Analysis

  • max time kernel
    91s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01-09-2024 00:10

General

  • Target

    Silver Rat [Re Lab].7z

  • Size

    10.6MB

  • MD5

    f06813aa321c43a69a04904cfa735a44

  • SHA1

    820a0f9f4c00af6ce2583218019ad14a5c5592e2

  • SHA256

    a384bad25740a4b783eaadd6ade53d96e878e1313c34321ddfb23149fbf6366d

  • SHA512

    72551e22ba2db4759ad905f92f407f7e8266e363aa8627a56d8bcaea83a69a96466269358a034e626581f24c2417fa98bb0bb57472f96c2ea39b2708edaa5bb8

  • SSDEEP

    196608:vGbH8yKZWDv2mzFaZ9+j0PlI6obvU/Y0NK6HLlzcurSGBZ+pbJ:vGTiMLNaLIulI6z/YGJHp76P

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Obfuscated with Agile.Net obfuscator 4 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Silver Rat [Re Lab].7z"
    1⤵
    • Modifies registry class
    PID:3980
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Silver Rat [Re Lab].7z"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1144
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:420
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa0b703cb8,0x7ffa0b703cc8,0x7ffa0b703cd8
        2⤵
          PID:3176
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
          2⤵
            PID:424
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
            2⤵
              PID:764
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
              2⤵
                PID:4504
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                2⤵
                  PID:1540
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                  2⤵
                    PID:3256
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
                    2⤵
                      PID:4784
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                      2⤵
                        PID:128
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                        2⤵
                          PID:1904
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                          2⤵
                            PID:440
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4820
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:8
                            2⤵
                              PID:3688
                            • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2504
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
                              2⤵
                                PID:3636
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                2⤵
                                  PID:4684
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                                  2⤵
                                    PID:3104
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14244465135277212327,16524181711623670860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
                                    2⤵
                                      PID:2332
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4140
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:3688
                                      • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe
                                        "C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4864
                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                        1⤵
                                          PID:4756

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          0487ced0fdfd8d7a8e717211fcd7d709

                                          SHA1

                                          598605311b8ef24b0a2ba2ccfedeecabe7fec901

                                          SHA256

                                          76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

                                          SHA512

                                          16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          5578283903c07cc737a43625e2cbb093

                                          SHA1

                                          f438ad2bef7125e928fcde43082a20457f5df159

                                          SHA256

                                          7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

                                          SHA512

                                          3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                          Filesize

                                          211KB

                                          MD5

                                          e7226392c938e4e604d2175eb9f43ca1

                                          SHA1

                                          2098293f39aa0bcdd62e718f9212d9062fa283ab

                                          SHA256

                                          d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                                          SHA512

                                          63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          1KB

                                          MD5

                                          b7f5521f3107dbb235bc164b8bf40368

                                          SHA1

                                          580caaef0d0ff8e969858eb85911d25f7d248e58

                                          SHA256

                                          ba243dae4fa76afbcce472b38ffe30c71e4fb63fbb64ff1b78e8360609ee5ca0

                                          SHA512

                                          744a4e8dfa4f414599182c7b44cfc01bbf8c141fb151054a69dd59ac59b08e026742be132e9ccb2d1cc853ab467571fd8f3fce87e23e0a9abe8ef77883f05cb7

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          98e7cfd112864519aceca834785fe4ee

                                          SHA1

                                          11d2fb9386a73be60aa75b4944c0c0cc75621691

                                          SHA256

                                          42030bc73b2304906ed683e2ee21a4a6e902b16b9317f6ed4b684c235ddd4d37

                                          SHA512

                                          8e452a2884ecc47b842e198c157775ba6cdaa4c8ae82270d7ad90fd229b0ebc4b794b109a18e048a4f1d77874900581ab5e8a6c2bed17240049fc3c66273054c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          2fc8f0600868d78f4c8c4e84b34a6a16

                                          SHA1

                                          555838854baf52c73deaa01f6307313de5e6d278

                                          SHA256

                                          0f327d24a7bfa6f0423b799018665caa4b1c9db626d4fbaec39bc5b5441da9cb

                                          SHA512

                                          9d441b306e05294771b5fb6932468cbd5561c2f810a63549d4fe6edef027b0cb0e2c39321931472bf1e70250269ae0b1624bf387f1e3dbdcbd03b0bc35089b2d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          47f3edcf1f4417d710c7b527dcadfeb0

                                          SHA1

                                          5e126251b3ee3323afe7a4090f97dbaaaf7e8d4d

                                          SHA256

                                          58250e6081d12dbf928f4f5a17d0ccdbe0293e6fc4998561fa9d5e24a6430071

                                          SHA512

                                          23ee8ec60fb07bd7804cc13fbd70b46140aca0025984b8d349ffccbf443310035e2d55d41a5289133629eb9cdef777dc959bd7215535415836186bcbf2fea970

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          b8f5c71b0ee7d54d87ceb448f02a823a

                                          SHA1

                                          90ffde413d342607dc07b1315cbc13003c814afc

                                          SHA256

                                          bc4f259fd5e65dcd216dcceb7bbd09d9d2fb09487e337203bd96ebee0bb12ac2

                                          SHA512

                                          31107814dcde5d85b6a26cbc738e9d2dd5b85fe1d7f786b9b6af082e8b5e638a14d221ae5b46b12a38c9725c4ce256ddaa351dade5c1b320c6b190e33b73a999

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          0cd7e4766f082209951daf5dd4bb57f5

                                          SHA1

                                          d85a4b7ec57e7f3bb578a8255fcd6b7dc1830f93

                                          SHA256

                                          38fb84b3c52bc8699776ad5c0806f2f9a6945df7a239c38f3fb8c90fd2a79156

                                          SHA512

                                          6d17bcbceb72122c7492a68c64efa3fbbbae76f1911653dcee59990a1e0503e0d049c3c6cc25a15f8679adc756329de1f77afaf3617b3759df6aecec337d4a24

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          fdef1d6a4cbbbe35021b7d781ccda0ef

                                          SHA1

                                          b4283d08ff73ce88785ab464433efca7d8803d23

                                          SHA256

                                          fcab4b1c756ca343c56a78e3e978597264158890448c325f23447f65f5940fc9

                                          SHA512

                                          5be7917b76ea5aee411bf98a5b40b687bf43cef7790082bae644f09f5e7d98b848caee81737af18f53c12fe96787f4ea025a1d39ec4847be654239041c0feee6

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585fee.TMP

                                          Filesize

                                          48B

                                          MD5

                                          063b7e13f1f2202a38a5f12d357010bc

                                          SHA1

                                          ce107dc58a9296103ab808478b354b597a893fbb

                                          SHA256

                                          d5d35095145b06820176475f99d790960b3880ce48f29aea54220c20fae9e20d

                                          SHA512

                                          7a20d1dd886be798fe2c30696374463b3306997337f7c7daad2b13d5b6d4d3f7e8a566e89e685e347323dcb7540b2515023334c5c34d142aee0c7cce26b94951

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          eea22378aa68f0c7d3f8f0a2b3671747

                                          SHA1

                                          a656d1127bc17aca863c72b6edcff52331330058

                                          SHA256

                                          251550c003eb8f146bd2044d14caa0c36ee419a873c5d6b30146eadde7c9523b

                                          SHA512

                                          2581f3526c34791df9976ec8413a638d1baecfcd3e63b3b9ab38e6a6d1cfa2b7bdc32e9bf4b858030d732bb8de60da9a01d4cc33653b7b34d05873e3f0bfc446

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          3a4216aaa350d5ff0f2a1a8904356c7e

                                          SHA1

                                          74336146f3d794643e2692d4afc0b7d0864b841d

                                          SHA256

                                          8670d9aaacee7d5b0c59eb5a00e4c4ce17d98d53b8352700dfab6b73eb0de122

                                          SHA512

                                          cbcb72f0dbf91dfb4ff7292f56424f0d2dadcdb239d919f5fb9731bde44036e02d0d6c16344839ea974e1f7dd5e0f0d85529a5148f14865716be5af6a6d7cc88

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          564d3f3e48fb124abcbe9286788814b4

                                          SHA1

                                          3af5ffe6c82ed14992f07993d365c0ec2e629ba1

                                          SHA256

                                          991824c11ec9e91f5a05993ea14f64070c9dc0fbb2d9fe4f9761d1c7a3325184

                                          SHA512

                                          e393c9415931b9ec6e78a4d11c1af6c35a73bb4b9adc6d24a3f47c85e472825dfb70a0ac4dab49b044753daa4f36bf1b0ed2ece3d646a1474055c3bfe35ed6ce

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                          Filesize

                                          14KB

                                          MD5

                                          ad332ac2a8b0fc062f6123b46e9e3d00

                                          SHA1

                                          5caf9bd4108b7a7f9c921c0addda90ef3a63a1eb

                                          SHA256

                                          1867358bd6c29ad069ec75cab53f740e09379586a24ac1186eb6149c61bb096d

                                          SHA512

                                          b25dcbfa412e0ece566baa1593ece7e55ba482b65c97bd6eba20bc04c33fab89aeb4377ac0fc1821f26eea5fc955d1341152d8bf4b77973eea6a406687cb42be

                                        • C:\Users\Admin\AppData\Local\Temp\TmpD26E.tmp

                                          Filesize

                                          4KB

                                          MD5

                                          e1a48ec781542ab4f0d3a3368b2a1d05

                                          SHA1

                                          a35670f07e5320a1591a55d903b35dcdd1d224a1

                                          SHA256

                                          f41d8818774f3ec0bf936e564f50008b46f5e4060edaab3bd72ffa389fb9ef21

                                          SHA512

                                          d3e756d8b321d38962a7b36af617d152e9bfd499b31f1630a24ada435715ad81a29ab73e4ab4aa21bbc9029b4177a943303e7df922bf375c2583607cb6f6566a

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.Licensing.dll

                                          Filesize

                                          1.3MB

                                          MD5

                                          c18a9e44e200c7315a1868caab894293

                                          SHA1

                                          18f65508762d2492f41b22e4e6e5ad19a2226baa

                                          SHA256

                                          661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22

                                          SHA512

                                          9a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\Builder.xml

                                          Filesize

                                          1KB

                                          MD5

                                          3fcd4ac4720febae7ed0b81913daaf1c

                                          SHA1

                                          7d2ec4090023cc93a453c65782c78fe9bcf5afbd

                                          SHA256

                                          b4b7d0f7878a60e5d641443a7d4720e178568e6febbb38a243d3b9fb8a30842b

                                          SHA512

                                          c6a5c5c5d17d2e56fd2fde8705062a8916673ec5557ef9f30c9f62c67877c72f5b8e4528a3a8a8ec24f74e5c52ed385442483606b13972bcc645257a5826f2ca

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\SocketPort.xml

                                          Filesize

                                          57B

                                          MD5

                                          5f807862258a390b2e2f75abb6d2c865

                                          SHA1

                                          22abc144aa034c6490cbf143a8f1cdd42bd06d1b

                                          SHA256

                                          7b87c31f6d1163fc236651f5e1f3187cfa0c79d4a85d20c1c05f1dc3056c4823

                                          SHA512

                                          b831e4b2eeec23e39544961cef6619c8d57c50b53dc6bad8846682df6f5252041f50ce33cbe182488288d6d5e2e3e5194055ee4143ceb09f9601ed49d39dba39

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe

                                          Filesize

                                          25.2MB

                                          MD5

                                          d6527f7d5f5152c3f5fff6786e5c1606

                                          SHA1

                                          e8da82b4a3d2b6bee04236162e5e46e636310ec6

                                          SHA256

                                          79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9

                                          SHA512

                                          2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe.config

                                          Filesize

                                          526B

                                          MD5

                                          d6f1152d647b57f64494c3e1d32ede94

                                          SHA1

                                          a35bd77be82c79a034660df07270467ee109f5ac

                                          SHA256

                                          a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72

                                          SHA512

                                          699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\bunifu.ui.winforms.1.5.3.dll

                                          Filesize

                                          297KB

                                          MD5

                                          c1d51a0e747c9d6156410cb3c5b97a60

                                          SHA1

                                          86312cba2eb3495cc6bec66d54d4ab88596275d8

                                          SHA256

                                          6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a

                                          SHA512

                                          a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\bunifu.ui.winforms.dll

                                          Filesize

                                          1.3MB

                                          MD5

                                          686833fccd95b4f5c8d7695a2d45955d

                                          SHA1

                                          882f60ea47f536c1f01da0f5767dfe5d569fc011

                                          SHA256

                                          578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2

                                          SHA512

                                          8bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\cgeoip.dll

                                          Filesize

                                          2.3MB

                                          MD5

                                          6d6e172e7965d1250a4a6f8a0513aa9f

                                          SHA1

                                          b0fd4f64e837f48682874251c93258ee2cbcad2b

                                          SHA256

                                          d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0

                                          SHA512

                                          35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

                                        • C:\Users\Admin\Desktop\Silver Rat [Re Lab]\guna.ui2.dll

                                          Filesize

                                          1.4MB

                                          MD5

                                          acec68d05e0b9b6c34a24da530dc07b2

                                          SHA1

                                          015eb32aad6f5309296c3a88f0c5ab1ba451d41e

                                          SHA256

                                          bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277

                                          SHA512

                                          d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700

                                        • \??\pipe\LOCAL\crashpad_2540_GLXIUGXBJHZYPJYT

                                          MD5

                                          d41d8cd98f00b204e9800998ecf8427e

                                          SHA1

                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                          SHA256

                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                          SHA512

                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                        • memory/4864-355-0x00000000081F0000-0x0000000008222000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/4864-353-0x0000000008250000-0x00000000084A2000-memory.dmp

                                          Filesize

                                          2.3MB

                                        • memory/4864-356-0x00000000092A0000-0x000000000933C000-memory.dmp

                                          Filesize

                                          624KB

                                        • memory/4864-345-0x0000000007E20000-0x0000000007F70000-memory.dmp

                                          Filesize

                                          1.3MB

                                        • memory/4864-354-0x0000000007F80000-0x0000000007F8A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/4864-369-0x00000000097B0000-0x00000000098FE000-memory.dmp

                                          Filesize

                                          1.3MB

                                        • memory/4864-341-0x0000000007390000-0x0000000007506000-memory.dmp

                                          Filesize

                                          1.5MB

                                        • memory/4864-337-0x0000000006F70000-0x0000000007002000-memory.dmp

                                          Filesize

                                          584KB

                                        • memory/4864-336-0x0000000007520000-0x0000000007AC6000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/4864-335-0x0000000000B40000-0x000000000246E000-memory.dmp

                                          Filesize

                                          25.2MB

                                        • memory/4864-349-0x0000000007CD0000-0x0000000007D1E000-memory.dmp

                                          Filesize

                                          312KB