hxxps://github[.]com/pankoza2-pl/salinewin[.]exe-Malware

Analysis

user interaction
yes
max time kernel
250s
max time network
252s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/pankoza2-pl/salinewin.exe-Malware
Sample260508-eq1jmacz41

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 1 IoCs

pid	Process
4716	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
85	raw.githubusercontent.com
86	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\af\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ja\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1004695208\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1708895988\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_274610703\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1004695208\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1004695208\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_78611458\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_78611458\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_542391799\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5496_838055955\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2121699993\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2121699993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1708895988\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_78611458\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_78611458\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5496_132171609\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4504	msedge.exe
5112	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226869892361724"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{6661BA81-E593-4631-8C77-78F318E05865}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{7A806085-5EAE-4EE0-B2BA-D34BBF77B1FB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\salinewin1.5.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4740	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4004	MiniSearchHost.exe
5864	LogonUI.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 3988	5496	msedge.exe	78
PID 5496 wrote to memory of 5112	5496	msedge.exe	79
PID 5496 wrote to memory of 5900	5496	msedge.exe	80
PID 5496 wrote to memory of 5900	5496	msedge.exe	80
PID 5496 wrote to memory of 5900	5496	msedge.exe	80
PID 5496 wrote to memory of 4388	5496	msedge.exe	82
PID 5496 wrote to memory of 4388	5496	msedge.exe	82
PID 5496 wrote to memory of 5540	5496	msedge.exe	83
PID 5496 wrote to memory of 1612	5496	msedge.exe	84
PID 5496 wrote to memory of 5540	5496	msedge.exe	83
PID 5496 wrote to memory of 5540	5496	msedge.exe	83
PID 5496 wrote to memory of 1612	5496	msedge.exe	84
PID 5496 wrote to memory of 1612	5496	msedge.exe	84
PID 5496 wrote to memory of 3428	5496	msedge.exe	86
PID 5496 wrote to memory of 3428	5496	msedge.exe	86
PID 5496 wrote to memory of 556	5496	msedge.exe	87
PID 5496 wrote to memory of 556	5496	msedge.exe	87
PID 5496 wrote to memory of 2376	5496	msedge.exe	89
PID 5496 wrote to memory of 4572	5496	msedge.exe	90
PID 2376 wrote to memory of 2340	2376	msedge.exe	91
PID 5496 wrote to memory of 4548	5496	msedge.exe	94
PID 5496 wrote to memory of 4956	5496	msedge.exe	95
PID 5496 wrote to memory of 5136	5496	msedge.exe	96
PID 5496 wrote to memory of 1496	5496	msedge.exe	97
PID 5496 wrote to memory of 1496	5496	msedge.exe	97
PID 5496 wrote to memory of 6080	5496	msedge.exe	98
PID 5496 wrote to memory of 6080	5496	msedge.exe	98
PID 5496 wrote to memory of 3836	5496	msedge.exe	99
PID 5496 wrote to memory of 4884	5496	msedge.exe	100
PID 5496 wrote to memory of 3836	5496	msedge.exe	99
PID 5496 wrote to memory of 4884	5496	msedge.exe	100
PID 5496 wrote to memory of 4884	5496	msedge.exe	100
PID 5496 wrote to memory of 5528	5496	msedge.exe	101
PID 5496 wrote to memory of 5528	5496	msedge.exe	101
PID 5496 wrote to memory of 5528	5496	msedge.exe	101
PID 5496 wrote to memory of 3796	5496	msedge.exe	102
PID 5496 wrote to memory of 3248	5496	msedge.exe	104
PID 5496 wrote to memory of 3248	5496	msedge.exe	104
PID 5496 wrote to memory of 4716	5496	msedge.exe	107
PID 4716 wrote to memory of 1000	4716	msedge.exe	108
PID 4716 wrote to memory of 4504	4716	msedge.exe	109
PID 4716 wrote to memory of 4520	4716	msedge.exe	110
PID 4716 wrote to memory of 4520	4716	msedge.exe	110
PID 4716 wrote to memory of 4520	4716	msedge.exe	110
PID 4716 wrote to memory of 4400	4716	msedge.exe	112
PID 4716 wrote to memory of 4400	4716	msedge.exe	112
PID 4716 wrote to memory of 5368	4716	msedge.exe	114
PID 4716 wrote to memory of 5088	4716	msedge.exe	117
PID 4716 wrote to memory of 1156	4716	msedge.exe	118
PID 4716 wrote to memory of 1472	4716	msedge.exe	119
PID 4716 wrote to memory of 808	4716	msedge.exe	120
PID 4716 wrote to memory of 808	4716	msedge.exe	120
PID 4716 wrote to memory of 4224	4716	msedge.exe	121
PID 4716 wrote to memory of 4224	4716	msedge.exe	121
PID 4716 wrote to memory of 5716	4716	msedge.exe	122
PID 4716 wrote to memory of 5716	4716	msedge.exe	122
PID 4716 wrote to memory of 1584	4716	msedge.exe	125
PID 4716 wrote to memory of 1584	4716	msedge.exe	125
PID 4716 wrote to memory of 5088	4716	msedge.exe	127
PID 4716 wrote to memory of 424	4716	msedge.exe	128
PID 4716 wrote to memory of 424	4716	msedge.exe	128
PID 4716 wrote to memory of 5172	4716	msedge.exe	130
PID 4716 wrote to memory of 5172	4716	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff89377c188,0x7ff89377c194,0x7ff89377c1a0
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,9282578311747990313,5899776522386260863,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,1685086479153427275,15773470934722590649,262144 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,18048899614075897106,12054686498250262279,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,13346401190149688180,18018813500178961214,2097152 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,12026932775657488190,1467685165504743688,2097152 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,7325871144302873887,10798816357063303481,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,7113084890724745374,16901210318083665280,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15381858057364397163,7739617481762232657,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10202607017310964199,14893726182495456330,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15381858057364397163,7739617481762232657,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16425491957744101639,12701658486250145716,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2871883924718584054,18092602984454085054,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11617471701320981437,295384638844376728,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,5295854237206082984,14543961542369151320,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,13688380290709826178,16552931012971560033,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,13667143113478716139,15636154645725961337,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3000,i,13670666826244023914,4644271605410942630,2097152 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6492,i,317092497029855428,5570550901902939185,2097152 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,9829141892664520698,16343248440536029047,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10042990350860651366,16296586110508011111,524288 --field-trial-handle=2152,i,15247705802524545105,2411646614382163373,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x21c,0x2b0,0x7ff89377c188,0x7ff89377c194,0x7ff89377c1a0
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,14801658628459292733,12541892557601395089,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,10890607363605112669,279564077743966540,262144 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6993872277484991865,1004204697899670416,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15618601200387942330,3856907535549165475,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15618601200387942330,3856907535549165475,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,3458193981892061406,14809536772472800667,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,10994620953904214687,11472073181370784714,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,4988468121342810448,5692860557721142803,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4434117022394379646,14721432180350690504,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,1366310005198356969,7867156708286701922,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6045659502595294097,8561426594359070117,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14110247076421425285,17269643030743696098,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5208,i,17079179275482430506,10841006857089412888,262144 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11324890707873778267,2080850683698965415,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,15949973083261721236,4555574657983928266,524288 --field-trial-handle=2092,i,3130458041983649568,15243686217749062552,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
    3⤵
    PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4988

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2a0301bc35651d5558ad846eb36835825727458f3a8d0dd7092bb0b946af4865
MD5 3ef264916cb5bad5972f8c38b8ea0c77
SHA1 1fd6d9215084caced866c7613863d60a96b2c125
SHA512 4c17ca893f32f1c95ed98054ae85e5669eb700dcded16462e582ef38fb535b7f7011e72a08621dce3f98ac3dc2a9b880d25b9e685b0431de36561ee218c595f0
TLSH
T15FD0A7773B0EF831F7289170D416CB05267554A52C066602E320845C98355D493892C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b1defada65a97097827096d86f0409e8bbf92205166cb70f4f40e9e3cfdf5d6
MD5 0234c6a6a184c4245ade9c192e1e6a79
SHA1 d5f4d3a55c22ac3ded8d2181f88988289bd3b2a6
SHA512 bb61c15cf42accd5af64f15757054a8300d7da84b8a9f7a0488742ed64fb353795971481b540ef11ba2734cadcc2f5dc68f01aa126dfa9acff09b54362d5a2cf
TLSH
T150D0A7372B0AF435E63C9170D1138B05263A54652C435602F328C45D85794E8A7C52D2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 458b3bd1f4dd1185aa2835cc5c08cb02f5ba2594d5029b074b8722ea9d4d1b00
MD5 e9baf02cf11a148e3abfab3d6dbe3bff
SHA1 b74c1aa25e640c69263e122894ecf380a74ee010
SHA512 4de63ecb3da534435ee0d830d713e50510ff3738b20551af7071ab60de10d52559ff7d7aa017d12c991c78e00634878f3b647a7eb17f69cad238e8d0c626a5f6
TLSH
T19DE0EDAACC60AD3B89FD47186489078AE75017562A80984BBA3C92098FB262B558796C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 83395db01f21c9db7a48c7202128d3ef512db75df4a95fccb45b0892140f3519
MD5 d566dce33a744e372778510ddd2a8f14
SHA1 3fcf9c313c376183e41822d449f7f514b7f96d14
SHA512 c086d69dc979d9c26556bdb6e328edd1d9ea42feaceda15111618595a803e44d734ec3a798b476b7c77a3b5758d6fc50766144af1ab7346f1015be8c7e67ff8c
SSDEEP 384:EBDQ3D3Xu4TLiUJECxQoR6B1AYznxHjX7FWuWaW15WvWNWaW5JOPQoLOErCddzRl:ADEDO4T+UJEM6rvjXvuQoaErCdd5CQ3
TLSH
T16E13C53E36B81D5BCAE3503E5E4F8A3363A28622C2C5194317747ED6625F70E7A0E5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 7b02bd0901000e0877b936a9dd775fd8b1091c7d0a541e5b2ac089f545057699
MD5 785f73639eaafa49dfc314114cace826
SHA1 439eeb8d0b04b49b1392f73c2f1de07a25fa0c72
SHA512 357e5179299a2f3e14f2349708820f2b9c55c7dc7b2e4b5a4be133877abdd5a503740dbe754a2eea884bbd4c673f5207a86a3799c1031d36d422212d51a88134
SSDEEP 1536:okhGp2uFqUGSLAk4m/6VpiwaEPsi59IBi8HsTsaRa2WbAoIRV72R06SJwm1Vb:7UukGiVceH0smLWUZSqV
TLSH
T136B462F71860A01BCFA816F5D6023A7DE177011DACD1ECE9D5390C91A829F32B6BEE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d483c5567cd1da2ca69bafe98b207ebdc5f011a8252440e0ac575bd6f44148b9
MD5 83c52311978a3d486cb36df89c411767
SHA1 0639f109e44decb047f227987a90e87d76bc93bf
SHA512 b5e1749ef61920167a4d407431c32a0496701f2953bc80ca3a09960a4939d34029cf388d273297b9867d74ad94d3047e12651e51e625186c5ce5332d92a10f8e
SSDEEP 6144:r5Pm8GlVLvsM9PoE2Y7VpZ2ykQogIiKf/HRaP4y7mgRB:r5P8v99PX2Y7VpZ2iogDk/kAbE
TLSH
T18B25AEEE9B383C87DD6B4D70B4E0EC22BCB41183751AE1E34818C990975A3C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 3a38c4f349df2e29694a083732278e40b71fb64529bc75b942946cbff98edb66
MD5 054dfcac8fc6dec9aa5362a3d48b07a0
SHA1 e9568e00d77fb5cb630fe466fd27784de627560c
SHA512 f083667a94840dc204476bacd54833acd84f2ec82cc1f08243439f144417978015e684f24edee348ede9217d42147a186ac62d3b75e4b638a45a17e29cb68726
SSDEEP 49152:I/gC3bYCjHCGzzOVBlEDCvvzgFgLNPz0JeMkLbpeWS:eD9jH5D+v3z+GB
TLSH
T1FE869EEE86745C83CF628930F0E0ED577D7012D3B995C0D38568C698469B3C5BB9E2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 09234d179258bdce6b8bcb2afc92b602650b8936e90b81e51a15b28e28972252
MD5 527dd565c4be07888148bd3121bafa8f
SHA1 6355fa08d6827dadf7ec2592079cd8fe65d612d7
SHA512 7623e26cd9393559af73598df7d01e790b6078b8813730efd95fbe3e72aa3ec33f48452ae11000ddaaeb0547947b5c6bc544d3ad336c37db36be91244a7363b0
SSDEEP 96:79jy9esIFNjRW139TsiIO62vc0FGKBeQWrq46gI60w6xGXz9GghACO9Wn69ONAp7:xWUsIFNFW139TsiIO62vrFTBeQWlrI6U
TLSH
T10CC1D44193B2C4EAEFE5C872D6DD0C93BE386408007B1E6A0A9A4DFDD99F7B158C54D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586e84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586e84.TMP
Size 3KB
SHA256 8a996180362d7c57d7455b7f0c0448820585146114ac535dd42cd2e2af9a392b
MD5 bea26cfb2c54ffe382fa2eedba6da66f
SHA1 7d49fb626e866e47c65411058bc0cc5644ad7872
SHA512 3522e3c7ff7ae4cfa312e4b8a8a7d5591d382c574391d6466167cec3eccf3e2ae00aa0a17eea5d7fa0fe1b0217c2ef83bf2dabb79d2ec7fc82aa0b468ac70095
TLSH
T10E61B44163B28498EFE2C1B393D51097BE78764C404B1E7A96D64D7CCADFB308C46908
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 350fd7c3909705ff6319858e0e7f7ff14c9f8f3fe75fdea38c0cbaa1bc136e93
MD5 b35cde7fa058fed5e261f9d97c975926
SHA1 1be19180ae1a71d1456daf651b82f95806ff2a6a
SHA512 c5cf60f1c9332ebcd96b043515a52f0d4f3ff7b3e34c974a3f715eda1e45cf7eed91a0b4106a7ed368c6628731ed9b32bb943d597551a63ead18635203a945a3
SSDEEP 3:MsEllllkEthXllkl2zE/lOpl:/M/xT02z
TLSH
T1AC4402456B80040BC500127040A583512770D42456226787345144225C856500C01084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 bf6f9ae2dcb0a5a271b509b19d12f19df0c7f6b5b6129f60037d4479d269327d
MD5 c5cd90f21ecebafeca0d689e303d49cb
SHA1 08c4ea693a633997d75850dbc4218708286cc708
SHA512 13fc7d562eb7ad1e342493520afb972605cbc705541ba5d6d9d1854cf3bfa5579bd3a7df389eaa6fd26da2571d8a5dddc1a43261d54aeff1afe51ee7d2b01b87
TLSH
T18FE0D8957BC7C21D751078CA42696F1AD1D03446D6856FC37B00CCC47702011F3E6D67
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 af07f3360bef12ece69a91c0afcd3cb0027c34d97a35b89107b6933d448a6a1d
MD5 395ba424d9207ca61a1abc37fabd4d61
SHA1 be8af7572763cbec49213dec8079189fef2963a3
SHA512 7ac4bdc741d8fc01f0f5157c31d532c179e8b62b99916aabaff83ce737ef28a5927d8a79e6e72d9e09afb6961ffb6ea0ffe9a69ac6e10cf5619becb3bdc5c390
TLSH
T1C1E0869419CAC139A0296CEBC36D5719C6D13447E68B7F82670FC8546701B55E3DBBD0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 0e2b0b3df07735c8070aa85b8b0baf0228793da4b2e686d20cf2024036ba4ede
MD5 46f92e7750cf7349fdb1ec872264c52e
SHA1 24f274d41814d6165470c6e5185da9f0c8473e40
SHA512 b9c69cb99b077ff195038aa2268b96d2714ba5c8e6b11ecfcdd5178672433a9ff348181314c4090286e03852aef68b7edcc64787bf03e2230acd2071ce8bff81
SSDEEP 96:UBCxDv974y1FwOJsUYlTCUad2bybsq1pW4EM0j:Ga790y1FwtUoTCvIIhEM0j
TLSH
T110B2079B2E313447DB081E7E11697CB6CE37D16CEFE1DC64B060443298B88A690789BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 2d13a486a92d2a1d754037f26042c87329e6062b70a450d92495c1d8fce66459
MD5 6decc676a04c5afa04fad3284fbc143f
SHA1 c2f5509f1fdba5760422dcefc5dae867ab0dc700
SHA512 a570d6934572a9db934449cb770da86260b521dc27c0bca38edd715cd79cf7606b655cda90d9e6ae56cf04ae2981c2031d258fcf65041973bde94a0e9e2ca70d
SSDEEP 192:toDUy9jC0+G83uxXBBK31GkSJzUEJH7DNspUm:t2ZlCa83uFBBQ1GkSH7DNspUm
TLSH
T12914454F1F302712CD7D517A68F644A39C7DF03FCB526ADA68611474CEE3652A06C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 506B
SHA256 5ec27dd9471c0060f0f4f5e4486838dc592673a1a41fb537e9919d6667819303
MD5 40e0fe91128b0d60ee80d519a8217c99
SHA1 16a2791ae493e4887139e43b26ad115f20920c02
SHA512 4cb0b0e60dd38c0d51b3249fad54b3c2eb18db542a0c1e3b83acc38a453e08e8577201cca4a7aec047852546f1a39afff1c4d200c9ffbd14075408f77dec791c
TLSH
T18BF0ECB2541065D6DF1F1CF898942945F713B059D9C48FE8C153B1080E829F4AADB505
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 0d6da1a6eaa83918d38e3a90098a23670da7cd2c35d48fd8c46074641c09faac
MD5 f741439accf0ed291862760aab5ceff5
SHA1 412203daee683ba22775af48b93bf34652f9f9ee
SHA512 8b96d9e5145ab4ab485f5808b4a9fa76b3bf7dd20d7a316365330aa98f84759a78f4e1ca50c3f325513163485cd8f64f871e3ad3a9ecb66685b611fc92a5ce6f
TLSH
T1A9E0D8B5ADDEC1197214609F4369770DC7E03907D7C82F822B06DD64B201244A3D5AD6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d39d7148ad7223f7548a0ef670d3cc45a99577b0e5e6ec06c348acef4308017f
MD5 551a8e284801842955a457fe1a6ba525
SHA1 a0ce4105a74254f96f6d69d352472db270077c7a
SHA512 ea82f04b4aff61b1cb72837c1cac225b5d6c81933107d61b7266dc2114a89b2aa99fe3e5b72f608b6e05b47794fc4a668c2b364cc1061e8b654c6a735d78d097
TLSH
T19761ACF783F5956D9A0295F0AA18AE2FCE2C0510431C7C6A85E0BE07D3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3869f2f0885065c2f9b68b95683293d38f221e675cb1614c584dfff49287add8
MD5 8b8c654ebad3174747b9f3984f08ac34
SHA1 3b184a7c06dc8045958260ec5393cfdcb2769832
SHA512 4a06631ce78dc29f792540e1e4c9bdc975f62d9f5368ebbbb5f6750388dbf14431c0fab417d8322474cb93aebfa59d503c50da4a8a0aa4fee35c189671c08121
TLSH
T1E661ACF783F5956D9A0295F0AA18AE2FCE2C0510431C7C6A85E0BE07D3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 aeffb8492484dba763f3ccf935c4670306d23fc5f6b6d839780f720b3de04a6c
MD5 9f2fa536c758d1de475be7b5b39ef5a3
SHA1 fc80f3bbb93fdaf22952585fcaebfbc80a4d2436
SHA512 4fc099e919e990db2f0b7925e2f59155c3c2e8384a96cbe34595b58c77775e056a766393cbbbcda164f06bf8df3db650bdd8c2a9baa1f1ef129cdea8dec4f5cf
TLSH
T1B171ABF783F5956D9A1295F0AA18AE2FCE2C0550831C7C6A85E0AE07D3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 fabc217d3ef38f652c058794a61546ed81b2d04054a31f9cf76c617a4862b9d6
MD5 5f3ce9b502fbbe47ff3848b33d003ee9
SHA1 ffac7ff73438b447c1184df78667becaea553d21
SHA512 ba4c622c013fcbb4d667886cafa1886f1e7425976ea76c38d98679d38dd5efb62626207654f822561b7121b0d7240a95880a7992fd2f7a96c8af890c164acb72
TLSH
T107217897C9F9745B203C0CB76C48786D6E7DB835529290F9CAA2E12CA1821FB4B15079
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7f549f4d020bdd45e26173b2d614eafc473641ef92a86c807cd6b836797d44e9
MD5 fa2d9d5f979bd070799f05b9389bbda4
SHA1 44e8f72022deeb63c34a9bfc89320f9b43d8bc4f
SHA512 08627ec56cb4c3c016ca96ac845906dd79c0d2330c9afee136799d8d59e3485b68bd6673868323f123f9ada6de1fbf46e086d9555ce557ae90b6c903a4fb9534
SSDEEP 192:sxZJRMyMqZ/K1Ml8CoY/fSsRWpVrL0xILc16zodpmTV/W6+WNmtgZZYfqJIadpTw:sxZJV8Y/fSsRWvrLk37O/bbZxrc7
TLSH
T18182D7566A345A7BCCDBD219FA55BF53D7F9112392804E449AFC8F0C10E6BED224382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f0a6336aa0bf9d750cc3e8011b3cb6058a6abaa74f1d1e4b9286353722815d29
MD5 973e064418b7f0eb83cd76b08da335ae
SHA1 8560328827720f95f7705ad05999458b22e26158
SHA512 e31ed801d5b2d9434e12d838283d79deeab86ccd8d32f206503ab31145a38bad560d699eb054fc60c3a501d8599a76039b0e17ff06cbd9d87d463fc8e8b250a8
SSDEEP 192:sxZJRMyMqZ/K1Ml8MFY/fSsLn0xILc9zodpmTV/W6+WNYQH/Y0lmaEmVIgjAJ:sxZJVdY/fSsLnk3WO/b//5/jk
TLSH
T1C272E95669345A778CDBD219FA46BF53D7F91522D2804E489AFCCB0C10E6BED224382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ff4677c777db286f0cbd124b5361d944d30c048b5918a4f04111e114513af062
MD5 83928ca9aa45c16b6eb0011039994055
SHA1 920e76b9ce3b45505827649c7e783bb2f72b2adb
SHA512 fe8aa68bbea45f42933ed4a577ecf7453bed5d76d988cb06d9a3237a597a72c3ce4e859cfcd934b84cb7c2221ac1faa8b7c51ea1e77b125f0b2cbeef0d9e61ff
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c7yZLle:EZN9b8PT24ZE/CuWRmCCQx6u1jaKc7yC
TLSH
T186031C3B280CCB7F4F804E9CDD26BE8E6DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 7d038c801cf2b114cff399e61bbe4ec6c6fea844c00b4237ecdfac62fb18b148
MD5 2868a86843561f27660730a9cebe24c6
SHA1 50070297a1d8d1f47f367695715cfaf995cc24e4
SHA512 8047a47350006c494c46c1c6a36b23d6d0c7eb80a090a62ce35ef5104b57eaba8f3f104d9f6a4d53c08a46c0bd5f39d924709f6dd6531fbac2db8eab5a768952
SSDEEP 768:EZN9b8PT25/7pLuLnRuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV307yZLlp:EZN9b8PT255EnRuWRmCCQx6u1jaK07yl
TLSH
T128030B3B280CCB7E4F804E9CDD26AE8E6DE8018B9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 b7adca21644248b86b8c6d3649ff022c08000ce29aa62df2a30abf05615333d3
MD5 0753cb2c0e185a7eb99f744e549be98b
SHA1 837c884b853a3b6b261cfc8c9b4f804b27c8ebcc
SHA512 b6df0bd27b4559514897184e952a31c274e55ae6379efa3412647c97cb59a665992b0cdcd6d9371c320ea8fe48fa70b4d70289a79a013d200f0d57db36534ed8
TLSH
T140E026205ACAC17D7115208703298709E2E47427D2C83FC3BF0AEA886742604F2DEA90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f0a423de9d2a930152ee2cf7bdecd6083165b719cc075843cf594e791da1d087
MD5 108a77362a1a146e23a982518b10196f
SHA1 845b53ad3f99ee1e091e4365dfa4d2143abb3243
SHA512 935ed814705979115c2071c8baa5e410d6d6d3634850fe65d51000669f9487d42a57d9758fb6bca1d87a9783d68f66b0c71e005c599d8c01b4079495b848d94a
TLSH
T100B012403F00926BCCCA143202444B809F04E807E180DD57494FCF684D046D42F40FD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 19937459dfe0ffef83c0fc0d8d2dadd1fc1eda8e6355d61f78592411c95648f5
MD5 fc0eefd3977505d6a0b66ea215c3003a
SHA1 e29fce0c77df115fb440881903931accc55cc4e1
SHA512 d21174b9f3b433f361a2eb2b4cf916adc199009231c3c9d65cbe7de200790fd0a4f6ffb12c77c6e3042a289f8287c1c47ec5b9f31100f601ca27f5bcc73aed2a
TLSH
T10BE0D8202ACAC22A715720DF4319DF09C1E27403D6DBAB913B0FD5447306240B3CBA90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 242f0ec88d8f0373a998def69f96ef975cc39334e4502a797ec0d278c5adc773
MD5 98a3fdb6f83843340623a4dbba283295
SHA1 43f7a37e99f7f5e71382947c362bb9fb947d3494
SHA512 9497b63bcc426d63a756d54d19d9dd3dd4e4870ffadd95ef47f0704ac0394f452819d2edeb160daf7cc1f06b11fc616227aa15f97f815d606214908a639704fe
TLSH
T138E04FB06ACAC239605560DA43A99F1EC2E07807D78A7BC6670E8454B701254B7EEAD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 e134d5e20cc78df081209e42acd6eb22e94b71a7e147d235ccf2504c56147a00
MD5 abf4982ffeeac4e0b85717cd6e5b83ea
SHA1 9d765a6763046d3e2b9a9b9405c45dca743d0091
SHA512 39ad67461b5b20295218de9cead2bebef09840003b9f858e27916771aad8129b912271cda5995a30b9c413cb53e8f2de464ec01424bef4a8ef81dcf9b5a62c96
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZ9RsD2E:cdOlNXJjSSjroduZ9RsD2E
TLSH
T132C26911723B138139BD28498590B8AF46C230633418A83F7BB954AA5F67E25DDFEDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 33352215105bbe7baddda17943c5596ab73aa413b69614b1bf107c834323f124
MD5 36c85bb5e38a0a15916af227423bf195
SHA1 25e7b8fcdc078b87e622d85e5d5e77e5d1ce4515
SHA512 6c028144eb31de2ebfb7e9440670e92a0454d26c8f2a88e79e5134d80d7bd7d35caf335a9611af5ae456023203aa50fbe4dc782ffd0eba7de3b1196d237cc1a3
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZ9RA:cdOlNXJjSSjroduZ9RA
TLSH
T19FB26B15713B13903ABD298A8594B4AF42C231633018E43F7BB954AA1F67E64DCFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a4b2a06b-1178-4b4a-8964-c86012330bf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4b2a06b-1178-4b4a-8964-c86012330bf9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 a88095d627cb1fd97d1c9af25aa268ada1d7a22fafc4e37beef9e0c4301ac8b5
MD5 fb0405f3acd6e871187134aec40adcc2
SHA1 23f980fc713fa5e7ef8d552ffc674916d778d0ac
SHA512 d79b06455eaaef9e70f7c191b13fb6c19a995689677bbc80ad7de48c507e45ba70573197b77e045c185a2cd42f613ec2c3fe6ba009bb98f629f0981c6485a03f
SSDEEP 192:LtOBKAsuliqMrsn5/7zBzQRIIIsb0MIMuDYcYSzrQFTITRTCTs:wBjssus59QRIIIsb0MIMmBEFct2o
TLSH
T11D72C7697F891BB3C66E1B7652A9C65517D1DC420DA0379D3020280E5CF3BB78BC92F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7938045808d0a7280b05f99b87f686ead13a3037773df2c73302806d23e70ed0
MD5 b9c279ecb6bfac88adb6d83a12e8ee2c
SHA1 ea53ed9f1fc12c256b7c131dd5377292627dc7b5
SHA512 5b3e381ddcb68575b964b7d558770ffd4f039afb60a17f77efaf56be5f7cfcbeb8fcbc81a780e681e118abd45a47a136b5fa2959bc44d647279353b0095b9911
TLSH
T15DE04851B9C9C1AE702920CB43554359D2D13547EB853F85AB0AC458620165473D9F51
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7d9a93db6b298f7bea6a31ccc4a9ed8b320225f462ab7d6673cddc42117d764a
MD5 fd9c2df44f605f92b021c9082dc31f31
SHA1 1b1d2bd6c7147c739e6cb86c5fcad5148ddc0811
SHA512 6635e19f3f50769179ac4645826c87b7221d58008b0dbd52d27357f6a608189fa4df5364685c5d3dd60680eab250d781f97376142529c7b87c0c673bc87c0de0
TLSH
T1A221BF16F324C149E18E8A3EA06B97350378E9129FBCDC0F44B920356DA2E001E8F6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 4b0453d188ba0289d5e71b4019783261c70a96d2e67433d44745d28f06c039e6
MD5 2bb7ba9d5ea584e9d437bb5ac405e890
SHA1 2b8d6d8382710bfebe330437935e815c86a2e78b
SHA512 77de62d0021ea883227fc6e73007e66c0edfc31deb6bbf1ba03643d3785bb89d6ba960212aea5fa173c5ac494852219d4560a875d62ed32c2138857cc68a201c
TLSH
T155E0D8907AC9C19F611120C70369838DC2D13C03FB842F86AF06CD58730124173CEB51
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 25680f62ee271efccbd0336980ea827d16bc442c29b77e2828e6f3d1c4e5e111
MD5 1e4aa2aa8493f8225b41b2c57a0948f7
SHA1 97a507f09c69cf3f028dfa7fadf1cbf4e2a3b264
SHA512 13fe717426bf6a4c605b8c809dce465a46db98f9a378ef3c9a4f4e6e7322ed2206876cf60cdecc04fe16820e638484cfa804079d1b229d330dbeb53cb97b21ab
SSDEEP 3:MsEllllkEthXllkl2zEd+UK/:/M/xT02z
TLSH
T1134404047FC41505D5001134C055C3510370D41D3531574F345105137DC55740C000C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 624bc62473cf15c791c7c9ee41e53b04dcbad63ba2ddeebd55e862206157760b
MD5 849124825dc54e0c4baaee9f60ca7e5a
SHA1 c0632383180d28d237e4dba383956c9743407f5c
SHA512 7a3018cac844b2b9a6ddc144dfd00a41c21851083ed3960aa3ddf1101be35a6c8248afa2b5f0a703026e20b05c434b44c64191152540608d6f3a946a113d1d80
SSDEEP 768:bFFcpwMwgmWWyKFMEOmjXbK/ozJwLaArXKCh:Ow1WdEFXbKQzJwLJD
TLSH
T1F603B3F988D7893AD49D6B4B973D2D2298BCC133B5A84998F7950F0CCC6607FE706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 088297f1e7898d8db1fc8469bb542b90ccfa0cb466d68c80e5d122024c3b3c64
MD5 270bf008e70ef9c789a2816a7a62378b
SHA1 350fa1fd4236c275d22689e32bb5748ac1a5737a
SHA512 206151e043109c730bb6cd4a80a914e22a4336df3ea7c97e79103b0e5d1197dfff014139d7db8c2baf67904b811ed7648da8cabb53b6c020a181e28a333b9781
SSDEEP 768:uCFFcpwSwgmWlyKFMkwt+x95jpLaArXKL:AwTWePtm99pLJC
TLSH
T1CEF2D3FA88DB897BD89E5B47A33D2D5298BCC163B5584994FBC80E0CCC560BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 04e8f197aae126a14dfb7a499024a1c2fd1dbbadd6a43455438a4f69dd3c6fa5
MD5 925aa36be22264b5dc7c2ee25a1dae96
SHA1 fb7bc2804115d21f790698164648b322355de091
SHA512 3b2b419ab264953f51a5845cb9ba0407668f7d1d55a32a2c3dcd9187aa0332767e4ddfc29d3fedc2f938d020199882e3a5f963648931910f538c0815031273a8
SSDEEP 384:nAiFavqMg38Nn8TUNTUlIxB4da7614f1KFAjTRCeXHPy3Ra4EHrN1k+5vI+l:bFayv3cwg5VKFMEOHa3RaP5
TLSH
T119C25D36E858DAABEDEA8FD9E70A7613EEE00193D58C4AD4DAD81D4D00C71DD130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4c7feae84937c7082efecdd215add31518af4dcbfa3fee7a93a02f0021e24217
MD5 f465fb60a0d8f516782c228ff4974ff7
SHA1 b12cfd0e2635dec92a0cd9f96be204e832a42afa
SHA512 eae45a10053db63d43f72a5bb3e429510a1cc2a4a1a2ec36c028bc4deb5e9833b5b47605346946996d5132f84af7dce4a328a726072a0877bd72522fcf0369ec
SSDEEP 384:n/iF9CcmyWCu38Nz8TUNTUlIRUWq4dgLp14f1KFAjTRCeXXPywLaJCra5eKOrN1h:KFccpu3MwgmW6yKFMEOXawLaArXKCh
TLSH
T1A3C25D36D8A8CE6BEDE68FD9E70A3653EEE01163968C49E4DAC91E1D00871DD130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ac2985725ec5aaba46f60539fbf049f4e7ae8567b22e6551b71ab20adb18fd29
MD5 2159b7395743c0137a97f42d1d6a2665
SHA1 86ab6978ca2f200dcb62361c5e012f47bb153349
SHA512 2109f953dccff1cb1c5312603683a607215561f7b6a2772c5c3dad3097f76208663724954b7ea090341c07d80c64f2c98681a1b00e4caf1608360e6c3f3ce6f4
SSDEEP 384:nviFavqMg38Nw8TUNTUlIxB4d45mBK14f1KFAjTRNAc3Ra4EHrN1k+5vI+l:6Fayv3DwgL0BlKFMzAc3RaP5
TLSH
T18EC25D36E898CAABEDEA4FD9E70A7613EEE00197D59C0AD8DAD81D0D00D71DD1307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4b741a224ee7b1b61365dbe579537e62a719718b51f6b0957520afeb34b0feba
MD5 5345719a2a98845daff25c62dc9bffc5
SHA1 0a97e50772ef33eecb726d304be18a1756c08c85
SHA512 6e154d25ce2509ac09b146ed4a609b53264c074ce90da4a480be57a1d3a8d77bef4402ecec3f0be2a8859f8e6e0d0bef8eea600abd6b01131e9689bd992f4745
SSDEEP 384:n/iF3CcmyWCX38Nz8TUNTUlIRoWq4d1Lp14f1KFAjTRCeXXPywLaJCra5eKOrN1h:KFScpX3MwgmWHyKFMEOXawLaArXKCh
TLSH
T19FC25D36D8A8CEABEDE68FD9E30A3653EEE01153968C49D4DAD91E1D00871DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9a74a35a11b8e056aa0d89186ce0ab7cc2815053c4d2b97d007619119f0845bf
MD5 6874be2046663ac2e79114c83e06ede7
SHA1 baa9f95dfacbc98dcb1f074a9bce1e2376dcee41
SHA512 d77496358ce4b19c33e764adf2880a467cdeefcf3afb00863557a037263550c557bc6a5753f6c44fd063582bff256c9b375365304511fb36f8dfefc3384ea865
SSDEEP 384:nciF0CcmyWCX38Nz8TUNTUlIRoWq4dKLp14f1KFAjTRCeX2PywLaJCra5eKOrN1h:HF/cpX3MwgmWAyKFMEO2awLaArXKCh
TLSH
T1CBC24D36D8A8CE6BEDE68FD9E71A3653EEE01153968C4AD4DAC91E1D00871DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8bef176fa41422e6c4933ce6ec2f93520f72e2666eb8bc6c098106c495dd6d30
MD5 c081ac2056b91d96468ec6e88b477307
SHA1 919ff86c38da1dcd055f645fb6ae75727c9d0984
SHA512 9292429969cb966453660e97bdcd71714c21a09c0bae229ec0fccf23d5cbf661170e34b7e251015700536f2584cab043542636fcf9e607add704f0e35ea6e9c4
SSDEEP 384:nAiFbCcmyWCw8Nz8TUNTUlIRoWq4dLep14f1KFAjTRCeXYPywLaJCra5eKOrN1kO:bFOcpwMwgmWEyKFMEOYawLaArXKCh
TLSH
T1D6E2B2F698DB8977D99E4B97A33E2D129DBCC153B5884994FB890D0CCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9ef991d52536519246d1ce7775ecc2962a7c72775ce2c331d593ce82428998a3
MD5 268e3272c7529ea1cb858360e89bcd27
SHA1 508ab01985c6e51358e0ae19a4ca17f1cde4b61d
SHA512 1dce0f9753f5cd09c73006f76239a30f88781f587ce1053a331a4199a2c6cdf1ed1441907d1277ae76c56eb9c6f70299b33930a5041d70e4472b2c7c1b3eaacb
SSDEEP 768:bFFcpwMwgmWryKFMEOmjXbK/ozJwLaArXKCh:Ow1WUEFXbKQzJwLJD
TLSH
T17603B3F988D7893AD49D6B4B973D2D2298BCC133B5A84998F7950F0CCC6607FE706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fb90945ae530f3a05a372f830ee1c8a9ef1f4ce9c90691ddbae97d30bb89da66
MD5 24c769905a7f236771bb8e873611c2e1
SHA1 08fd43bacf9b4b0e02a67edab972b3cc67d57654
SHA512 da4a788a4ae6fa9144837caeee0acba91e0df8c02e300a10089a21ee881ce4738cb46f44ac2a013c00a17746c62b6401b3f00467cc719dd9f6581a4410b862e2
SSDEEP 3:MsEllllkEthXllkl2zEBp:/M/xT02zSp
TLSH
T1024404047FC00515C5001331405DC3700370F4151531574F355504177DCD5700C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 005ce6b91becfcc1dda94e3c7e77db25b8b84cd97a2afb70f48491c9f979a01c
MD5 c609ffd365995fbca899298e7ed19799
SHA1 1a2a2563157e3738347e1d128bd5fcd6d43399b4
SHA512 ec6173985751badf24d15d28144836b276c8d6fce8ac4e4e3f2f8d9cb472fed33ee5bcb3ccf493a281804d4926b7430d52dc665637893c6c4d4738d54e5476f8
TLSH
T1514131E14C3D2AD5D5BD1A6E748B34FC96DCD729F4A4353D6825EAC40A7A21C348443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7608fcbb0ba3a4e5c1d0826b618a18c5e1036844e16b19ae74b8e5cca3074d0d
MD5 7a0d24ae362f58a9de67961e30bee875
SHA1 ec5fd80627e9173ac39541d34db62fd66f774a89
SHA512 7d58ca0dad6cec1fa28e77a5169caf077ce433f250dd7d47208679ab2e6e274dad57a9c573c7f68fe1439f48a9d27555e3cc95e72cdc248a205a37024e11989a
TLSH
T11E4142D04C3D2AC5D5BD1A6E748B34FC95DCD729F464343D6854EAD4067A21C348443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a9dd29e5681d212c1e5c11a820870fcec832893b93f1eba15f2e27ee73b71402
MD5 241b8de1609379f2ccd5716f743c8d73
SHA1 aee6777358eb30ae12f522db5ef0b0c0f89dc3af
SHA512 4bbef0ed1f84ea7ca7eb8c498e41b13a1d6896b343db483e6bbd2993b5fbc8af0f44fcd027d30149c85ff500c86e8d98ccdaa154771325224bd37396fe4439d6
TLSH
T1CF414FD04C3C2AC6D4BD1A7E748B38FC96E8D729F494347D2854EAD40A7A21C748983F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8e4a8eedeaf7ef9ba22398a18938a6268ed704925f7b93f5832039d1c15515c8
MD5 8ab18e4bc77d7736203e8db72f0264f1
SHA1 9a8a1938f6da2082a444c734be52a5997e9bb8cf
SHA512 cbbdd2b4a2d47407201be3b31c5ac0c2bf14f3089878ce451ce714f49ff9f1813050cb48920d1ee28ee70c3b1022a17e6674368146074d6f608e2d8196df3e7f
TLSH
T178414FE04C3D2AC1D1BD1A2E748B38FC96DCD72AF4A4353D2825EA840A3A21C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3e186456e893a79f40999842041bedc30b9c93d34a68a043fae62140ac79228
MD5 eae16bb3e0089d320e6162402adaf053
SHA1 99c018747d850bdc4d545d1245732b0a4ec393bf
SHA512 8b82f4950047441a1e183b698d9c6b2a9c531875b0a306f9d0b8178054aa366b31299ac6f4520373a9c8bf220c4d6359ba28f2054bafbb3169c393b15a579519
TLSH
T1284160D04C3D1AD1D4BD1A2E748B38FC92DCD72AF4A4357D6824EA840A3A61C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

salinewin1.5.zip

Path C:\Users\Admin\Downloads\salinewin1.5.zip
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin1.5.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\salinewin1.5.zip:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1004695208\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1708895988\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2121699993\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2121699993\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_274610703\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_274610703\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_542391799\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_78611458\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4228-1336-0x00000000016B0000-0x000000000172A000-memory.dmp

Download

memory/4572-571-0x0000019F1BA50000-0x0000019F1BDC8000-memory.dmp

Download

memory/4572-580-0x0000019F1BA50000-0x0000019F1BDC8000-memory.dmp

Download

memory/5368-1181-0x000001616A960000-0x000001616ACD8000-memory.dmp

Download

memory/5368-1180-0x000001616A960000-0x000001616ACD8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads