salatstealer | hxxps://seliware[.]site

Resubmissions

13/09/2026, 07:24

260913-h8qnxsgf243

12/09/2026, 17:14

260912-vr5sqsfa5310

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://seliware.site
Sample260912-vr5sqsfa53

Score

10^/10

credential_access defense_evasion discovery execution salatstealer spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 27 IoCs

resource	yara_rule
behavioral1/memory/4628-370-0x0000000000DB0000-0x0000000001A05000-memory.dmp	family_salatstealer
behavioral1/memory/4628-372-0x0000000000DB0000-0x0000000001A05000-memory.dmp	family_salatstealer
behavioral1/memory/4628-383-0x0000000000DB0000-0x0000000001A05000-memory.dmp	family_salatstealer
behavioral1/memory/6064-387-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-390-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/3948-401-0x0000000000B30000-0x0000000001785000-memory.dmp	family_salatstealer
behavioral1/memory/2312-434-0x0000000000CE0000-0x0000000001935000-memory.dmp	family_salatstealer
behavioral1/memory/6064-461-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-473-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-481-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-482-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-483-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-494-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-495-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-496-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-498-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-499-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-500-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-501-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-502-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-503-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-504-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/6064-505-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer
behavioral1/memory/2232-509-0x00000000005C0000-0x0000000001215000-memory.dmp	family_salatstealer
behavioral1/memory/3348-517-0x00000000005F0000-0x0000000001245000-memory.dmp	family_salatstealer
behavioral1/memory/4304-518-0x0000000000FD0000-0x0000000001C25000-memory.dmp	family_salatstealer
behavioral1/memory/5220-519-0x0000000000F60000-0x0000000001BB5000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
70	1780	powershell.exe
71	1780	powershell.exe
71	1780	powershell.exe
77	1780	powershell.exe
78	1780	powershell.exe
79	1780	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5472	powershell.exe
4944	powershell.exe
5820	powershell.exe
4124	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	4880	msedge.exe

Executes dropped EXE 10 IoCs

pid	Process
1392	Seliware-setup.exe
1268	ewpgc0b.exe
4628	ezpxp4m.exe
6064	spoolsv.exe
3948	spoolsv.exe
2312	spoolsv.exe
2232	RuntimeBroker.exe
3348	sppsvc.exe
4304	smss.exe
5220	spoolsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001000000002af15-352.dat	upx
behavioral1/memory/4628-359-0x0000000000DB0000-0x0000000001A05000-memory.dmp	upx
behavioral1/memory/4628-370-0x0000000000DB0000-0x0000000001A05000-memory.dmp	upx
behavioral1/memory/4628-372-0x0000000000DB0000-0x0000000001A05000-memory.dmp	upx
behavioral1/memory/4628-383-0x0000000000DB0000-0x0000000001A05000-memory.dmp	upx
behavioral1/memory/6064-385-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-387-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-390-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/3948-397-0x0000000000B30000-0x0000000001785000-memory.dmp	upx
behavioral1/memory/3948-401-0x0000000000B30000-0x0000000001785000-memory.dmp	upx
behavioral1/memory/2312-433-0x0000000000CE0000-0x0000000001935000-memory.dmp	upx
behavioral1/memory/2312-434-0x0000000000CE0000-0x0000000001935000-memory.dmp	upx
behavioral1/memory/6064-461-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-473-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-481-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-482-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-483-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-494-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-495-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-496-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-498-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-499-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-500-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-501-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-502-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-503-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-504-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-505-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/2232-507-0x00000000005C0000-0x0000000001215000-memory.dmp	upx
behavioral1/memory/2232-509-0x00000000005C0000-0x0000000001215000-memory.dmp	upx
behavioral1/memory/3348-511-0x00000000005F0000-0x0000000001245000-memory.dmp	upx
behavioral1/memory/4304-513-0x0000000000FD0000-0x0000000001C25000-memory.dmp	upx
behavioral1/memory/5220-516-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/3348-517-0x00000000005F0000-0x0000000001245000-memory.dmp	upx
behavioral1/memory/4304-518-0x0000000000FD0000-0x0000000001C25000-memory.dmp	upx
behavioral1/memory/5220-519-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx
behavioral1/memory/6064-520-0x0000000000F60000-0x0000000001BB5000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\sppsvc.exe	ezpxp4m.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\8039e952-b19c-8ce2-3f24-fe5166f452b1	ezpxp4m.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RuntimeBroker.exe	ezpxp4m.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\8039e952-b19c-8ce2-3f24-fe5166f452b1	ezpxp4m.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Seliware-setup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sppsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezpxp4m.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe
240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{39AC38CA-5728-496F-9161-F48E2EE81697}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Seliware-setup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
5820	powershell.exe
5820	powershell.exe
5820	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
4628	ezpxp4m.exe
4628	ezpxp4m.exe
4628	ezpxp4m.exe
4628	ezpxp4m.exe
4944	msedge.exe
4944	msedge.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe
6064	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6064	spoolsv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	5820	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 5504	1128	msedge.exe	80
PID 1128 wrote to memory of 4880	1128	msedge.exe	81
PID 1128 wrote to memory of 5052	1128	msedge.exe	83
PID 1128 wrote to memory of 5052	1128	msedge.exe	83
PID 1128 wrote to memory of 2952	1128	msedge.exe	82
PID 1128 wrote to memory of 2952	1128	msedge.exe	82
PID 1128 wrote to memory of 2952	1128	msedge.exe	82
PID 1128 wrote to memory of 3272	1128	msedge.exe	86
PID 1128 wrote to memory of 3272	1128	msedge.exe	86
PID 1128 wrote to memory of 3272	1128	msedge.exe	86
PID 1128 wrote to memory of 3196	1128	msedge.exe	85
PID 1128 wrote to memory of 3196	1128	msedge.exe	85
PID 1128 wrote to memory of 3196	1128	msedge.exe	85
PID 1128 wrote to memory of 3984	1128	msedge.exe	88
PID 1128 wrote to memory of 1396	1128	msedge.exe	89
PID 1128 wrote to memory of 3984	1128	msedge.exe	88
PID 1128 wrote to memory of 1396	1128	msedge.exe	89
PID 1128 wrote to memory of 5640	1128	msedge.exe	91
PID 1128 wrote to memory of 1228	1128	msedge.exe	92
PID 1228 wrote to memory of 1212	1228	msedge.exe	93
PID 1128 wrote to memory of 5332	1128	msedge.exe	96
PID 1128 wrote to memory of 5156	1128	msedge.exe	97
PID 1128 wrote to memory of 5332	1128	msedge.exe	96
PID 1128 wrote to memory of 5156	1128	msedge.exe	97
PID 1128 wrote to memory of 5156	1128	msedge.exe	97
PID 1128 wrote to memory of 652	1128	msedge.exe	98
PID 1128 wrote to memory of 1392	1128	msedge.exe	99
PID 1392 wrote to memory of 5472	1392	Seliware-setup.exe	100
PID 1392 wrote to memory of 4944	1392	Seliware-setup.exe	102
PID 1392 wrote to memory of 1268	1392	Seliware-setup.exe	104
PID 1128 wrote to memory of 1408	1128	msedge.exe	105
PID 1128 wrote to memory of 5560	1128	msedge.exe	106
PID 1128 wrote to memory of 1912	1128	msedge.exe	107
PID 1128 wrote to memory of 936	1128	msedge.exe	108
PID 1128 wrote to memory of 936	1128	msedge.exe	108
PID 1392 wrote to memory of 5820	1392	Seliware-setup.exe	110
PID 1392 wrote to memory of 4124	1392	Seliware-setup.exe	112
PID 1392 wrote to memory of 4628	1392	Seliware-setup.exe	114
PID 4628 wrote to memory of 6064	4628	ezpxp4m.exe	116
PID 1128 wrote to memory of 4944	1128	msedge.exe	117
PID 6064 wrote to memory of 1780	6064	spoolsv.exe	118
PID 6064 wrote to memory of 3948	6064	spoolsv.exe	120
PID 6064 wrote to memory of 2312	6064	spoolsv.exe	122
PID 1780 wrote to memory of 5992	1780	powershell.exe	125
PID 1128 wrote to memory of 240	1128	msedge.exe	126
PID 1128 wrote to memory of 4396	1128	msedge.exe	127
PID 1128 wrote to memory of 4396	1128	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://seliware.site
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd3b77c188,0x7ffd3b77c194,0x7ffd3b77c1a0
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1904,i,9825560373117107851,5861794951033725731,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,841965050274990121,15909882911244209622,262144 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2368,i,15852554640035131820,18286098141680313791,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,14770789704101745959,5772669121347231014,2097152 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,16294543567655255175,9161010449602358077,2097152 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4900,i,5642940992347248676,6479256657342597081,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4908,i,4757186838071461751,10097054131472753471,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5812,i,16417370906759849875,4396314101107115637,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5812,i,16417370906759849875,4396314101107115637,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5992,i,6757358570690825971,16313676244343510715,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6488,i,13966542817334431845,229601777979063304,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6492,i,11140263792681248037,11847158469804539703,2097152 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6888,i,1547215086853019564,9797434823755738016,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:652
- C:\Users\Admin\Downloads\Seliware-setup.exe
  "C:\Users\Admin\Downloads\Seliware-setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    -NoP -NonI -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pagez4j0'}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    -NoP -NonI -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Plgoz7p2'}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Plgoz7p2\ewpgc0b.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Plgoz7p2\ewpgc0b.exe"
    3⤵
    - Executes dropped EXE
    PID:1268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    -NoP -NonI -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pogqz7e7'}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    -NoP -NonI -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pogkz4h6'}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pogkz4h6\ezpxp4m.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pogkz4h6\ezpxp4m.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exe
      C:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        UAC bypass
        Badlisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3948
    - - C:\Program Files\Google\Chrome\Application\spoolsv.exe
        
        "C:\Program Files\Google\Chrome\Application\spoolsv.exe" -
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5972,i,15771156587897848164,7708652021559810020,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5904,i,4354109034786977456,5261291940876474827,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5956,i,7923815874147344130,2882037101963402832,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6572,i,4452960081707786556,12572936390713713601,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:14
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,8993052717592645430,1779133619250944743,262144 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5624,i,4922089639789465286,9333128967390243849,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5620,i,6822260086673810674,2641355200371823915,524288 --field-trial-handle=2112,i,7380862261168953529,14083130655320770569,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:648

C:\Program Files (x86)\Windows Defender\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Defender\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232

C:\Program Files (x86)\Microsoft.NET\sppsvc.exe
"C:\Program Files (x86)\Microsoft.NET\sppsvc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

C:\Users\Admin\AppData\Local\Microsoft\smss.exe
C:\Users\Admin\AppData\Local\Microsoft\smss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304

C:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exe
C:\Users\Admin\AppData\Local\PeerDistRepub\spoolsv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ce3f6ccf5981fa38ef23ed588af8291f34cc73d13b71cff3a09b51187a769c11
MD5 f193d55e2d07c05617847d7fd7197b3e
SHA1 0cdfb9ae1de5353d3450c1ac3cba43e852b5e2c7
SHA512 dfc1003676c8ce5b4408efbd2f634de606cf3b7b7a2dec2b6f92847bf3d9f2dfd768674609621e64050799be75669f7df503225b804cd2897da13b5b1839b73a
TLSH
T17FE02BB9CC25BC3B08FE071D20500B4AEA5003572A50984F3A3C820C8FB163A8585C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4c50461d8ad373603e00fd14ad64faaf977a0f4751c53366c5d9c26717f3ddf6
MD5 107e97c46aa0f0f0dddf844474c8602c
SHA1 e9b72fd16edb3c34c88aec890aa6f3329f28ab82
SHA512 6a1f4a9b8b02b002d79ce0b9bd8bb701902a2becbd3413a7b085b4cb2d80b4ce6cc434401f3d11bac6804ac5d5a7ad8baeb45ea525ffbe9186fe577644144acd
SSDEEP 192:jhXtVbbA85iDIJX6sn7dk4MXpdamHcwgEGbs6ludD0t3U9xFPAHSM90rj:jptVbU8UuFI6q1X10KLM
TLSH
T14C1338FE32266E95C3D7613E828F9B362379E531F2D0DA070B39F1410B827669E5E125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 eb2a9c5debf2c28ed416ccfde0a8dc3faebdf58a2eee1f4af914dbca935aeb49
MD5 8c3de7915b82a9b9e208136dddb78a06
SHA1 0ea2ecd258233b69e407615886b0537759ccf89e
SHA512 3fbe35a6124ef4c632793cc5ec70f74dec63afacc165dfae2e9e245d77a6ecf77ef775d1644866fbc3a290cd2271699d491558d44f98770ff923605741368a9c
SSDEEP 1536:tasL/a+L/50D78sv/UL/pL/zglW9YL/6ECAuS37g8KQZSxJ:tZL/VL/2UL/pL/zt9YL/xKhx
TLSH
T1FB4471F71951A05BCBA842F5D2033E3ED177016E3DE1F8EAE1788C952825B31B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 f6271d6fae2055ada578d4048c12ae90f190e6c5b9b6c67b5241bf48326844a8
MD5 a17359b090705e9eebd2c7ba1b285bc0
SHA1 578fe54be1da2563a14575cc16426c8ca9a1e33e
SHA512 f98c4847c3f05f757be5ec5f11705a98978f1bf14b00822d50442d3742d75dd04363af59933fb71385083de1835f7229bb501672a5e2ce2e431c114a57635342
SSDEEP 3072:kW56iH3DQxHv/sYfouoyQMuPlhtDJG3CTduy3tkD4IWtbfn9rZPMXs:KfHvUm5QMuPlfJGSTdR3tkD49tbvVZ
TLSH
T1412529EEC7682C82CF6B8770B4E0D9077E702182B65DC0D39944C5D897D6B857AE92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d212ac0f9b7be0892b080ee8ae2cd2a419efc8f0fdcc59189cc930d9010f3e1f
MD5 b795be846e89f276e25c96f4609a1084
SHA1 fdd943749e66596dcedb1fdb862ce6e0291dc22a
SHA512 4d5c7b87b5b70cf2eeb4f2e22bbfb3b72d8c4b857ed5e07a6dbff6e714789cadd93197fffed34ce6ab32154c3af4edb94fbbf8202f6485a4d705245e9aa1a723
SSDEEP 24576:GsWNAw5Dt2TjWUKsAIXY9m6qnmG132+Z9h4TJ:/WCqJlUfAJ9QmA3zh4TJ
TLSH
T17C165BEDCA6858C3CD63AA30B4F0E9477C7413C3F955C1D68C98C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b288ca687b8e06c430d3d4efc609da06c3d185c637320c83d561873bf036e579
MD5 5e44114d2ebca75ae5580e29d98ed981
SHA1 701b1e193a818eab050077f031326a9be59c8781
SHA512 efe3b30ebfb8a34b958ee19f5bf0493682c35cbc6e6c0a4570646e26ee5b53d4cdc2914128b2d6ddeb0eaeaccf9054c132e0acc07ba305f7f0e485954b82fce5
TLSH
T1F161C782595081D1EB64C0B4FDE415CB757C65B07283AFD34694FB7EBB8ABC32140186
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cbd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cbd7.TMP
Size 3KB
SHA256 28ab72bc0f869c551ca2f1cd2e3d4f0c8e9b3e1ddb7b88fccfe957cfabca7f72
MD5 fa33e6dbc72fff8584b926c4fe13a300
SHA1 34983c95a98d97033668b994e85d28a00c72164d
SHA512 94c0314ab15c1d675c312f25ab70fa7613c87cc4475b0f1564c7908c517037621449c6e7d4d5f6247858b0ded855ebc9288ae9fcebcbc337e032f2b6c007c24d
TLSH
T1A561D782594081D1EB64C0B4FDE416CB357CA5B07283AFD38685FB7EFB8ABC32240186
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 ee7d8b2812f35392d75db544e6800973b76d2c265d341908509944d28d968b89
MD5 50f79370684d3a1049754eef82f71ebb
SHA1 381f4fd5e3b59c896edcdd6603402adf3b370b7f
SHA512 38af62bff40493176976584d6a3c31a337ddc5ddc9cdc80cd8663be06e9d00e98673ac683fd4d6e9e44ccdbd0b9de7eb069b3a96c4b4c4d24ea88d5b563de6a8
SSDEEP 48:T2SLopFMatSaw/auUOt8B/wBlzyhNacDh5yoHUwD6Yj4VowH:iSeMatUaAKelzyhIcDhNUFroA
TLSH
T14692940E2F607022D1B05BB7DDD285631E7C214ED7633A5ADE5860F39D8346AB822679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2868a176f2be0a7e9a8b03ff95be67fd9e7dfb386688b058178cd4e03b1fb7aa
MD5 556ba7e6ad85595dff355cdd0f9de853
SHA1 43cbe98d70658b379e874a39578e00be23f4642a
SHA512 fb65840e02ac10703a3bce5cb1905d8a674a79d02c1304e26bbf1c7aae59f073cd5489e6c6ef6b276333d69ff7b71aa9890da9c03121b877113b66a9bbbe914a
TLSH
T18D51FFF3C3E4866EC95156F0A614BE1BDE1D0914431C3D5AC8E4EF5B93E2472E201A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 5032db5be307cb502c97b83690eeef11255e433bf4fa50da2f5d920799ddfe74
MD5 b5f9a5b5ed2b50d5a6b7fe464dd21adb
SHA1 1a9b4f228e59e48bfbbf98bff53cba2b725f8473
SHA512 7290aa922d40e98a0e27129df9718925b6f80dc812cb32063cb246d6b741e29851589f931f4145c999caf4d8e4a321accdb0fa82742486c72b458314964f3146
SSDEEP 96:OIEumQv8m1ccnvS6VAx+jokWfDkBnFalA4g:OIEumQv8m1ccnvS6mkOkx
TLSH
T181F200FB17376245D98444F0A0049F8EAF1A414B47B2B6EC76D44BE3F3A20E2B179796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6b473e6623e850b4918b21642e0b1df169b8c7d38e8e479f4936ddb96d014a8d
MD5 7bf8dac33131f17cf2d7ccc059be5d42
SHA1 ee55033761f93effdb4ecbce8632ed26e251ea7b
SHA512 e080ce1a77113a19297285ef62a3860fdb617e09c6d620c8e138a6e9fe48f93ce0f95075d7eaa3eb713f0b9c243c1f21defc0f967757c3a6cf3eb3ebab3223ed
SSDEEP 192:sxZlRxoW/f5sNzI1ZqMqTzodp1N/W6+WNzy5/Y0gxDzuRzLIgSOYJ:sxZlAW/f5sa7qYT/bE/5gv4nSO8
TLSH
T1D642B6556E68A93F4CC7E619BB55BF53E3F9103291911E48AAFCCA2C10E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 02531b027314b6cf3033386c5f36879491810435e684cf56943c5140c8f4e752
MD5 e5c0710ce461ae8f574ca80bdd9a5db1
SHA1 5558fcb2dd9f1fa403de2b715d651dc32086cc65
SHA512 e7d6d567d815f2659099e2ca74dc4df667d0fb5dd9ada019185bba3afb2b3644f99fe52c23c5ed53fbce25302a65473a5da92719f5943a3ca9cd6a4870e7f1fe
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAg6:ohdNdBzXXFPXgRbKvtp0JlzniD/c
TLSH
T14AB2571131BA12593CBE390891B59B2F52813573711CEA2B7FFD10A68E6BE481DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 af6c93d9afd4cf0e048d2ca06c5e4b6b65867753245e4bd98d5f41c555339766
MD5 73785324958fc4ec174d74a6d143a4b9
SHA1 f7ee8512763b74e36540357c189fb4e864001096
SHA512 d43af0ecede6779cbdaed9c8643fd7486d2a33a6075f020c9ddfd61ddeb169ec053eff68da1c04b7641be4aca4fbd97aff8ccd73b030e96d125189f4531f3e98
SSDEEP 192:FvoWhYXfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a4AfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T14024630A7B747001EDE7D9725CB080771A3CB16DCF22A6915DB264698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0d0c69a-e977-4712-ada3-0be398f41605.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0d0c69a-e977-4712-ada3-0be398f41605.tmp
Size 28KB
SHA256 77de40f0455c2a9d155749086e9d62d1652ae02360f0ecfd95ac161cabb4aab0
MD5 fa256e27e54f69d1568933bcf4804154
SHA1 d0004dc9f8d39fdac4fc60806c8b8eb478957be7
SHA512 78e48c64d36fc9165faad7be8202679ee5daf7815617abea3e0a397e3a27d53cb064cfe57f2e70ae86233bcd74630e53de9f8345f130be76d4296c4910027ea6
SSDEEP 768:AvmgC8Ba29tWRmpbQHL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroXm:AvmgC8Ba29tWRmpbQHLu1jaKHgLpj+s4
TLSH
T105D2093B240CCB7E4FC04E9DDD16AF966EA802D7AA589D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 bee83400a71f4a39368d797d882a4068a3488db58b340dafa844a8a1f2eac938
MD5 05e2706aa0bc57facee950bb87766be2
SHA1 3a727a31dd1f9128589f37442ec540a6ad13f098
SHA512 9c4f51a968908c0ba1ca76a1ca6dd45955112301650048c7181db69be8d0a25c834a52b307f6c45fc262dd1e952c8d0b1afe053c58ca055053978d10ceeb92ed
SSDEEP 384:n5iFiZcIj38NLs8TUNTUlIR2CC7Vsl+OKuxzyfoBjohWF1iB/u7O6R2FeotgL/7b:QFQj3QswgnCal+O9dBchIihu7TRHP
TLSH
T168E2B2F1A8E78977E8AE4B97677D2D0299FCC153B5884984B7C81D1CCC960BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aacec7368818e12981fabeeadf323dfff129900f45047e81a9c37bd3a5eef564
MD5 4c2d784e161b83bb5ed5d7ebf42a5de8
SHA1 8c4b32679879aa498eed84bc7990e5262eaae0df
SHA512 4d75d20a80fe9c1cb6abef709160589fbbe8c361da2a26bbdac2d302de67de1b8c4ef4cb86b5773e9ce4ebfb355ad9fd869e339ceb43320bf869e34d76da7c8a
SSDEEP 384:naiFiZcIg38NP8TUNTUlIR1CC7rsDKuxzyfoBjohWF1iyvusa+VYtGgL/7IzCoT:RFQg3wwgaC0D9dBchIiwuhgQE
TLSH
T15CC24A32EC94CDBBECEA8FDAA74A7603DEF04153958C9AD8D5D85D1D009719E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b7599fd4f8c3aa7b1e3e0f8b59dc47226bad8253c8e55ad97e219c193ed26c54
MD5 40c2a1385624cd01f6b3e98e87738497
SHA1 292915ff7bbd2ffe2d19385b77bc763c72f3b1a0
SHA512 a82576b3618210215929b3976015e3ace3f95cba1260b34fb702aea60ac720e112b37499ac3e4e3457f5ca120fe09edbfa35c5b63482f4fa70c179a46428d2b3
SSDEEP 384:n5iFiZcIC38NP8TUNTUlIR2CC7qsl+OKuxzyfoBjohWF1iB/u7O6R2FeotgL/7II:QFQC3wwgnCJl+O9dBchIihu7TRHP
TLSH
T185E2B2F1A8E78977E8AE4B97677D2D0299FCC153B5884984B7C81D1CCC960BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 945c14b4ceb40b08776950a702fb509263c370ac327508c043f5ce1ee6ca295c
MD5 94581a4893edb42ba31850149492c89d
SHA1 477b0dfa4a9939344a6e8776d3e9aa0286a96ee7
SHA512 1652123af7523a8167f3d22ac798af7c680edd1ee2fad77985f97cf2ae99f86e1dc33442618f7ac8add8740f7405450de6fa2c67040ca9b009eab3daa8a36767
SSDEEP 384:nniFiZcI638NQ8TUNTUlIxhCC7JzpcxzyfoBjohWF11Q8sa+VYtGgL/7IztoT:iFQ63TwgaChpWdBchIu8hg3E
TLSH
T1A2C24B35EC94C9BBECEB8FDAA74A7A03DEF00163949C9AD8D9D45D1D009719E1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewpgc0b.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Plgoz7p2\ewpgc0b.exe
Size 402KB
SHA256 3e810bdff410dfabce8769d71b6358f77a9468b71bcdc5869842fe405f802d99
MD5 a0ac62eed839876992c68285b80e07ee
SHA1 ad398535a6567eb9718f6ac26225d5c394e9587f
SHA512 6604a06efae2fcb37dc99335c4004a7f29a0d56ae19b1c2f85aa04ed1f758debeba12372002966555243b01c7637af0b87f80820833c7b6e1a74649bb39dde02
SSDEEP 6144:RnWzNxY+fSm6/m2uaarGk5mbrOwjz+xZRtiKzvzaOxL:QxY+6m6u2uaarGk5mbyIO
TLSH
T1E494B1E666554C9DF2168C748D77B64087A1ACB10B6297CB134036BACEB36C5FE3B603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezpxp4m.pak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Pogkz4h6\ezpxp4m.pak
Size 3.4MB
SHA256 7e38afec47de25b35c525bf04725059a2cd4477200bbe3b57e50b7c0f9a649e4
MD5 aa3b111348d5a7bbad2979836bb45658
SHA1 5e7143496ea5086abd593e2372c838791646df47
SHA512 4495cf7d7243134bbdc2cabc2293a060915bcde9fb1b629372e628d9d39f0252fb85ee2407e3c5b24659166870a386e9ae383cc4dcd6696dda7f8af3d01fa632
SSDEEP 98304:hd03wwktgPTZ4Emouk8YZDq88gxVXqY0u:D03wwigPT2EZukZZDqRgWY0u
TLSH
T11FF5337D82F6EDA6F03DADB1889D5D7FC334249028236AAEB2D51C9461735C624CA0DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cf32bcb511febdf28777d91f56fa6809371d48db9b80490007984fadf4bd7c28
MD5 2bc2d3124edc0dff8ee2db4bdc6ad540
SHA1 a17b5db4f142d79f6700141ff4a37099f08807a7
SHA512 2fb5526e6e27c54e76e9617a189a31bddfd58ce4f92106889c23f25dd6afa100b1e591081db4f1ba778f87bb970c2de1fa08a18bad560061c97d18b3edd55244
TLSH
T11521A833B7ACC235C8D911BA2088AD11B2B5C3C7449ECECB7B84C518A57F9DADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e03b8b4caec21d8d0e83b9917772c57d9b9a8e146a3c2ecf7dbe6e11bffcc1e4
MD5 6d8155ed2c451e955e45eb3f46e8ee19
SHA1 3d5caa27a57c7a587a36020a14fc628a11f174b1
SHA512 6236b7a712d1d0adf6613c5719ebf20ba9256dae2eea9c82bbed5073b66bee84aa9a20905233da860c27cc9b8310143429b0e5e69b2b6a300cddc6fe8a8eca11
TLSH
T1BB218933B7ACC234C8D9117A1089AD01B2B5C3C7049E8E9B7B84C508A57F59ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a363aff958ee71bdeba0165dbf15ebe19c60431bc6f6c368a1fbf1af22c3587c
MD5 9bca6f1a0e3a844c62c741e8436ca76e
SHA1 bc88c327182489064856036528a9d58f43c4a0e9
SHA512 4e542e9483614dbe394808f0ff5c1f942879f2bad1e5ebb1b10a48078f86c80d13a0c3f2350837519cb63b6db53073ec83868d10fef60d515a368dbc636ea93b
TLSH
T1B521A833B7ACC234C8D911BA2089AD01B2B5C3C7049ECECB7B84C508A57F99ADF645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lmsvi5ea.lan.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lmsvi5ea.lan.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Seliware-setup.exe

Path C:\Users\Admin\Downloads\Seliware-setup.exe
Size 14.0MB
SHA256 6e09be1f96b03ca0f463c452d27c15ead711fff9fc10f384f418b823f9395b1b
MD5 a2e71bb6e9c61a9583a2089a42f8732d
SHA1 c8138e21e6b965fcec7a9b5dc1d5f40f5cfa654b
SHA512 bb6384cb7613a2c0df80c8cc9fef3334dfc747ea3c73793cdf03804600be6d7bcaf5752ef0562bc45d00eb6dd1e7210a29d5dbc0e178910de9a149af3aa1617f
SSDEEP 98304:ZH5lBtQSzla+P3VABg7InkY3ZCH8k8wo4duh+8Y+3:ZHBGEbP36BWQbCH/do53
TLSH
T149E6CD3353656B0887D8D2C51F729E64B5F0ACF018AA995E149CF0787A2E772B1B13CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Seliware-setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Seliware-setup.exe:Zone.Identifier
Size 122B
SHA256 b82da678ff57e73c3812b04f8f447ac07fbb7701058869dd00be99b6b5dc723e
MD5 58bdfa2604b1b19ebb779510e1d8179e
SHA1 090b7c2e18c473722b91d0e2021b8dd431b9ba93
SHA512 f026656acdccf4fd034d7e7abfecb59b1b548c8a5f1363fcc302117ca6e342b51cdb2d0ba9ee9b543304e3588b43b3bdb4202af0e60a8a8836aea3a365fd83a5
TLSH
T158B09297A8418619021421C116AFA00CBA0B21CF8868C148D840C38FBA408B496B3A0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1392-474-0x00007FF79D190000-0x00007FF79D59B000-memory.dmp

Download

memory/1392-475-0x00007FF79D190000-0x00007FF79D59B000-memory.dmp

Download

memory/1392-270-0x00007FF79D190000-0x00007FF79D59B000-memory.dmp

Download

memory/1780-410-0x0000000005BB0000-0x0000000005F07000-memory.dmp

Download

memory/1780-448-0x0000000007700000-0x000000000770A000-memory.dmp

Download

memory/1780-460-0x0000000008910000-0x0000000008EB6000-memory.dmp

Download

memory/1780-459-0x00000000077E0000-0x0000000007802000-memory.dmp

Download

memory/1780-454-0x00000000077C0000-0x00000000077C8000-memory.dmp

Download

memory/1780-453-0x00000000077D0000-0x00000000077EA000-memory.dmp

Download

memory/1780-452-0x0000000007770000-0x0000000007785000-memory.dmp

Download

memory/1780-451-0x0000000007760000-0x000000000776E000-memory.dmp

Download

memory/1780-450-0x0000000007720000-0x0000000007731000-memory.dmp

Download

memory/1780-436-0x0000000070A70000-0x0000000070ABC000-memory.dmp

Download

memory/1780-449-0x0000000007850000-0x00000000078E6000-memory.dmp

Download

memory/1780-446-0x0000000007CE0000-0x000000000835A000-memory.dmp

Download

memory/1780-398-0x00000000028D0000-0x0000000002906000-memory.dmp

Download

memory/1780-399-0x0000000005570000-0x0000000005B9A000-memory.dmp

Download

memory/1780-400-0x0000000005230000-0x0000000005252000-memory.dmp

Download

memory/1780-403-0x0000000005440000-0x00000000054A6000-memory.dmp

Download

memory/1780-447-0x00000000076B0000-0x00000000076CA000-memory.dmp

Download

memory/1780-402-0x00000000053D0000-0x0000000005436000-memory.dmp

Download

memory/1780-437-0x0000000070C80000-0x0000000070FD7000-memory.dmp

Download

memory/1780-444-0x0000000007560000-0x000000000757E000-memory.dmp

Download

memory/1780-412-0x0000000006100000-0x000000000611E000-memory.dmp

Download

memory/1780-413-0x0000000006140000-0x000000000618C000-memory.dmp

Download

memory/1780-426-0x0000000006660000-0x00000000066A6000-memory.dmp

Download

memory/1780-445-0x0000000007580000-0x0000000007624000-memory.dmp

Download

memory/1780-435-0x0000000007520000-0x0000000007554000-memory.dmp

Download

memory/2232-509-0x00000000005C0000-0x0000000001215000-memory.dmp

Download

memory/2232-507-0x00000000005C0000-0x0000000001215000-memory.dmp

Download

memory/2312-433-0x0000000000CE0000-0x0000000001935000-memory.dmp

Download

memory/2312-434-0x0000000000CE0000-0x0000000001935000-memory.dmp

Download

memory/3348-517-0x00000000005F0000-0x0000000001245000-memory.dmp

Download

memory/3348-511-0x00000000005F0000-0x0000000001245000-memory.dmp

Download

memory/3948-401-0x0000000000B30000-0x0000000001785000-memory.dmp

Download

memory/3948-397-0x0000000000B30000-0x0000000001785000-memory.dmp

Download

memory/4124-346-0x0000011BF55F0000-0x0000011BF56A3000-memory.dmp

Download

memory/4304-513-0x0000000000FD0000-0x0000000001C25000-memory.dmp

Download

memory/4304-518-0x0000000000FD0000-0x0000000001C25000-memory.dmp

Download

memory/4628-383-0x0000000000DB0000-0x0000000001A05000-memory.dmp

Download

memory/4628-372-0x0000000000DB0000-0x0000000001A05000-memory.dmp

Download

memory/4628-370-0x0000000000DB0000-0x0000000001A05000-memory.dmp

Download

memory/4628-359-0x0000000000DB0000-0x0000000001A05000-memory.dmp

Download

memory/5220-516-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/5220-519-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/5472-219-0x000001D4E1CC0000-0x000001D4E1CCA000-memory.dmp

Download

memory/5472-215-0x000001D4E1CD0000-0x000001D4E1CEA000-memory.dmp

Download

memory/5472-213-0x000001D4E1750000-0x000001D4E175A000-memory.dmp

Download

memory/5472-218-0x000001D4E1CB0000-0x000001D4E1CB6000-memory.dmp

Download

memory/5472-217-0x000001D4E1760000-0x000001D4E1768000-memory.dmp

Download

memory/5472-212-0x000001D4E1770000-0x000001D4E178C000-memory.dmp

Download

memory/5472-211-0x000001D4E1720000-0x000001D4E172A000-memory.dmp

Download

memory/5472-210-0x000001D4E19A0000-0x000001D4E1A53000-memory.dmp

Download

memory/5472-209-0x000001D4E1730000-0x000001D4E174C000-memory.dmp

Download

memory/5472-196-0x000001D4E1680000-0x000001D4E16A2000-memory.dmp

Download

memory/5640-214-0x0000019D04C30000-0x0000019D05C30000-memory.dmp

Download

memory/5820-331-0x00000204C76D0000-0x00000204C7783000-memory.dmp

Download

memory/6064-498-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-504-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-496-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-473-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-499-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-500-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-501-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-502-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-503-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-495-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-505-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-461-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-494-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-483-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-482-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-481-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-390-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-387-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-385-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download

memory/6064-520-0x0000000000F60000-0x0000000001BB5000-memory.dmp

Download