edaf2f7d798ec50334bd6e3b01ae2744b32b4b371cc92168c24be4d7a9b704bd

Analysis

user interaction
yes
max time kernel
599s
max time network
600s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/07/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Silent Client Setup 4.4.2 x64.exe
Size 70.5MB
Sample260723-2vr5dade59
SHA256 edaf2f7d798ec50334bd6e3b01ae2744b32b4b371cc92168c24be4d7a9b704bd
MD5 94ad60ac3c0ea10cdb95c22247c4caff
SHA1 fbe2bbbfb254c020dd322d52c42a07f32acc9d3b
SHA512 bcb7300d1cf9318f5b3874ecafa2385bf31501090567833255364cf1924ff0e3c61ab583d855c5c1ae6a9c5447e7bd3e5c7763c21d2fbccaa5142310f241eae9
SSDEEP 1572864:OH4opqebd6+v9xFJgHaXOTqPLk8rDbDkkagQkpIEirY/5xiPM:OHHlbd6wzFJsNH8nkkagQfXYRxUM
TLSH
T1A4F733D1CC7E4912D8801E7D5A708BFCDD8AB63917A6C6D8C482796CFAF343C471A46A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3224	Silent Client.exe
4664	Silent Client.exe
5512	Silent Client.exe
1620	Silent Client.exe
5496	Silent Client.exe
3376	Silent Client.exe

Loads dropped DLL 19 IoCs

pid	Process
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
3224	Silent Client.exe
4664	Silent Client.exe
5512	Silent Client.exe
4664	Silent Client.exe
4664	Silent Client.exe
4664	Silent Client.exe
4664	Silent Client.exe
4664	Silent Client.exe
1620	Silent Client.exe
5496	Silent Client.exe
3376	Silent Client.exe
3376	Silent Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5800	tasklist.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_2016667703\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_454431693\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_454431693\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1243305717\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_454431693\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1243305717\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_2016667703\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_454431693\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_1311772973\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5060_251733935\shopping_fre.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5604	powershell.exe
3432	powershell.exe
4360	powershell.exe
2408	powershell.exe
6000	powershell.exe
5220	powershell.exe
5404	powershell.exe
1352	powershell.exe
4552	powershell.exe
2184	powershell.exe
4296	powershell.exe
3356	powershell.exe
1096	powershell.exe
4384	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5564	cmd.exe
5612	cmd.exe
4216	cmd.exe
2536	cmd.exe
5736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Silent Client Setup 4.4.2 x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1368	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Silent Client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Silent Client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Silent Client.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293215061247888"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{5FBD6EEB-7E12-4CB3-B38C-CAF19C092ACC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146	Silent Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\URL Protocol	Silent Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\shell	Silent Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\ = "URL:discord-1055105215487021146"	Silent Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\shell\open\command	Silent Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\shell\open	Silent Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1055105215487021146\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\silentclient\\Silent Client.exe\" \"%1\""	Silent Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
6116	Silent Client Setup 4.4.2 x64.exe
6116	Silent Client Setup 4.4.2 x64.exe
5800	tasklist.exe
5800	tasklist.exe
4552	powershell.exe
1352	powershell.exe
1352	powershell.exe
4552	powershell.exe
5604	powershell.exe
5604	powershell.exe
4360	powershell.exe
2184	powershell.exe
3432	powershell.exe
4360	powershell.exe
2184	powershell.exe
3432	powershell.exe
2408	powershell.exe
2408	powershell.exe
4296	powershell.exe
4296	powershell.exe
3356	powershell.exe
3356	powershell.exe
5220	powershell.exe
5220	powershell.exe
1096	powershell.exe
1096	powershell.exe
5404	powershell.exe
5404	powershell.exe
6000	powershell.exe
6000	powershell.exe
5220	powershell.exe
3356	powershell.exe
2408	powershell.exe
1096	powershell.exe
4296	powershell.exe
5404	powershell.exe
6000	powershell.exe
4384	powershell.exe
4384	powershell.exe
3376	Silent Client.exe
3376	Silent Client.exe
1032	msedge.exe
1032	msedge.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeSecurityPrivilege	6116	Silent Client Setup 4.4.2 x64.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeShutdownPrivilege	3224	Silent Client.exe
Token: SeCreatePagefilePrivilege	3224	Silent Client.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	1352	powershell.exe
Token: SeSecurityPrivilege	1352	powershell.exe
Token: SeTakeOwnershipPrivilege	1352	powershell.exe
Token: SeLoadDriverPrivilege	1352	powershell.exe
Token: SeSystemProfilePrivilege	1352	powershell.exe
Token: SeSystemtimePrivilege	1352	powershell.exe
Token: SeProfSingleProcessPrivilege	1352	powershell.exe
Token: SeIncBasePriorityPrivilege	1352	powershell.exe
Token: SeCreatePagefilePrivilege	1352	powershell.exe
Token: SeBackupPrivilege	1352	powershell.exe
Token: SeRestorePrivilege	1352	powershell.exe
Token: SeShutdownPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeSystemEnvironmentPrivilege	1352	powershell.exe
Token: SeRemoteShutdownPrivilege	1352	powershell.exe
Token: SeUndockPrivilege	1352	powershell.exe
Token: SeManageVolumePrivilege	1352	powershell.exe
Token: 33	1352	powershell.exe
Token: 34	1352	powershell.exe
Token: 35	1352	powershell.exe
Token: 36	1352	powershell.exe
Token: SeIncreaseQuotaPrivilege	4552	powershell.exe
Token: SeSecurityPrivilege	4552	powershell.exe
Token: SeTakeOwnershipPrivilege	4552	powershell.exe
Token: SeLoadDriverPrivilege	4552	powershell.exe
Token: SeSystemProfilePrivilege	4552	powershell.exe
Token: SeSystemtimePrivilege	4552	powershell.exe
Token: SeProfSingleProcessPrivilege	4552	powershell.exe
Token: SeIncBasePriorityPrivilege	4552	powershell.exe
Token: SeCreatePagefilePrivilege	4552	powershell.exe
Token: SeBackupPrivilege	4552	powershell.exe
Token: SeRestorePrivilege	4552	powershell.exe
Token: SeShutdownPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeSystemEnvironmentPrivilege	4552	powershell.exe
Token: SeRemoteShutdownPrivilege	4552	powershell.exe
Token: SeUndockPrivilege	4552	powershell.exe
Token: SeManageVolumePrivilege	4552	powershell.exe
Token: 33	4552	powershell.exe
Token: 34	4552	powershell.exe
Token: 35	4552	powershell.exe
Token: 36	4552	powershell.exe
Token: SeShutdownPrivilege	3224	Silent Client.exe
Token: SeCreatePagefilePrivilege	3224	Silent Client.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeIncreaseQuotaPrivilege	4360	powershell.exe
Token: SeSecurityPrivilege	4360	powershell.exe
Token: SeTakeOwnershipPrivilege	4360	powershell.exe
Token: SeLoadDriverPrivilege	4360	powershell.exe
Token: SeSystemProfilePrivilege	4360	powershell.exe
Token: SeSystemtimePrivilege	4360	powershell.exe
Token: SeProfSingleProcessPrivilege	4360	powershell.exe
Token: SeIncBasePriorityPrivilege	4360	powershell.exe
Token: SeCreatePagefilePrivilege	4360	powershell.exe
Token: SeBackupPrivilege	4360	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 5564	6116	Silent Client Setup 4.4.2 x64.exe	81
PID 5564 wrote to memory of 5800	5564	cmd.exe	83
PID 5564 wrote to memory of 5104	5564	cmd.exe	84
PID 3224 wrote to memory of 5612	3224	Silent Client.exe	88
PID 5612 wrote to memory of 5468	5612	cmd.exe	90
PID 3224 wrote to memory of 4664	3224	Silent Client.exe	91
PID 3224 wrote to memory of 4664	3224	Silent Client.exe	91
PID 3224 wrote to memory of 5512	3224	Silent Client.exe	92
PID 3224 wrote to memory of 4216	3224	Silent Client.exe	93
PID 3224 wrote to memory of 4552	3224	Silent Client.exe	95
PID 3224 wrote to memory of 1352	3224	Silent Client.exe	96
PID 3224 wrote to memory of 5604	3224	Silent Client.exe	98
PID 3224 wrote to memory of 2536	3224	Silent Client.exe	101
PID 2536 wrote to memory of 5896	2536	cmd.exe	103
PID 3224 wrote to memory of 5736	3224	Silent Client.exe	104
PID 5736 wrote to memory of 1260	5736	cmd.exe	106
PID 3224 wrote to memory of 3432	3224	Silent Client.exe	107
PID 3224 wrote to memory of 2184	3224	Silent Client.exe	108
PID 3224 wrote to memory of 4360	3224	Silent Client.exe	110
PID 3224 wrote to memory of 4296	3224	Silent Client.exe	113
PID 3224 wrote to memory of 2408	3224	Silent Client.exe	114
PID 3224 wrote to memory of 6000	3224	Silent Client.exe	115
PID 3224 wrote to memory of 5220	3224	Silent Client.exe	116
PID 3224 wrote to memory of 3356	3224	Silent Client.exe	117
PID 3224 wrote to memory of 1096	3224	Silent Client.exe	118
PID 3224 wrote to memory of 5404	3224	Silent Client.exe	119
PID 3224 wrote to memory of 4384	3224	Silent Client.exe	128
PID 3224 wrote to memory of 1620	3224	Silent Client.exe	130
PID 3224 wrote to memory of 5496	3224	Silent Client.exe	131
PID 3224 wrote to memory of 3376	3224	Silent Client.exe	132
PID 3224 wrote to memory of 5060	3224	Silent Client.exe	133
PID 5060 wrote to memory of 3040	5060	msedge.exe	134
PID 3224 wrote to memory of 952	3224	Silent Client.exe	135
PID 5060 wrote to memory of 1368	5060	msedge.exe	136
PID 5060 wrote to memory of 1884	5060	msedge.exe	137
PID 5060 wrote to memory of 1884	5060	msedge.exe	137
PID 5060 wrote to memory of 1884	5060	msedge.exe	137
PID 5060 wrote to memory of 5872	5060	msedge.exe	138
PID 5060 wrote to memory of 5872	5060	msedge.exe	138
PID 5060 wrote to memory of 5140	5060	msedge.exe	140
PID 5060 wrote to memory of 5140	5060	msedge.exe	140
PID 5060 wrote to memory of 5140	5060	msedge.exe	140
PID 5060 wrote to memory of 5464	5060	msedge.exe	141
PID 5060 wrote to memory of 5464	5060	msedge.exe	141
PID 5060 wrote to memory of 5464	5060	msedge.exe	141
PID 5060 wrote to memory of 5532	5060	msedge.exe	143
PID 5060 wrote to memory of 5532	5060	msedge.exe	143
PID 5060 wrote to memory of 5532	5060	msedge.exe	143
PID 3224 wrote to memory of 4520	3224	Silent Client.exe	145
PID 5060 wrote to memory of 2248	5060	msedge.exe	146
PID 5060 wrote to memory of 2248	5060	msedge.exe	146
PID 5060 wrote to memory of 2248	5060	msedge.exe	146
PID 3224 wrote to memory of 3240	3224	Silent Client.exe	147
PID 3224 wrote to memory of 4760	3224	Silent Client.exe	148
PID 5060 wrote to memory of 944	5060	msedge.exe	149
PID 5060 wrote to memory of 944	5060	msedge.exe	149
PID 5060 wrote to memory of 944	5060	msedge.exe	149
PID 5060 wrote to memory of 3232	5060	msedge.exe	150
PID 5060 wrote to memory of 3232	5060	msedge.exe	150
PID 5060 wrote to memory of 3232	5060	msedge.exe	150
PID 3224 wrote to memory of 4656	3224	Silent Client.exe	151
PID 5060 wrote to memory of 2156	5060	msedge.exe	152
PID 5060 wrote to memory of 2156	5060	msedge.exe	152
PID 5060 wrote to memory of 2156	5060	msedge.exe	152

C:\Users\Admin\AppData\Local\Temp\Silent Client Setup 4.4.2 x64.exe
"C:\Users\Admin\AppData\Local\Temp\Silent Client Setup 4.4.2 x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Silent Client.exe" | %SYSTEMROOT%\System32\find.exe "Silent Client.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Silent Client.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "Silent Client.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104

C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
"C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:5468
- C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1472 --field-trial-handle=1644,i,12130834498460590619,13898548560425837011,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4664
- C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --mojo-platform-channel-handle=1864 --field-trial-handle=1644,i,12130834498460590619,13898548560425837011,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --app-path="C:\Users\Admin\AppData\Local\Programs\silentclient\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2944 --field-trial-handle=1644,i,12130834498460590619,13898548560425837011,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1620
- C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --app-path="C:\Users\Admin\AppData\Local\Programs\silentclient\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1952 --field-trial-handle=1644,i,12130834498460590619,13898548560425837011,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5496
- C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe
  "C:\Users\Admin\AppData\Local\Programs\silentclient\Silent Client.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\silentclient" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 --field-trial-handle=1644,i,12130834498460590619,13898548560425837011,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffcf38bc188,0x7ffcf38bc194,0x7ffcf38bc1a0
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,3767381502523381882,643742874711776947,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,12624745934992018168,11528720446220190870,262144 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,14213764411188859349,3819150819760736219,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16812729697553389199,3100374742031600525,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16171283603078132236,247017868238662619,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,10725450276014744723,206194636245170406,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4920,i,3688926337516107615,5917896521612390884,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5140,i,11672293077819787113,14905884863715429704,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4244,i,8872948683585393510,18033839160692673688,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5488,i,9780973763612017995,17767333338613633642,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5908,i,16607315468866291010,2263469129860455380,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5540,i,15518758868484505849,3986345686921925169,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6376,i,12436861470490934271,833537272243099034,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,12377256595425601466,4904710813507630732,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,13000147050292856368,12976914998315528737,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7108,i,1789443736412349799,14935786804326269745,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7284,i,2733880897194283765,339358225224943546,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7508,i,15950169453708452089,905919002697268960,2097152 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7824,i,9037455581252442325,4082916002826011593,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:14
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7824,i,9037455581252442325,4082916002826011593,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:14
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,16323589212011565412,16211078836754408169,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14
    3⤵
    PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,6534615164950340397,11435485473130117859,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,12971253220476524207,11398822249094418815,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:14
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,5653932493232742602,2255245471053364463,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,14355973934431577495,3093941582418539886,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,6690943447790737444,1780174319260838313,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8119757728523978535,1555754140373556488,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,3781719788859815301,15249166031792171055,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:14
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7088,i,5440290940781405848,11664245369136966978,262144 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,5123676196978789262,14054920556255605738,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,6853896265574028854,5827713578498481153,524288 --field-trial-handle=2572,i,3434610137587190542,13304196019467592999,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:14
    3⤵
    PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://auth.silentclient.net/register?redirect_url=http://localhost:51069/auth&force_login=1
  2⤵
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4bb05a05277f291c98db321b3470fa84e8532fe183752ba2c26f44af24ec74f8
MD5 e41c6719183c309f0f4c244a261040f3
SHA1 93207a30a7cf866a379e925d23c7920e13211066
SHA512 b67b2114ab54e1bbfb09e4f76d18b99842bb3d213cfd9ea27492ece59695a4636dc9a1c5b4ba1f31ffd48873f250da56f44ad1f8d0b4633b7bde57256e6b87e9
TLSH
T10EE02BAFC9309C2719FD4B5AA16546C5EA9057576680885F3B3D450D8FB472A42C581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 32KB
SHA256 40afde9ab0f6f6bcff9b1a4a670bb843527fbbb10b8904ea224b27502bd2bfd4
MD5 8015b8201d2df2135d56b706ea76642e
SHA1 15455e5c89fec6d41385b0341c0bd474091aab50
SHA512 6194e3177b1936db840b783760e9b67869229c55a8dc171f55ff2180a93dd10f5e41ec8a80f1c1546429e5ad0dc7ca754261288452c1af5747b6b42f2c0a0d18
SSDEEP 768:k+19skVJKVSXxvPkHi4cexlpWtKIBhLgZ2h59:kRkVJhXxvPkC4mzw2h59
TLSH
T1D9E2F162601D5F5F130B7A72F9828BE0639F425061A14B98CA420D2FAFBA7733176705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 23KB
SHA256 03fdf220f32b0c2459f944b09deee93625dd381da9df8290511c0d07e9997b65
MD5 45b0f20c9f3cec9329458552cc7b2850
SHA1 9d1d0451d1122ad9b4d2ca2bdb5e16d6640935fc
SHA512 8c5404c524dbac09af0884d875186fb40d1cd5c8449273ee509ce3d325d73519043ef4ec60548fbaf1dbf4db6b20b57ad5b4440cdef7ac0dc3f85e1bd1f03c45
SSDEEP 384:1RWAd+JJbHirE86N/mb+h17S603payfw6uYco2CAeveaMusekVpI1Z/Ifzjg/EPl:rWAEirE8s/k+hJS603IyfR4o2ReveGsX
TLSH
T177B2F10CA6D89E58443950255ED5E00F72B9CF6F6BBAC56BF9D3402CE3C096D47185C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 19KB
SHA256 1f0b4f5973985988743649a557bbdeae78fa082a0725885517001dbb4acc609e
MD5 fe59dd214d04da8ecc69f92daf3d57d2
SHA1 822b317a4bb3ad69c1205305c0668c27e9285151
SHA512 ab7cfb42eb37a0374e842b589c809c29cf4689935de52bf9f86056538a7f9007ab52d9417b070fd6adeed8ec850b69ce247c9f014960137704bbd55f0495803b
SSDEEP 384:zval/p/EaVmfOlZ1Mpo6+Cd8O9Nk/srbuIwM5QVsHUg1szDFdcdIiL5:zvTaMfk1MpoO8qkIwM5osHUg18I5
TLSH
T11792E0075987BAAC34D472A35FEE1A39BD63E789062C6AA5B57342C3DE03D444307C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 31KB
SHA256 67849bcc11e02177442da14ad954bfe1cc709553dad137b5003449b303e83fc3
MD5 d5c8e706f54e7d82fb45350c62ddb711
SHA1 21e838f00fb7f6998024aba4886c719ebee3aff3
SHA512 53bd94956713ffc280d2c259ac40a61b7259fd0c8cdd29b8fa189991624687ade17badf36ba9dbe2aa9a24d9c0586368038a4b5c6dc47ddd350dac8d76621ac6
SSDEEP 768:B+0O4O4UMvC+piwHos4U4FbJcH6vNLkGXgKvqY1:BTO9aC+phIhVeCNLkIg+T1
TLSH
T184E2F18BCEEB255B9F37A432C6C1211048619674DB1EEB64EDED8C120BF1A1907D8DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 23KB
SHA256 3a586cd495cb0b70cd46c10f8621ecf3b394860b42ead85aa94ef53a9424abbc
MD5 932116b84a8a08820f0386ab09056dbd
SHA1 adc740ae1804e8fadc64be2512ef4feb8a6acae3
SHA512 16942db58bec507ab1cab1414e27e8ef601df2ac27040fd63fc9018138a66d1d40b531b8fe09136fd87ed72974b26673b0e6143a792ffb6c7ae00328ffd60b99
SSDEEP 384:enQck7PXExLkWdvoLTfTfLc7tEQOsgSNgew+TYwr4AfytVgp1pKOkVR1b6zwtsT9:mO7PmLkWJiTbfwpEQicgel/yngp1pKOR
TLSH
T1DCB2E00C7169D48219F1E4ADAAD3AA5657F23F33815F0FE1BD3646BA70418E3A186217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 48eab8d6bc31074547cc1df334376308d93740c8ced74cd7e04b04ff7c0131a0
MD5 206563fe8078ddd0f901b0debaa9b726
SHA1 f0dcd0b8847ca54e745eadbb74540d84b46abc74
SHA512 c48a5258f3468cde5613f7754aae6279b86b9546e022317410664b7297073115a661c1ccc4b2d0942677878a72fae0cd58f0d925620e0fb76dfb167e88d39d26
SSDEEP 96:QDvEaPK3fw0UZMEjrFN653WMo7X0FHE2b:Wa3r1EjvjMo7EX
TLSH
T187815006678DA133EBAB233E74D08FF630724674CD4BDE3F019065B51817BE9D5A6489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5f0aa7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f0aa7.TMP
Size 3KB
SHA256 004e703f1e647e34775e0db7b82b04efdf199da36a1fca8988e2ce874707b9b2
MD5 f38121ff1c2901b0eddea3a3518fc445
SHA1 65a516015754142856d8793a01d67a4187b12850
SHA512 fa27a7100a8a77a823157f1ed0c0b4d973950cecd9bc21ff14fae6817953ec8aaafaa62c4d1d10ee4a2e332ccddc87218f7a486bd990642bd3e0d23979e7e270
TLSH
T16D717109039D4537E7A9233EB8E00FF6307286B5C94BEE36019059F2140BFE9D5664C9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 8ac202bca1fde45e54d8708b8b82647526258f428ff14039ff74e8b0c87fbc24
MD5 63baa03b5b949d069093d9c0e03a46f7
SHA1 664c2b482870a6f7aa03008c424722ed0446b9f4
SHA512 35e2b254a84ce27591d482d820c0338b0928438110dc0f166fb40577603387e4f8a9a95712ce9c8b5d4c86995276acef94a93edbefb5607e484150caafc4f471
SSDEEP 96:D1AHOWZyDnV+mnKYuaaij6uzBT/xmwxiGkGHT71TwQ:D1b64VBKvaaij6u1T/xmwxNkGHT71TT
TLSH
T1DEB190F7C2E88B6DC91151F0AB646D2ECE5D0954432C3D5AC9E5FF8BA3E24B0D20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0b11b39dcff3b2f306996d58775517671cc9e7b9cd5d98b18cabf5cf762f3665
MD5 1ffa26a407a85c0f4eb72702315a8fe5
SHA1 6dbca09a56258f405dabba2dcc563ed7478f91f9
SHA512 4404b225a1046bd499c7d8825e204ebf3822bdb55ca9570aad1512304a2ffa83a546628db43f9c7da75ce5573693945d7f0aaa5a9af292c1ab6f9262d411fa0c
SSDEEP 384:sxZjN07/fms8H560Ly8u9H/bvp65IVFjj:s7+7/fMQ0g/bB6GV9
TLSH
T17962F806AA385977CCDBD219FA45BF53D3F90563D2505E449AFCCA0C04EAAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b2df040a007635e927b75f9d55036c413c1c4dad705689c72978716a9c31648e
MD5 db07b818b23e1ae86b0a077083553536
SHA1 b8f454ac4c3a06ff93ac13a3fbd6a26e3d211826
SHA512 a0fca4f1083f15eb3a3a8f034db2d8b863c09d75788a115964be2f40c887444c0b7f897bc2ee4e04c652766a28a49d238885646a30b8f1058eac244f96a4822a
SSDEEP 192:sxZjRAyMqZjK1Ml8UQ7c7/fmsXuE0CXUyynDuGzodp/f/W6+WNfrbpz10dvUyIVm:sxZjNqg7/fmsXx0Ly8u9H/bvp65IVFjE
TLSH
T17F72F816AA345977CCDBD219FA45BB53D3F50163D2804E44A9FCCA0C04EAAED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 3d3d7274cbc9718f3becf1d6fe64b3e96c45f63cc9c4c69c61ec339cd3517909
MD5 f00bafd4794280050e520146c3b31bdf
SHA1 13f2822ef19c0a9f8c517829a6e2c1ccfa984131
SHA512 6e5dadf286dd301ac12c9523eaa151d3d095b72f6d0c75c33a08de09039e2aa4310a491f411a14b081a26521be392fba0a63d75afc377ac910236e4fa0ae6244
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3O3pQLle:ciWKy8Eq2ADEn5dWRm5rQg7u1jaKO3pl
TLSH
T1FE031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA840C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 675770403d478dde2631217fc77f804e12b30d5145138a6e108267d33057494e
MD5 d7e3d16c1ac83f96e4b6c1e75fbceaee
SHA1 ecf9ff3f948d4e6fa1be85126dc913ae6018e883
SHA512 7f7b24147fb4e6b9ef8c10794509cd6103c51e71e8eb4931176427e122243d9e94e70d2e8b33c3ebbcdeed4c31bd722140dae40d01aa74b9c0788802bff598f8
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv76jB:AFBHhTofhno2mB21q3Llbfe3sLDdeEpU
TLSH
T174B29D56717B12023C3E290CA6929B370E8272A3345CA57F7BB900BA4E67E515DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.18\data.txt
Size 150KB
SHA256 5f26dcaf93bdd5d99e3f6f8266c06378a2855b74daf896788becd9c3f8f47799
MD5 6465a9ebed80863ed27fef7a65fceba8
SHA1 d950817d5f1c64daf8d7eb834c5dfc3384f9ff78
SHA512 e88e87a5f4d5afbcc5fbb867e640f94d3b4aa0a435e1c79056ac54fa221ba12fe094cf5290e86e76033cf0965aac56a2a24fe5db38fc56d3f74526a3e9baa451
SSDEEP 3072:aPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhpu4aQDo6j+UJ9:WX1aI5aZoKzMJ07Nh+QDoE
TLSH
T102E3021089C44FD9DFAC292C50BE0F1D53E1C69E842B6986D763FD4EBF9BA0496270D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e880c859891ab8d29d001e675f098faba3b9ddf94931163b8f7c477488101654
MD5 5ac64e770a1f31050a5a275edae55535
SHA1 1dbaf05d60c96fd7fddad7c50ceb1dd314f6bd2b
SHA512 327ad76a6942181a4442d2fc00fd5bae2418f75a4c123c97aba4cd54db01be3f24922a02cd15803bfa94ae1bbd04fbd1c9682ab9bcca616efde8acf51a05594b
SSDEEP 384:n5ciF9CcmyWCs38NH8TUNTUlIxBydvxotajGfbwoFMtTvDhkP+lFYS/npHy/7Igo:lFccps3kwgAsioFMZvDhkoFYS/r
TLSH
T1C5B25B36ECA8CAB7EDE75F99E74E7607DEE00163858899D4CAD81E5C00C72DD170781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8b57a67fb60eb7c00e880cd573931f3e59afa217d3166b38156549c73cf4ffcc
MD5 a7503554dbc804bb58aa1ff84e6ac1d6
SHA1 899d7804c2bf8c4f46e45fa03bf883b40784387d
SHA512 27ec48fef5e4be40d92f19fd3e06ecbd65112a2f90a645541fd8447c1581c6ab3d35fdc1072dff73b638e36a7078b686f77830ba453a4d72e2ee707320a5f711
SSDEEP 384:n5fiF9CcmyWCs38ND8TUNTUlIRyyaxJjGfbwoFMtT/7uhkP+lFYS/npHy/7Igo:oFccps3kwggdoFMZTuhkoFYS/r
TLSH
T170C24A31E894CDB7ECE75AA9F74E7643DEE001A3C5889AD4D6D91E5C008B2DE1B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e173f8daf95eac874e4fb348717dcd496e05869b11c9e9aee1cfa3ab1947aa79
MD5 c583fbf617593fddbb5f1ff9e20400a5
SHA1 6cadc970a7481ac6345d75f3f102b2b3b0b56f26
SHA512 f976961687a9a9ea6481923180f8ab54609689aa2d2be028f6c6c53d855e0254e6df06bb6ba4b3680eec67add41378a317ed7c2cdfabb7309cfaf437e7e6e830
SSDEEP 384:n5SiF9CcmyWCs38NP8TUNTUlIxBydczajGfbwoFMtT/7uhkP+lFYS/npHy/7Igo:zFccps30wgdioFMZTuhkoFYS/r
TLSH
T192C25B35E898CDB7ECD75EA9F74E7643DEE001A385889AD4D6C91E5C00CB2DE1B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 430bc5e93df0e6da8624c0a9df61b6a965fa93efc521f7117d33336775d85824
MD5 ccc435f5a583e649c434000433ea628e
SHA1 93ad8eeca3a231c4499d5436e969b5a0320e1c53
SHA512 159a3b3abd1fa68f533bd0d80690ed4c185042a955478ed1d794cb554023d9c9aac9c6f1c86f4431b82e1920a0d2ef6d8b940aa39110521829efee883e18d12b
SSDEEP 384:niiFiZcI938ND8TUNTUlIRiySa5jGfbwoFMtT/HuOObjI9G6w7NWHy/7Ig/:pFQ93kwgnNoFMZfu29Ml
TLSH
T12FF2C3F198D78972D8AE4B97A37D2E029AFCC163B5884984F7C45D0CCC861BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0a367c4f2a5d75e4fc3c3ac14fe0df0fcdd5db20a86f67fd3eef8293b3e8f1b4
MD5 a40b0bad82ecf2a447c065f6b5d86969
SHA1 24d06b6b1dafb67c2eda13453975b155b43dc549
SHA512 efa7e589342c2778a64cbe465031195973bf6392f1bd89ab8b0ee20d5fb879097124365e80a538d43300a590aecf364decbdcb92eaa29659fe5986a50142a9af
SSDEEP 384:n5fiFiZcIm38ND8TUNTUlIRiyM05jGfbwoFMtT/RuOObjI9G6w7NWHy/7Ig/:oFQm3kwgLNoFMZpu29Ml
TLSH
T140D25B72EC94CDB7EDEB4EA9F38A7643DEE041A3C58C8AC8D5D99E1C008759D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 54005b6dcb78d74f00c01001c0af3b6d3bb6c42aa46c55f361b4358a75c44f7b
MD5 b5813d127a6cf6fb9d277e17eece100e
SHA1 e55f68dfc47fe2c202aaf36bb90f77fea822598c
SHA512 6324bff47de9d06222f569e8c9db4e1800602cb63512b56757f9275c9b304523b2fd4212735211af07feabbb2159e522b469f5be32944510e132347e5b54d31c
SSDEEP 384:neiFiZcIm38ND8TUNTUlIRiyS05jGfbwoFMtT/RuOObjI9G6w7NWHy/7Ig/:1FQm3kwgNNoFMZpu29Ml
TLSH
T1BFD25B72EC94CDB7EDEB4EA9F38A7643DEE041A3C58C8AC8D5D99E1C008719D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.20.1\typosquatting_list.pb
Size 738KB
SHA256 c45ca589e12ede5ad2d94c66891f20ba805f5109edc1a6d1cd7734851e470899
MD5 929d5213a119594f4c334ae8f98e2918
SHA1 2275bf3fd051b6ef08eaa757a52f9a08e1918731
SHA512 8a4ebec0d5acdff8150110475910fbe8689544fd005f2a248e27bcae47e5bc37d5f7c61daabf0d238d3d87cf2d5fdebaa1bd75d7cf36b86471989ce4e2173dde
SSDEEP 6144:RLfPL6KxmAjX5rzpVj8CZANIgafGaFU9OOemJFZKvmwko898O02:BfPL6KxmQX5rzPZGI3eaFiUFko898O02
TLSH
T10AF4C6B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 23eed74f234ec26560b69a26a95bdf3bcbe7653adc71a60baeaa6d0fb6540f79
MD5 880fbff6c9ce4074cc24967f81080767
SHA1 3f1bacdaadb11e875d49aca6cbe685e0ee2bd88f
SHA512 8762f0a2dd0a7d32498c87e9277ad8d5a93c82f4af2b16c3c75bc28f5393b69869dbf933f6068f3e8879b3f8aa46c950378938d9b4637edb6e75ad10eea9983e
TLSH
T19D4120E05C381AC1D5BD0E6EB48B38FC81EC9725F5A034396848EA94497A61D658087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f1bce00b44c1e995735d9c8a7ef283bce115b02f81bd6204536170847d0a6b8c
MD5 e3095d6754f5104133a9ff85f513641e
SHA1 008b0020ceab1a4c713dd6d4d95db25d85ce338c
SHA512 639eadcae9e1eec05d088bb283a10ee29dab0c004f13297e766fd4525b0f7fcf6e66765ef28a93a0311c800cf69c7437de5ff0bba7b009cc9453bf02cdde3218
TLSH
T196413FE05C381AC2D1BD0E6FB48B38FC81EC9725F4A034796848EA980A7A25D648487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 48b6ddbc017c3c2fd11974491ad67ae46a9890237f760680e92fce7c043f4882
MD5 bd953c2c13eb2da3cb875c4093dc976a
SHA1 011b1f329d28bf74da3d74ddf124237ed5ae418f
SHA512 a224d61120c79c06ae16700afb385c5883cebc90cbbc2da2f539be13c029e442b2981fcb18385d68243891c892e1a883d1d11bcc87e12547d428b6b05c401723
TLSH
T1834121D14C3C2AC1D4BD0E7FB48738FC85E89715F490343A6858EA98597A71D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ce915a581a31968ec31333f5d5a4cfb7960f2c830f542dfa0d12e064e540b9c6
MD5 d72cb6a1a2524fc55f2249b16c1e89f6
SHA1 b9fa8426f92fc4ab982b64eee6ae10f1a7b6aa83
SHA512 1d7465937371b0ca0ee670ee7aafc0421ef8ee6cb1755575ff3a816a12381ecdcece7b5c63a97d9b0d3d8a63b6b14235b4911b7833e17c77cfff57838306d677
TLSH
T1564120D04C382AC2D4BD0A6EB48B38FC81EC9725F49034396858EAD8497A61D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fa2d87930f591fad8414480bb64918c2bc59abf2b6b1d056e790eb95f50782c2
MD5 ab670fd2cebdff58f99f478f9ed732f1
SHA1 a324a6fa220d006339d78c4fb3e822973ae4b26f
SHA512 154dc249783ff75c788404b8220f1b50f70995e77c665dd7bed353317b32db475bba7a9b960b14426bcaca19a6214e3009c8499eb78b6e2701ed0abc00d91b3b
TLSH
T1D54143D14C3C26C1D4BD0E7FB48B38FC85EC8729F490343A6858EE98557A61D258087F
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 7fbd4c8b35f476f9c2b0a62e1cba03c91330423a3a48078e0e65d3f22e4813ac
MD5 d280577ca5656c8c38f07d6f2263e6fd
SHA1 b7c60ba9f744257336cf2b5e29f17a8a870a55bc
SHA512 8b751532f1b479eefe50b1ad5412683a50b18bca4f449058efc48c50655c3c860e4b06897504e99db9ddb7894c32e24226c32d1a11ab08f730744f9577a1513f
SSDEEP 1536:LflJd+h4iUxUYyYkzvd5fKQOUpeE711kDa5ljNC+jH0IMjMFYoe9V3CNBQkj2QOP:LflJd+qiUUYyYkzvd5fKQOUpeE711kDh
TLSH
T162538392E9204E75E2E65F3EF15622627D30394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download