 wrote to memory of 5732	5952	msedge.exe	101
PID 5952 wrote to memory of 4256	5952	msedge.exe	100
PID 5952 wrote to memory of 4256	5952	msedge.exe	100
PID 5952 wrote to memory of 5732	5952	msedge.exe	101
PID 5952 wrote to memory of 5732	5952	msedge.exe	101
PID 5952 wrote to memory of 4324	5952	msedge.exe	102
PID 5952 wrote to memory of 4324	5952	msedge.exe	102
PID 5952 wrote to memory of 5816	5952	msedge.exe	104
PID 5952 wrote to memory of 2880	5952	msedge.exe	105
PID 5952 wrote to memory of 2052	5952	msedge.exe	107
PID 5952 wrote to memory of 2608	5952	msedge.exe	106
PID 5952 wrote to memory of 3548	5952	msedge.exe	108
PID 5952 wrote to memory of 5364	5952	msedge.exe	109
PID 5952 wrote to memory of 3548	5952	msedge.exe	108
PID 5952 wrote to memory of 3548	5952	msedge.exe	108
PID 5952 wrote to memory of 3444	5952	msedge.exe	110
PID 5952 wrote to memory of 5132	5952	msedge.exe	111
PID 5952 wrote to memory of 4356	5952	msedge.exe	112
PID 5952 wrote to memory of 5364	5952	msedge.exe	109
PID 5952 wrote to memory of 5364	5952	msedge.exe	109
PID 5952 wrote to memory of 3444	5952	msedge.exe	110
PID 5952 wrote to memory of 3444	5952	msedge.exe	110
PID 5952 wrote to memory of 5132	5952	msedge.exe	111
PID 5952 wrote to memory of 5132	5952	msedge.exe	111
PID 5952 wrote to memory of 1972	5952	msedge.exe	113
PID 5952 wrote to memory of 4356	5952	msedge.exe	112
PID 5952 wrote to memory of 4356	5952	msedge.exe	112
PID 5952 wrote to memory of 1972	5952	msedge.exe	113
PID 5952 wrote to memory of 1972	5952	msedge.exe	113
PID 5952 wrote to memory of 5816	5952	msedge.exe	104
PID 5952 wrote to memory of 5816	5952	msedge.exe	104
PID 5952 wrote to memory of 2880	5952	msedge.exe	105
PID 5952 wrote to memory of 2880	5952	msedge.exe	105
PID 5952 wrote to memory of 2052	5952	msedge.exe	107
PID 5952 wrote to memory of 2052	5952	msedge.exe	107
PID 5952 wrote to memory of 2608	5952	msedge.exe	106
PID 5952 wrote to memory of 2608	5952	msedge.exe	106
PID 5952 wrote to memory of 4760	5952	msedge.exe	114
PID 5952 wrote to memory of 4668	5952	msedge.exe	115
PID 5952 wrote to memory of 4760	5952	msedge.exe	114
PID 5952 wrote to memory of 4668	5952	msedge.exe	115
PID 5952 wrote to memory of 1000	5952	msedge.exe	117
PID 5952 wrote to memory of 5296	5952	msedge.exe	118
PID 5952 wrote to memory of 5296	5952	msedge.exe	118
PID 5952 wrote to memory of 1588	5952	msedge.exe	119
PID 5952 wrote to memory of 1588	5952	msedge.exe	119
PID 5952 wrote to memory of 6112	5952	msedge.exe	123
PID 5952 wrote to memory of 6112	5952	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.30.358 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MiniMeters v1.0.30.358 Installer.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Program Files\MiniMeters\MiniMeters.exe
  "C:\Program Files\MiniMeters\MiniMeters.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://minimeters.app/help
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7fff929fc188,0x7fff929fc194,0x7fff929fc1a0
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,2927495936892728574,15665820043396370102,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,16426455582633320817,51890921122776907,262144 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,3169609785452929908,1616058465384641549,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:13
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,17290563110651597242,483478117054604151,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,15635686477731970882,10621839721899708651,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,15176257451112197664,5817563532174405047,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2982059752994421201,13445596549457701729,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,18056648763980160382,1876154513657812171,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5540,i,17478915166052231959,2275372346339257710,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5380,i,5320559771112112550,3121891382048859742,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5588,i,8031032612161851814,15801340692729260280,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5576,i,15842627222944097400,69017934101872189,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5548,i,15587414154202473492,13497217105712639936,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5524,i,7378585673304026229,17404644481552815449,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5472,i,9637059810503771302,13530677996589684545,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5552,i,793448267189506522,11853219324902355994,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5672,i,15769338850096741228,7659988381432279264,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5408,i,945105218946237542,4016588112552300739,2097152 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,7413069077063816915,18015516005162459056,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,4903645341520202759,14823110655769855147,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,362301661902122537,7143834141087019956,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,362301661902122537,7143834141087019956,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:14
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,3656744036958439914,8706325708578595706,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:14
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7884,i,5842055738048864211,5258473012634974422,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:14
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8468,i,9112229732075880741,14359547660665369577,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:14
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8524,i,11858850822967129606,2121149074504365455,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,17114298886343330129,13557787019145401744,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,11944761607405790382,3935238852868778863,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,9024917844761588876,2618369646974552825,524288 --field-trial-handle=2492,i,8640157539673441659,12858406435822440959,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MiniMeters.exe

Path C:\Program Files\MiniMeters\MiniMeters.exe
Size 5.1MB
SHA256 aeec5530af0a9d16aed4121d0233b67ef2eb578125e4ed9f510d5deea07d3b69
MD5 3705856cfcd8237d5f54cabdc6690ae4
SHA1 afc697f2172f94d6d0d05ce26054807fe608f543
SHA512 8bb10cb377ecce867fef306a895d646c46f55a806cea44975eb739e0dbd73395107845c0848c3973d988e81ba8866962f4cf42be9c6d6eb30c0e77522a18aded
SSDEEP 49152:Ojn76XvGiYo4GCnLk9Aud3pZItEyCGMT4jyg9mOpDbq5zP3AqCmwt8iu8Mnhu0Wn:EiA6AKGbvozP3HC2iExWd1
TLSH
T1D746AF1B3266B0E8C435C1755687E41646367C8B0B547CEF21A18A263EBBDE31FBE90D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b390fdc-f023-4404-bcda-a65498e2d956.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b390fdc-f023-4404-bcda-a65498e2d956.tmp
Size 34KB
SHA256 596950d23e91dca75aad4115308c08bc6a9794a653fa9234545a63916d7f1c2d
MD5 86f877d776b6294e932f7f8d25baf6e3
SHA1 48ffdde0424a16db7d9d027a4ad7413d3c6fc106
SHA512 b9be9bb190d71dcd9a90c140b29fa2f9bdb25b027e744bb19262d58a93fabb90401716f6ffdc4b011bf3185f08215a616aaacc9ebf772f8f850c987a9aa5a053
SSDEEP 768:EV3h5vcZ0rfZW2Yo7tYoOBBw4Ot5AEl94BHYjHj68upLJ:EV3Lp6BVa5AEncHYjDbMt
TLSH
T1BEF2AE78DCA18D638CF7D795F70B36836EF1A163E9800ED4D9C96A1D098728E274B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15e699a4-84bd-46ba-a80d-95024265c1bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15e699a4-84bd-46ba-a80d-95024265c1bb.tmp
Size 40KB
SHA256 7c779381814b74ce9a1b4c36353079be502a5b3794f409d525830ebe29a21ad9
MD5 d53eaee09b11b2e59b35145871692422
SHA1 c9c2a85395aa9ca35b4a131e909fee0b4fae03e6
SHA512 c06036db487fefe4475c5d2f7cfe7a4fc657b8dd8c139554f3cec3987cb70df568c35a94f838b2ea6ca292035a7d85c6791be2fe021e137ce8ea0931ff39f3ca
SSDEEP 768:i/UxvxjgC+5315vcZ0rfZW2Yo7tYoOBBw4Ot5AEl94BHYjHj68uql:nZj3+53Xp6BVa5AEncHYjDbZl
TLSH
T1F113BE38DCA55D238CF7E795B60B33879EF16463E8815ED899C96E0E0E4729E134B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

199cd036-8f5c-4524-8861-84f045298fac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\199cd036-8f5c-4524-8861-84f045298fac.tmp
Size 34KB
SHA256 2b074af84294f1b6dc457a682a849fb9464466f86aa7ee92a87dd28bf5f6020c
MD5 d5de32c91bcd0ca5fb1130d2133e7444
SHA1 82517c8b682134f7ff21a4256589ea205cc2eef0
SHA512 46bd1302b333a32d401072227faffe6fcee0124d109043a1358391a103bbbcbdc9945face843bad0e055739924ea5cfcaa7389ebfb8353c192fdaa0745360c40
SSDEEP 768:/V3O5vcZ0rfZW2Yo7tYoOBBw4Ot5AEl94BHYjHj68upLJ:/V3Ap6BVa5AEncHYjDbMt
TLSH
T150F2AE38DCA18D638CF7D795F70B36836EF1A163E9800ED4D9C96A1D098728E274B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30c7c0d0-8772-4802-aad4-3b77f4223966.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30c7c0d0-8772-4802-aad4-3b77f4223966.tmp
Size 38KB
SHA256 52eebe28fd85d030754b64c1b08cdc9ad2e57a3db261591a7a1df4ca91e759bf
MD5 ce99df1c738dfb9f518fb4fcfe311063
SHA1 c5045a4e39e949bb60799a392dfdb172fbc1bb43
SHA512 b82603397e6629017cae84fbb4d73a462e4534ac1d3b56d0c5d19df5473ad994b0aefd5a67eb731162f5d21126deb34d6e61356804a6cc7eac055b2ae8a443d6
SSDEEP 768:z/UxvxjgC+b3nd5cZ0rfZW2Yo7ABw4Ot5AEl94BHYj/3AFTN/:GZj3+b3dbABVa5AEncHYjfAFB/
TLSH
T14F03BF39DCA59923CCF7E785770B238BAEF19563E6812ED489DC2D1E0A8725D1307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68b6b39c-c0f6-45ac-8721-219d03f17c18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68b6b39c-c0f6-45ac-8721-219d03f17c18.tmp
Size 38KB
SHA256 bfe9ef959f037745d35c239a352f81d889cf4a882cb6ad0fdf88a79fccfb6040
MD5 3c25fefff3d1c9e0aba73f24744f749d
SHA1 bd9c6ab816ba5e9082da59f68032d34cb39cecac
SHA512 02b7175327e07346d7440600fc2b693b0ebffb422754d99baa1c8c6e48e7ee6ee515094053a62f2aa8688ef820f5bfa4bfab9d1ba0ba2d45e1c2790c12c75623
SSDEEP 768:p/UxvxjgC+b3C55cZ0rfZW2Yo7tYoOCBw4Ot5AEl94BHYjejAFTN/:cZj3+b3sb7BVa5AEncHYjkAFB/
TLSH
T1C103BE38D8659D23CCF6E785770B338BAEF154A3E9811EE489D82D1E0E4724E170B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e010ee04-b09f-4bf0-b5e3-e9038467c434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e010ee04-b09f-4bf0-b5e3-e9038467c434.tmp
Size 105KB
SHA256 aa204e7f585c1f2b64ec2dfe226fcda3dd40e2d6c7acaecb8bc39c51bf5021a2
MD5 82ef5ef3fd97f3d79a47f09529d45307
SHA1 4d70248d33884063e95777b4e6e0d998931440a1
SHA512 a3e3e08187ec16facc64907edae849970f4fffaceb0ff69b6b9421c352de4ae4396f6c7d28c814160c616bf604747c73d4cf8a04f10f2fc8fa4a07c14210288d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

470472ef-a6a5-4be9-bcfa-241177d6d1f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\470472ef-a6a5-4be9-bcfa-241177d6d1f2.tmp
Size 12KB
SHA256 01802fd305f6c4995f98a3c57034c4e0c5044e96a36cf267988f5d22eded98a7
MD5 8a4594135c48e5af957c30db2d73e3c4
SHA1 f785611b6cd8643a526b886d4689d75e54300198
SHA512 ab458cf1e52ca3c76e98d1731f926ca542caece247a2a593a16fdc9353f528631b14ce9ded058a75f1ffccbc94a9eee8e31cefdc3f22a21ea32c1d0d50570338
SSDEEP 192:sxR1ReC//fosGkZChgzLzoA8poP/g6+WNur4/YioDLJG9IgDNIWHJ:sxR1L//fosGa3zqG/5h/9Hp
TLSH
T1FD42D815AD28AD3B4CCBD21DBB55BF63D2F95032A5901E48B6FD9A1C04EB6DD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b1dc50d-7b07-4694-9e39-67c3065d6cfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b1dc50d-7b07-4694-9e39-67c3065d6cfa.tmp
Size 12KB
SHA256 87ef427d837d94e2f50b60968d8394ab757dfb608802daf6729c9c5e257561df
MD5 5352fb473a176bd7a87f7a13a8d57499
SHA1 a962a0c3b47aefee7fdc03c676105e8ec3f2e7f1
SHA512 4ef39ed2cc6ee9990862b0c77c01ff0f8f61d0b4f6004e9370be17b6004ac120912285a1f98d0715064218b29469b28186d9f1f8794a08feda4135ed8b664695
SSDEEP 192:sxR1ReC//fosakZChgzLzoA8poP/g6+WNur4/Yi0xLJG9IgD3IWHJ:sxR1L//fosaa3zqG/5h/dRp
TLSH
T13A42E915AD28AD3B4CCBD21DBB55BF53D2F95032A5811E48B6FD9A1C04EB6DE620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59961421-5431-45ee-82be-d48141f78ee4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59961421-5431-45ee-82be-d48141f78ee4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f72f620-d2ca-4bc0-9225-8bcfc1807bb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f72f620-d2ca-4bc0-9225-8bcfc1807bb6.tmp
Size 11KB
SHA256 0fd922f513da4d9ca398807bd6c09bb33f108543b6b0e87844e2b2c391e41568
MD5 2b0a014e024535e667c0a029860e6452
SHA1 d1206d70f64ba06152c26173a04e379112b54875
SHA512 da55ba22cdc243facb8df1cca5409c7a3f6d14962b459a6c59e80fb3fb02d345bda059e2f2a720cb76e91be569054e49ec9467f4a6d22bd6e53edc042b210b9f
SSDEEP 192:sxRSReC//fosGkZChgzLzoA8poP/g6+WNur4/YioDLJG9IgVIWHJ:sxRSL//fosGa3zqG/5h/9rp
TLSH
T1D042D715AD28AD3B4CCBD21DBB55BF63D2F95032A5901E48E6FD9A1C04EB6DD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 31KB
SHA256 b7e10ed2291a4a45916419282c3eb32e2c8790da2a0551d0bc27a6b7a1bc6c1b
MD5 be6ae8d7d05270ad782945ca323a9f6c
SHA1 904eccdf21db5ff1e810b2849bc53cff53954697
SHA512 1b2c3198ecc11b46a8844ad526e45f829a4b9f8eed84a9afaf10ae3b3a6a84b1ef5f071af85fb7b199c09caad2ae003f525d9f09a6a6b2171a1aad8412c28eb1
SSDEEP 768:UaP8VXeLoADsIhOCym1mw8Yx4BSewDSgsAyBgex:xEVgoSbR1x8YoIhex
TLSH
T154E2C0E0A8BE9D7658E7AA7C39E75FC6432049CD0789E521BF0AE4C97D0F84160D1D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81e16e40d4f29486_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81e16e40d4f29486_0
Size 5KB
SHA256 c82486c70c47fa5ff61246d3a54bcf7a46e5e8f7ab4092b52eee241867ae2413
MD5 ba8b7fa735abebfcfb64c9f7f7e785ff
SHA1 7064b95607a53c519bc1aa4927cf09da56fbe0ce
SHA512 3a3b08a2764d60148776a551e2e035ff64f6c145605fd74e6d8e08f6d2b4616c60765cb8250513e1229becbf3ac1661d656bf0ae42a78c78ac0fa78b9d0cd613
SSDEEP 96:cXe9y1FItDvv5tE928i3XPGkVJ4Fbk9bwlwahhgUVjy8WrymZg2j/:+eK+X5t+ZYpQ6w/jQ
TLSH
T175B164C25BAD6E0ACE2313FE42958665B3B5520A2F83C33726D543716C6A7F74D0B907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9365fbf464af8e7407f046b7469a122c5bf42d97c4a54e71ee5aaab39d6b0c50
MD5 bdef5097d63f7011f315d9f8bccc1461
SHA1 696a5a458726e33f6245b0ff343a13ca60242cdc
SHA512 e61b27095d3fa5c4aa00eda28aa6d39e5ab66f74b830b20322a3d1f2e2d9c98109544bcb965bd5a89b1d49fd7df6d97460d22734cea4c7a7aaf737e184b2362c
TLSH
T12F514DC2A5626091F7A95D70BDEB2D873EEFC7C06C8B0FC17394F5B4A883B61819010A
MD5 SHA1 SHA512 TLSH

Submit Download

c8b1e4f4-47e2-46b2-acdb-7d464eccaa97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c8b1e4f4-47e2-46b2-acdb-7d464eccaa97.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0818cc56-49a3-4ea1-9842-918c20e31608.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0818cc56-49a3-4ea1-9842-918c20e31608.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

84c18f67-b5f3-431d-aa7c-65d9f54de897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84c18f67-b5f3-431d-aa7c-65d9f54de897.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b07327778b109e18a587b4e0e2a98afee62dd4e9e51cb767dbaca4f445ba20ee
MD5 8344d0e2f454cc579ba1560d0d537662
SHA1 36d19498ef267bf9109b2a738e165e3214dbf476
SHA512 a448f221fd7503ac2b13c8069f8ecc02445691e2b28038a2817d596c5a0035350db55cc0e425e32e5a1672c3958efd0d1758165f1b50cebfddf61509fa4c94a8
SSDEEP 96:KUowK1+KnvOtBvd9hMhs82phKOI2vh63/0pdinyF2iUwcEMwPv2qEKOh28E6CivN:qjjDl0ruX7x3
TLSH
T19391E92530372281397E351890E5A77E438272633124E9AF7FD920A68E2BE145DFD5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c097ac1d-647d-4148-ba15-f899de5ae72f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c097ac1d-647d-4148-ba15-f899de5ae72f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c0d43c23-2473-4c99-89fa-a440f2dfb317.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0d43c23-2473-4c99-89fa-a440f2dfb317.tmp
Size 29KB
SHA256 3eff595685a62874f687df64728caf4a1f7b745b193306804fd720f8cab74c27
MD5 af2c7b86642ed615c03c658b22339f80
SHA1 f2a9ca683df35e1849eda9a0aa5bb7ba7f73c587
SHA512 d8a9b315c4852cafcb988095af07a4a89d972c15150ec5982459013fe4f6883644d11285cc7177ef9f7503c7e36f1cc04e9fe78601d6ef67264764e172a7d128
SSDEEP 768:XIDmwY7pLuLjXoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnuDIljVroTQDU:XIDmwEEjXoWgvHfnvu1jaUuDmjuTQg
TLSH
T15CD2EB7B640DCA7F4F800ADDEC297A9B6DA802CB9A98C94047FE941C02D67EF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

694cd444-86eb-4045-8733-5f36898da7ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\694cd444-86eb-4045-8733-5f36898da7ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

8133805c-e6b4-439d-a2ad-cca7c7478906.tmp

Path C:\Users\Admin\AppData\Local\Temp\8133805c-e6b4-439d-a2ad-cca7c7478906.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84221eb1-2814-4574-895e-2d3de07eb3da.tmp

Path C:\Users\Admin\AppData\Local\Temp\84221eb1-2814-4574-895e-2d3de07eb3da.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

minimeters_shader_cache_-5980775891053976249_vs_5_0_Text.bin.tmp

Path C:\Users\Admin\AppData\Local\Temp\minimeters_shader_cache_-5980775891053976249_vs_5_0_Text.bin.tmp
Size 1008B
SHA256 e6d99ce8e7c9063cc71da180189b32a3170272a0d56ad0a9755f2135223beea4
MD5 07f9aa9005e895a8e4fa18889c48f5d5
SHA1 68f28084b2ee4e5e870809aef14e1427c017651d
SHA512 6b735299fc329c85f11db0885f074ae557d02aa6c4372e45bdf93beee0151958421deadba74b2d2e057462cd5fe8cd53287b349c567ba8b8afd41c84d1e7cc1d
TLSH
T1A411460267C9DC67C63D93B188DB1342737BF0806FA39B67A444A6769D1A3C09B1760D
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst333C.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nst333C.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nst333C.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5952_1501473259\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5952_618961552\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansJP-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansJP-Medium.ttf
Size 5.5MB
SHA256 fdb4044741bc68f30ea8b92c1aefd920530a2d044f8753a6148148abdeb33958
MD5 818eefff2fa0b989124d9ba3a84f073c
SHA1 07ce11b5f8c64155d30fcdbf849b82e3840cb53c
SHA512 96483c07afd1a7b6177f00ba3794a2e6ba321ba7aa4ac57b491482308a106d0fd08f8735e2b5e9241cd13ab140702015678401875de574a0793364b5dbe19e67
SSDEEP 49152:Oi7/LBcP8JrdDMLDgAU0Z8J5CcIYsEfWLhM4zja/gomukguQYwQLWOPhK7TK:nbmkDKBc5CcRIC4aozukrwUWOuK
TLSH
T15D463987266D3D8BC1B56BBC554150BCF0CFC82DAB99D3F09DDBFC5A418A4421C42BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansTC-Medium.ttf

Path C:\Users\Admin\AppData\Roaming\MiniMetersSupplemental\NotoSansTC-Medium.ttf
Size 6.8MB
SHA256 6dab5509da393017701282da4f8373731ff5471bdeab05c08cf06be2a2738b1e
MD5 77bb826ea1eacfcd234608d3dedd1e2d
SHA1 0207e8e9dde26122d25e4880cc340ac9fdea5a9a
SHA512 c63711f90771a1dfde7f6328ad63ad2ac72f768fea2bcc0719f3df2e127a178711c083c17e8fcae00b08ac4411ed9768fe38fbe542bf43cc1ef91f9d4cc6a482
SSDEEP 98304:GqbyX/gAuQ9eEFUi2t2ZMp06WRWWzfiWvz36JzEEILyT:Bt8e7x1ajoEbW
TLSH
T15F6659C7165E39CB81A52BBC544190ACF1DFD82DAB99D3F4CDE7FC5A40964420C82BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Current Preset.mms

Path C:\Users\Admin\AppData\Roaming\MiniMeters\Presets\Current Preset.mms
Size 1KB
SHA256 35caffbec000dfb1b488c1f3b00295a0ed8382797a1a444951e868c7e7a43221
MD5 094aa8cae1852e44de11ee406bbac797
SHA1 c8ed9f5a45e5dd4572268d315a235827a5c1d125
SHA512 4687dd11373b4d135cde17deb1da1ec5aca8b8d13d6839cce903adb19f7e989c9d6436bb90dbc483210e136d4aa86a21520e9f7e88e852591b059fe195a4f5a6
TLSH
T1AA31D453D2551E529D28AC468EB2591CBE18AD3740CF3C36FE4C833D6F097142BA4BAB
MD5 SHA1 SHA512 TLSH

Submit Download

MiniMeters.lnk

Path C:\Users\Admin\Desktop\MiniMeters.lnk
Size 920B
SHA256 1ed815b9dd44ca49a587dbf7ca4a5ad8ac047907e33008fb1595d51f363fe16a
MD5 6095a1f8554884f035b4a619ad68b96e
SHA1 0da1d32713e2b135a0634c65b40304b681f41a9a
SHA512 c3c3164e3359c06f107be7121e7ff4b78a0546606a77ee06d4058facce34a3b6dba1bcdda239a508417374e9c10d5bb86ac1b3412c01e75c5245a7cf769148b8
TLSH
T136116D0017D76B0AF2E29A722AB54720AA27F919DF288B5D42D402990476504E178BA7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4516-50-0x00007FFF74650000-0x00007FFF74660000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads