7004f99d7bc678bc496e7014f9b7af2a89bb789305668a070e0775247c4104b8

Analysis

max time kernel
102s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240426-uk
resource tags

arch:x64arch:x86image:win10v2004-20240426-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
12/05/2024, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
test.py
Size 338B
Sample240512-rt1d9ade74
SHA256 7004f99d7bc678bc496e7014f9b7af2a89bb789305668a070e0775247c4104b8
MD5 26db165909d68aab997c6b0f80a6683c
SHA1 de00228c4b0396c7086119b309259d201d878bca
SHA512 2b1c0c321585e42bcb54f80208310618dd105655029222fc8380f4dffcb79fd11bfece9a8016c3c9fe3e6e8d77ec236e524f7afe603b0aa36c2dce455ff42803
MD5 SHA1 SHA512

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
105	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018855536-2201274732-320770143-1000\{3E96E190-A4E3-45D6-B016-0DBBC28289B5}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1508	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
3716	msedge.exe
3716	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
1448	msedge.exe
1448	msedge.exe
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3744	OpenWith.exe
3744	OpenWith.exe
3744	OpenWith.exe
3744	OpenWith.exe
3744	OpenWith.exe
6120	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2356	3716	msedge.exe	96
PID 3716 wrote to memory of 2356	3716	msedge.exe	96
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 3800	3716	msedge.exe	97
PID 3716 wrote to memory of 2312	3716	msedge.exe	98
PID 3716 wrote to memory of 2312	3716	msedge.exe	98
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99
PID 3716 wrote to memory of 2672	3716	msedge.exe	99

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test.py
1⤵
- Modifies registry class
PID:2948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa61b46f8,0x7ffaa61b4708,0x7ffaa61b4718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=audio --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=collections --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4741686061328993325,13279145500960385851,131072 --lang=uk --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5080

C:\Users\Admin\Desktop\salinewin.exe
"C:\Users\Admin\Desktop\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:6120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:1508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x384
1⤵
PID:6012

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d9855 /state1:0x41c64e6d
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

6492c771-38a9-41b0-ac70-80c61b5affa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6492c771-38a9-41b0-ac70-80c61b5affa1.tmp
Size 1KB
SHA256 463d9d35405e8ed78fbefb71566e126803a7457d6daf2aac1ed54aa8ec12eb6f
MD5 3a23378d8f7cb20694de34b3892cf68d
SHA1 2968e0de7cce54061fe294513160062a107738cd
SHA512 2f253e2c0639fab306075769adadeb158848411ae630eb56ea789e8a9dd02520ca6efa44fd141e953f27573cce2e0cae5831f97001430de1aacfdd40ec9816ed
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 69KB
SHA256 0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486
MD5 aac57f6f587f163486628b8860aa3637
SHA1 b1b51e14672caae2361f0e2c54b72d1107cfce54
SHA512 0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a
SSDEEP 1536:O76uwIZe9NVY6Nj/5StV8Zd3CcQWfeVmNk9nfNJxJIsAuB+U2:O7Dw2eLF5StKZgc5feYNk9TrB+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 39KB
SHA256 5592dd532714a81e43ba56f98961f852f09ed2fc9eb8396f6593b6dfe50fe46e
MD5 3490805f00d3a3e0e91bd165c7bbb40e
SHA1 b8da3e4394bba3c0171cf8cf53d3667946356b9a
SHA512 3fcf83d58e9c65c8fc65e73a60eb32aca371d41c52674402980114927503670f967b06342c704e1d399338b8c01faa250eebb599bd274f7849bc25f60bdb367e
SSDEEP 768:eBsC+PYqEbNOP9gnC3lJzaFO661CgtDWyUzCtaW0/CFsMT4UpffJAarncW:TlbEbwan6lhR6VmtUSaQFsMTvhOmncW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
SSDEEP 384:OdEDMO3OT070pXDaeGj7ZDghRm9nyj4uIttWEDh2dvFBbUDfgAU:OiDM8OTE0pTal3Bg+9n2pItt7d2dLbgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 1.2MB
SHA256 1942ea4d2f0b066d0bbf102d25490e01e3843a204b2cc3cf2b721a7f7ddb9712
MD5 b76a36f694fd69b229872393bd33b65c
SHA1 710ebf0e68bb65f2faa4356abe17f3d164e8b943
SHA512 8e4172f38b9b32658717de15c38f5b0c4dfcdbeb73424e6ba4f08981c868fdc240eb5776452f0a71395df2d0bc441f3f88ffaead5860fa672d992a94fb868a26
SSDEEP 24576:WtWfhD1Toa5H8hXtWV1EHrYbCpwSh5xLJ0CBp9XLDlsmSQvGs2pqPsACJKOk:XhDBTFVbGqShrJ9TJHldSO2Md4vk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Size 59KB
SHA256 c5fa7f955f72a8ef31883517badb2e5d2a4909f708c9f8ab7b53e9ecfacb99c1
MD5 c5daadbdbbf6860d51598ca4cd565fa2
SHA1 ddfdc115feae3b15e02e181d6a1a7e9bb835edad
SHA512 020a2e14bdc6fe57215e8146659e42651192d2ee7485de71072cf042a7e865a782a9a37f9e288f471bbc4fd1d24346d1109452b5e08f35ec6b4f7b43bbbbec5c
SSDEEP 1536:9Nlnj2C5YQ5XhYjZt1g7jiHmb0kIuykcoXdUEN0:tnv5YQtYbK0VuytRN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Size 151KB
SHA256 e98f893415bb4a9e2490327239132725245b2388853aa451e61545cd0fcd9c03
MD5 992b11ff67a7a85ac361af5fa7b7d128
SHA1 8f6e96ef72e6f8d187555f3336ce2fa74bccd9a7
SHA512 df8fbd1abaa320a175389cd8a28b69713261eeaf5a3d6a743817923281eb756c2c600c5bfae7c352861ee85894845bd392801bf9356f92283da50a2936163ef8
SSDEEP 3072:BskfbyM8B0Q7wfR87OnlZ5o0ibziiIL4CoUwSGXr7qE9ffTPLU4f:BBbyM8Bfw587Olgn80sZ+3r9XZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Size 21KB
SHA256 0a525183f268409566c99e6217a87645908306df7dcda16a45adfdeab84ada50
MD5 32c05a2648fa581b2fddb72595c036c4
SHA1 61ad89a62722501be68af6a4ce20dd260126095b
SHA512 9fb37130d69df1439adb0ee4751b3ef8520fab2400abe2c3154933ff67f3b01b45802d7f6b7a14a0b4360509ff05d53dcde3b18534280eec21b4e4e31b7ec596
SSDEEP 384:N8wXheHqm8uu94P2/sO/fx/J3pRDM+Evzygxo7joQATBo61ze6J:WwXoK/uu94PsXtJfgO/7jp61zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f98f9ea82e5ded42262fd650abd53b99a0411c3280b02327b91d9c497ad10004
MD5 d6655f9e7a9e8eff40ffc4d957e1df37
SHA1 53c877e7b35c53c9b8de012e913eb1fefddbd73e
SHA512 9f1bd37060cbc011febc21b5d1f7c65b3afa182ab7a0464fcc8c8f85f47de01fa3209614d927f9055203a1d555fcbef6ef6fabfe7a21d36f967bf26b4a660051
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 867B
SHA256 550ba7050913edbcae18625c4fd9e8cf67bcb975c0be2d67ceeac8d8b540c6f2
MD5 f784952aefb29e435f76fc34e67255d2
SHA1 e0d44b96e0c180b1d02498094c0e506e3300769f
SHA512 5739df761aed3e589808d8e416f8176f8178d7b38cdd03aba57d9bd5871c3985ba2190147ade014a5c20b90c2de91a89f15002d37c761ccededf3543aecc05d5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 867B
SHA256 0132e36c14779d538fb351039a0a2e688e7bfc5b7465e6ca200c4a3622790cb7
MD5 30372f7f7753ca3f5569ca00eca32c2a
SHA1 56145896607d72acc2f1993a68aec1b05649bb5f
SHA512 3eef1423f7663ad3e894ab1d855cc9a99365daca213c2a18d19aa2b5a5ccd78cf672dc17bbbebf33538325b021998f0fe658fae56d67f9043e6bdd940d93c043
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c1d200636be9448fd81e72acdc4ee60280a20afd6cc4c3fca9e64985c446535d
MD5 162bb57f24381ce87887d404b7af0a40
SHA1 bd0994d6c5997a914869d8215dc3a136aea1d37f
SHA512 ff7d277dfec4490fd375dbde3a65396e56440e7c8644726b2d398eb2a0f229169c742d693433996b500f448b799c05ce1ba11050f82161f1e30e80c844484f49
SSDEEP 96:nmkhL1fx63XwpvWMoiVmdeHp1kRVfalUwQyV+VDCzYEGb:nmkxXqXGWMXpEVAzs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ad9e8bdaeaa1976c135d0c9dbc9d6985db5610afb51499934ee6bc9d4c97d2e2
MD5 1f68719f02d5644b3860598e55b42982
SHA1 f0920a7603fda95ef6b30c9e59af8242d5c61f86
SHA512 4f659814856ffab116ed518c48ea77d8a13a4f1d50716b8512c567781926548d1a31046a936f3f7abc2466a607116b26945fc73e91b1536e4a5dad97c8e9a244
SSDEEP 96:nmk+zsQNL1fxl3XwpvWMoivRWR5mdeAkcV/XHYwH4jNp1XXNVNVfakywQyVeJVDx:nmk27ZXGWMvYCkcV/IwH4pp1BVjleB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bcdc35c2343ebfee1498ec788f6a22907dfa68519f9839034c4a4a5f6bc72c29
MD5 f249f2d385f88670c67af0da207f0aef
SHA1 f2e55e11b1c0826bfd90be3d3ce59fab7caf1980
SHA512 bdab7511d2ec35fa9ce7c88ea7a26fe996baa7ccd7e47a38ab3fea76c4a3663bed8bca0c87323e01f63a70e817df6c8871df8e633b425c62b4d24ec9ca0d3cec
SSDEEP 96:nmk7L1fxK3XwpnQWMoiVmdesLu5J41jp1uQRVfalUwQyV+VD7AYEGb:nmkf7aXIQWMuu34hpLVAzk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4a47f0efd0d0f0d331114902497b11fd990d376c6b99378cbc6a9769bd30812f
MD5 4486d66a181b2f57ca986ee2b026082d
SHA1 2366c084a722e5e654f74868d984c7030deed8cd
SHA512 190a2f81a86ecc0aa9682478a16bb66054bf15fd7429115064eab00fc4e91823633260248848970e8c08cd7207e3ec021a4da0ce9f4f3767b2fdc95781ebae48
SSDEEP 96:nmkvsQ6L1fxd3XwpteWMoiVmdeAkcV/XHYwH4jNp1kXNVRVfalUwQyVeJVD7AYE6:nmkS7BXmeWMwkcV/IwH4pp2FVAzeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f16deb9d045988f2b1f2d685020143dfddbcbdb58e87042f2c4f1718f4a498e0
MD5 08a511565add743e522e09a5132927ff
SHA1 6b386197f6cf44fc5c263fc342d29f2191f7f3a1
SHA512 cea255b20e18cd3f646e488e2137ed09d84b3bd3726aed7ff11ca08855bbc1912b143e155fcb0f205c35f496800df07485457da3b5db81572c7f7c58e8507d45
SSDEEP 96:nmk8L1fx63XwpvWMoiVmdeHp1kRVfalUwQyV+VD7AYEGb:nmk6XqXGWMXpEVAzk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 276b4b07ea8e71b2ef941bca1530b77ad2e01c32e7b98b74d5b80d13abf2ada3
MD5 9512bf404d9f4977125501dc5931ee59
SHA1 2b4416fdd4a8df4fea29d0cef82795eb1861d1c1
SHA512 f61be99ed6e6fb4d63f1fcf6ff38d3ad45ebb2de799e7b1cd46eb9878355ae277393c74e778c8d7867d7370de84541ed8b89a82ceaba4db7bb683c4247295a8b
SSDEEP 96:nmk4L1fxd3XwpteWMoiVmdeBYwH4jNp1j3RVfalUwQyVeJVD7AYEGb:nmkG7BXmeWMiwH4ppfVAzeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d827e5c1a4188cca565d5edc0c0eb1a4afa8b90014319d1ab9503ff0fdf6035d
MD5 6250abdbf1535beb81a0a61e0a66ffb1
SHA1 e0ec1bf6b667a871018505d9ec7b9ec5dd5cd622
SHA512 1b4fa451fe04d94cb976c36108621b9161c90ccd1ee8419bc0fa0290b6ecbaf53706a231134ff2b6504b8641c0f693569222af6c30652bf568b4378e36685325
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4a1db0071728e9c62cde8b57da7d7ae3d2bc592b78e969703bedb679691db802
MD5 7d14263bbf00b71ba32e3c557e975130
SHA1 2d67ba96b6c378f9dcacd58b9d5775402007158f
SHA512 42a0d87e6fbd74432623e4dc446f1eacb5daf2e1d293cd27b77c82fb12f1ae56bf518738cfc30a58e0821800ad1e13543c60be8d86cebdca3fafb2ef4e12fd5a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 82007425f862f5c9bbae01b63288cbdb5111843d54d7207a83b9e293144945bb
MD5 0b031a03e6719d02eadff1422020c87a
SHA1 baa0256d5daa9dd1f30837233aead254b4d75007
SHA512 4922c20e80de3006491a758cf2fa24cd4d0048520a6401bce993b721b3d69510e2929290d8f9a34fb75488bb053e373377bfdf26c37e30cd957aa55941441960
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57df54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df54.TMP
Size 534B
SHA256 ec202c0000a68b0c7767ce60b02bda2d12888297e139217253409ec8b0f279ac
MD5 24ecb40c8fe7269e9bfcd13c99efb71f
SHA1 113bc00300491c46c7de1c34b3d494a690d5fb6b
SHA512 44558c9ce22b5fb06083163f19f01ce418f9a449e898854ec71eeec87a298921b63e5cca2dac3ef15a11e39d0a7570444b1a3b2d91846379b026493949942170
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dc02dd83a41a31780043ad964cad220baebcb3829f8045a9979364106e2a5260
MD5 ca8fc83d86a14f525f67527ffea40cc3
SHA1 3928e96c6a14db86bebafffa279933d7b75d63b8
SHA512 1c65af364f3e48fa14290f760fe5d1e532033e6fb06b3b702902e6cdb994561285049efe974dd136ada5d49a8ca0367ab433ea3623de0a931f814030951c973b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCt7/e2RUNgo5Y+OblfBhDO:A9iIxuERzA83h09RZxYuDEY/XDafEBaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9aebdea92583ae872050913ee2c2350bd037527ada244bec1c6ecf2c9ad11649
MD5 06c9cd3d13906ae5df3096406bcf7961
SHA1 48ca154bdb9b0efa7b8fba80b2bb6a8cab7fb7e0
SHA512 0849f1372f05ca743b1de32c7f2bb840aad7bd7408e14ac6cf2e99923b26b4545d782deea7ec939563bb4f00b26744f3bb1a6297f68b01783b993ab667f78671
SSDEEP 384:t9iIxuERzA83h09RZxYuDYz3ha/XDafEBaf:WIxuERzA83h09RZxIz3ha/XDa8Qf
MD5 SHA1 SHA512 SSDEEP

Submit Download

salinewin.zip

Path C:\Users\Admin\Downloads\salinewin.zip
Size 203KB
SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
MD5 19a966f0b86c67659b15364e89f3748b
SHA1 94075399f5f8c6f73258024bf442c0bf8600d52b
SHA512 60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427
SSDEEP 6144:AX0xX7MnBGkuOtEZlwuO2lJwz7EeQG+YSGL:AWXKuVZQ27oEhVYbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads