ced3fca2130d60e1ddbb6f3f31c3ba6f433e88540c87d96ee9f0e4f4503da409

Analysis

user interaction
yes
max time kernel
135s
max time network
135s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/05/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OP Auto Clicker Installer.exe
Size 1.2MB
Sample260516-llbs2afv4j
SHA256 ced3fca2130d60e1ddbb6f3f31c3ba6f433e88540c87d96ee9f0e4f4503da409
MD5 63844b5f673eb0619a45eaa1877ad403
SHA1 97dedf85d45dd52297190ef6fea16d0a04f94ce7
SHA512 9c55770c070d9802374ba77f9c96ec6691f21ef66085db0930dc31becbb1e47be9b2c1adf004d86f0585d7a07ebe0f853f6a7b755f73c180f30ad0403add9235
SSDEEP 12288:5LKKMLRtx66l+Tac0RDffXJjyYp2QoNHSy5viczRuWGu0g1Ga97pU+DgGfXJjy8X:53Ml+2DR7BWYp2Qo44RuWf7rNBW8p3Z
TLSH
T1E6555B8127FC0939F7B70B79BD7A68210A36BC395502E69E054D592D18F2F168DE233B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	OP Auto Clicker Installer.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\ranked_dicts	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1534995079\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1534995079\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_381035345\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_381035345\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1126818298\manifest.json	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
4436	OP Auto Clicker Installer.exe
4436	OP Auto Clicker Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134233978340261857"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{833117BF-F1AB-49D5-AEF3-16C2AA18D213}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	OP Auto Clicker Installer.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	salinewin1.5.exe
4976	salinewin1.5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4636	4436	OP Auto Clicker Installer.exe	81
PID 4636 wrote to memory of 5400	4636	msedge.exe	82
PID 4636 wrote to memory of 1388	4636	msedge.exe	83
PID 4636 wrote to memory of 4696	4636	msedge.exe	84
PID 4636 wrote to memory of 1388	4636	msedge.exe	83
PID 4636 wrote to memory of 1388	4636	msedge.exe	83
PID 4636 wrote to memory of 1868	4636	msedge.exe	86
PID 4636 wrote to memory of 1868	4636	msedge.exe	86
PID 4636 wrote to memory of 5252	4636	msedge.exe	87
PID 4636 wrote to memory of 5252	4636	msedge.exe	87
PID 4636 wrote to memory of 5232	4636	msedge.exe	88
PID 4636 wrote to memory of 5252	4636	msedge.exe	87
PID 4636 wrote to memory of 5232	4636	msedge.exe	88
PID 4636 wrote to memory of 5232	4636	msedge.exe	88
PID 4636 wrote to memory of 2376	4636	msedge.exe	91
PID 4636 wrote to memory of 2376	4636	msedge.exe	91
PID 4636 wrote to memory of 2376	4636	msedge.exe	91
PID 4636 wrote to memory of 3132	4636	msedge.exe	93
PID 4636 wrote to memory of 3132	4636	msedge.exe	93
PID 4636 wrote to memory of 2328	4636	msedge.exe	94
PID 4636 wrote to memory of 2328	4636	msedge.exe	94
PID 4636 wrote to memory of 5996	4636	msedge.exe	97
PID 4636 wrote to memory of 4852	4636	msedge.exe	100
PID 4636 wrote to memory of 4852	4636	msedge.exe	100
PID 4636 wrote to memory of 4852	4636	msedge.exe	100
PID 4636 wrote to memory of 2364	4636	msedge.exe	101
PID 4636 wrote to memory of 2364	4636	msedge.exe	101
PID 4636 wrote to memory of 3568	4636	msedge.exe	102
PID 4636 wrote to memory of 3568	4636	msedge.exe	102
PID 4636 wrote to memory of 3568	4636	msedge.exe	102
PID 4636 wrote to memory of 2708	4636	msedge.exe	103
PID 4636 wrote to memory of 2708	4636	msedge.exe	103
PID 4636 wrote to memory of 2708	4636	msedge.exe	103
PID 4636 wrote to memory of 3148	4636	msedge.exe	104
PID 4636 wrote to memory of 3148	4636	msedge.exe	104
PID 4636 wrote to memory of 3148	4636	msedge.exe	104
PID 4636 wrote to memory of 1876	4636	msedge.exe	105
PID 4636 wrote to memory of 1876	4636	msedge.exe	105
PID 4636 wrote to memory of 1876	4636	msedge.exe	105
PID 4636 wrote to memory of 5448	4636	msedge.exe	106
PID 4636 wrote to memory of 5448	4636	msedge.exe	106
PID 4636 wrote to memory of 5448	4636	msedge.exe	106
PID 4636 wrote to memory of 4296	4636	msedge.exe	107
PID 4636 wrote to memory of 4296	4636	msedge.exe	107
PID 4636 wrote to memory of 4296	4636	msedge.exe	107
PID 4636 wrote to memory of 732	4636	msedge.exe	108
PID 4636 wrote to memory of 732	4636	msedge.exe	108
PID 4636 wrote to memory of 732	4636	msedge.exe	108
PID 4636 wrote to memory of 872	4636	msedge.exe	111
PID 4636 wrote to memory of 872	4636	msedge.exe	111
PID 4636 wrote to memory of 3724	4636	msedge.exe	112
PID 4636 wrote to memory of 3724	4636	msedge.exe	112
PID 4636 wrote to memory of 3724	4636	msedge.exe	112
PID 4636 wrote to memory of 4976	4636	msedge.exe	113
PID 4636 wrote to memory of 4780	4636	msedge.exe	114
PID 4636 wrote to memory of 4100	4636	msedge.exe	115
PID 4636 wrote to memory of 3356	4636	msedge.exe	116
PID 4636 wrote to memory of 3356	4636	msedge.exe	116
PID 4636 wrote to memory of 3356	4636	msedge.exe	116
PID 4636 wrote to memory of 1980	4636	msedge.exe	117
PID 4636 wrote to memory of 4744	4636	msedge.exe	118
PID 4636 wrote to memory of 1980	4636	msedge.exe	117
PID 4636 wrote to memory of 4744	4636	msedge.exe	118
PID 4636 wrote to memory of 4744	4636	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\OP Auto Clicker Installer.exe
"C:\Users\Admin\AppData\Local\Temp\OP Auto Clicker Installer.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/XPFM2K6GPV72CR?ocid=&referrer=psi
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2e8,0x2fc,0x7ffc99f4c188,0x7ffc99f4c194,0x7ffc99f4c1a0
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,5443217314354127874,10268088367010387571,262144 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,8476393994010690920,3935012798816020655,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,8590852365801853274,6073078933706042069,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2802939141423449563,6335606239783005582,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13386553019331468248,2812274240805656213,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,11557742412491143737,10338663635265672912,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,8136809185655561880,13364961306135217748,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3551455627931942971,17967173306239119887,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16145648623980331475,16530558255960126058,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16145648623980331475,16530558255960126058,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6276,i,7133367675948423971,6653165581576390031,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,8473676860432581416,2131521156410298226,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6076,i,17630451302967267491,4850848438665984691,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6712,i,5473375100163780549,258431067301376172,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6808,i,15918521590071168604,6033427165862489844,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7008,i,9445859011765994597,11991053994693769778,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7304,i,7627216539174183128,6521564983256283399,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6556,i,2317580845218911328,17512529210359714638,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7116,i,2726227721897373217,2853017930202691882,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,1751352915060940499,16327187395663354056,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7044,i,11285789681248315084,16272341378071269126,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,16540682746870162750,14675327794675250184,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,7293896442138479937,3844942760475710620,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,4048511387703949950,15075036250264161633,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:8
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7328,i,11273308779990258491,1638255003640519643,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,15432431175021106096,3345611509585962221,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5984,i,14003782563498612009,2638508678107739026,2097152 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,16076667541951224207,3369708027894401353,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,2239020804291220847,12253668331802375199,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:8
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9485283285718013410,1715265022766967122,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,11073234742064689072,12661570026413619550,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9217503814291661637,10245147540622023268,524288 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,18114432402482699086,6602020750154004708,262144 --field-trial-handle=2336,i,8211479630105027591,15258265262724078505,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5548

C:\Users\Admin\Documents\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Documents\salinewin1.5\salinewin1.5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Users\Admin\Documents\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Documents\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x51c
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4925046b98b24c2f42b8fe7d1625f7acf4fa147250c7dbb684eb8b5594d8081e
MD5 3dec6c3c6b78acdc47cecaf6d58ddc67
SHA1 6e3e67d539d40ccd0e8f307dfc7d0af88a6f5e1e
SHA512 0a59f2114d3a18385a658b03dd93c350c4accd24006b3d45d7fc3cad91f9fb1b4fda518b9228ee13cb25c44c372ec792d779dbe2aa0b6347f3f7bf9a3cbab890
TLSH
T191E022EACCB198370CFD0B18A0A10746E795239B3B80498B363C82088FB563B818381C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 16KB
SHA256 2df1098e7c34bbb8c3315268c28a66603fbdba7f5f8309950d1808ff877badc8
MD5 3d15fac4ca79a55408ca7fb29c5cb856
SHA1 9f8b739e1f5b5000c70bde81dc5520f761899643
SHA512 f438d8f1375b4cfa4023449a002d156bb61d065f0837ce4a4c718e6b30ac050236850df12b4a8842ba2a6778bb74ddba6d544896bc7c202bf4b5b62470ea5a38
SSDEEP 384:P+yI8VFe7gHjVMjltobNze5IQOqpBmidGwoY473ICZ+D1:PH3espMjlt8pSIUBmmEFZ+D1
TLSH
T13A72D00527104C43630FB758838CFDDE82D49D8E70927BE8666694DA5F5E9AF07B5051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 27KB
SHA256 97b5c3b18d66eefb5c1c8629a0a979875a7334938a121d940ae9eb4d4f14dc9f
MD5 f3c0878adb6e3d757c88acdf6cbcab23
SHA1 1e1fbf12f0f69a382f1c239ac3525b6582733a8c
SHA512 884ba4bf171c912ba7f9422046a2e824afe386a0590d0eb4628314f83e165037cd8b5a88712083caf6164f343a1d0887ff2646d41e3a9313a7527e0761c5ac4b
SSDEEP 768:KU3SHZcK0jhwdklmvg1a9xYHGY2wO47HG:5zlwvlMHnDG
TLSH
T16DD2F150C15DA61BB72D1AE9CF5FC7394DF4EE80224F780656ADF06BDAB00115B8970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 77KB
SHA256 809528a288ef4782e57a1f56bde014e37c294c372eace981677f11ddd7b6e33f
MD5 69620d2c7dc157a5297c4cd238a535ba
SHA1 ac7a320948d7424172883d446733a9f4c5b971bd
SHA512 caface33457144457c5ba9435d1eb9a8ae29d595d9d37e4eeef41dea648bd3ffd0613eb22f641a3e1df2f6002985f8b32fda447a2ee1f9280110cbae633c1fb3
SSDEEP 1536:VAwcz5u++KgDhuLbtwS8a8Tv99uSmvXYJnj8BFDQWtQA6wdtW3Ul:VkH+TALbtwTakKSmvxvLl
TLSH
T1A37312B160C1116BCC3B76B168826C552FAEFC7A62737F03A79E696A613087353C8C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 18KB
SHA256 99d7b2c80bec67254c52e7593bb69053202050e3d676e4737e1d7b85f5ae4294
MD5 29f3e6a5c63f06fa9ea2c46de254ad96
SHA1 1e492d961433c0d69b331c3715b3d0034cb06022
SHA512 22cb1ee1364a9351257654eaed511a0e6461823b91c76da596f48df8cd66efc498a930370b70548690fa6853b1eba92fcb1a9e7d9070f4fd8431eb2f99450c65
SSDEEP 384:klMwoXpp4duygMKEY3PqUl8g0azxWKbyJlCSH2GU0gvbjE:kGvpp4QNMpUl89KxWUaYSTeU
TLSH
T1A982D07C8F1B8083C49B1342A5F8634FE7A9E0A70A541B53AE9745536276F26B14FD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 59KB
SHA256 2bd35e7a5d0cda6576419635674bd5751bf3da0c76fb890c6147dff01e9c157d
MD5 14d34d1138dce33dd9d854ebc90ebccd
SHA1 666f7106036b20420e97635c92c9651b833e7e2a
SHA512 cd39db0bff82b323ef194ea344bd8ac2a0ff8be65566f29a80e02d9d0a16308e5a1a4ce304cf02b65ce0a3559a31dfe571d3a3f941592061ba26a3cdad99418c
SSDEEP 1536:e8iDiCEOFEzHAAbyxVyi6iZMzBsfiInJ8oFpM:f7oOzVyLHzZMyffdFC
TLSH
T13553010592B32C403EE3496752ADCD58B392DA84439FF55ADA0186211D7E4AEB93FF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 efde148781dd6965d92b7395eee5c71243aeaaf1a3644f9abd85219e03f4b80e
MD5 475b1d20b6a2b3d4e4a03bcd7735ebb4
SHA1 d27850437992fef1ae54b2c83deb87b22df2d552
SHA512 5f405b27643a13fa168245054aba96ba70a4888686530dce6e68e1770f1dbdd12c014620307083d81c19d5bd6910287953d5dd2dcb462954872b86cac6e9101a
SSDEEP 384:djeoi4ouWmWD+WynL+EFqGoM1wOWnZIU1G2l9LTQm6ScvAUuIiERyKeXR/V+/qWi:daz4oR5DBynL+EsGoM1wOWZIU1G2l9L1
TLSH
T15542E858AA837D05EB350EBB9EF3491DB831826A39C30E6A0A407B75D8EFFA141015C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594be4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594be4.TMP
Size 3KB
SHA256 2b8a5ecb329e3436a1e09bd46ffa4962b2e842e72460279c6bb2296df0664087
MD5 235ba621237de0f0d07be47448bc71dc
SHA1 d75cbbfcdce648aed52d0d817712cc6bee4dd1d8
SHA512 88c0741967681bef6d46ce06e025ea016b833277b04a5dae80241f7561d3f345bbd752b70105c8e2cc02ca61a5f6cbacfadd8326ba75accb5d800ed55daeb279
TLSH
T14561F8FCCF9204A1F3251D30A1D2960E78B293BE7DCB4E42128038B568CEB25C555A6B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 448b3394a9d84762341618120008a09fc66d0163a7231063cb933baee207ba50
MD5 6d41c00928941b075f53c75d8e5873a4
SHA1 1bd06a0a70214b5ea736d90923921989baca1385
SHA512 4c8b1bc8d622cfae8f6388a873730f28422f906f9bf28222410a3d3a35d4c6d36627e6b9094fc9b5a5e3850888bac9e5eee095b20a1350c619188665d0ab0cdd
SSDEEP 192:D1nE1b3GHqhe6omKJa915y06b00j6VeG3Lc57XuLGtjyxRCf1Nbj+QdPQQcyyM8d:D1nE1b3GHqhe6omKJa915y06b00GVl3f
TLSH
T1C022A9F783F5466ECA1295F0AA18AF1FCE1D0556436C3C5A85E4AE0BD3F2471E142B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b3bb37b39d1fe235088415d08df54cfe567619b7dc21563696634e4b3f0376c1
MD5 7b307351cab8e1703d8dc320ae71eae1
SHA1 622cac2717eb995eb12b78121c7f0a4fd6588761
SHA512 f1b1ce396ed071eb11864e18d30eb454a32bc444a9c3f6c00240ae23543594b753d89155c418bf01dfae9802f7731cf18b3f84228c35bc62499fd5163d17340d
TLSH
T19BD02353130034B5977C2F83A055AC4FC72B20150445EDD510F0549C053146C1547540
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 7a24496660e2c397c9b1dd7bd519e5eaab7178b8ec2ef3b530c2983c0fc6b390
MD5 d3a5cdf6f64a56b894dcaae5d4c9aeab
SHA1 3643544c4d920e1c4dc3224dbe19d5e72459f3f5
SHA512 2ee63b659b0cd509b83f6a0c25476d41e2dde175a3525091adb1d48cb3a621cba54f9869d48898cea4a6174ad5c503a0312e79499c5f7743c81d9eeeed442e28
SSDEEP 384:sxZLnPF+m1n/f1sUHmZo5dbQjWGVNAwaCvHb/13/rJnetiCMz:sjPIm1n/ftHPdbQjWGVNAwNHb5t0iCMz
TLSH
T18CA2C852652489B7CDD6C519FD36BF62D7E81463DE504E8CAAFCCA0C04DA6BD2212C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 c1dc8d3b25b893213e18be226b1df2e74f6fa1aab9b72bdeacec48f6a3fa7ec9
MD5 1b8b44eddc89b991100fae4858134a97
SHA1 a673aa9e3a2b043d079a00b4ecd956e81eee9ae3
SHA512 2d1b79086540f99cc0b1fe6a6c14165060bc738de6d68bbee5e20ab9696804c97e9f9950bde7d759f235ea1dc620c5a68f29a82aab4d00f0a76032cdb3738f30
SSDEEP 384:sxZLnlF+m1n/f1sUFmZo5TbQjWGVNAwaCH6HbH1iE5XrjCnetgCMz:sjlIm1n/ftFPTbQjWGVNAwIHbAElHC0k
TLSH
T16FB2D953652489B78DDB8515F926BF62D7E81463DE504E8CAAFCCA0C04DA6FD3212C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d9644115fb8203489c4feab1cdc7db24f1b88fca65db199472964f91f6f98065
MD5 c8216d81ed4c1180ee92cb96348bad34
SHA1 d886c5f32567d037767a201b751ba406ced1875d
SHA512 35d86f037eb013c4a188363e137bf5a75b630c7559a6789ec2a62eed59f19cb6ad31a8382bfef565e15be7ce8ed41b0f6bb139425efd6f9106da289492ad30d0
SSDEEP 192:sxZDRQyMqZjK1Ml8M4n/f1sRHYZZyb5Cxodp4/8HW6+WNttG/lPcDBru15rIgjt0:sxZDFwn/f1sRHmZo5PhHby//njt0
TLSH
T1F972D8466978497B8CD7D619F945BB53D7F81522D6904E88AAFCCB0C04E7AEC321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a4f7b727a1a8ec558ca4eef7b3492137c509a1d0a26390b573ac89a44f67c9dc
MD5 d0b0168b2789db5fca1aeeab1aa541ae
SHA1 58b16d790c47a8d686dcaac6a02dbf5873a13e4a
SHA512 7cb77fe43dc6433c2a34d3e335dc1a532b5d54806c3606b94925b74c11c2b1808e561385f46dc1e9eb9d768e114f827d6ddce21065fae13dae46de43238dabcb
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVN6yVLlFX6Barox:P4E/aezEnC6WvCuFOu1jas6yVLfqBRVT
TLSH
T18AF20B3B6C0CCB7E4F844E9CEC2A7E9A6DE8018B5698899447F9841C03CA7EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d48562ce-0fce-4732-afa4-e8e5c45ecad8\index-dir\the-real-index
Size 3KB
SHA256 5d75df9d730100a98eb7e4b7168e1d06ca5eb101f30fb9deb3cf502aaa0ac1ee
MD5 1c511fe85f0a671fc9f5c889878b3fac
SHA1 64b02848c8a66451782f85dca8791fb315c11717
SHA512 fdab7f51af303888a91d75d5c4b3e24652e3aeb3317e55659c7924714398b5ca6bf740aa0d05dfde4da4650318676050907a8c2e852163154bb6bcfc62ca7959
TLSH
T128511C4D8D87156BC77806F264B10402737216FC7A404E03A8FD81786957B3A1CE9B3E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfb9d8ae-6c0d-4ab2-aa07-c00c885aaa4e\index-dir\the-real-index
Size 72B
SHA256 98a652a73defeebf29ec962d5d7d2a8713e0c00ad29784cb8bb75162dac4f34d
MD5 0e47fc951b7e9d63e1fb406e3055cdf5
SHA1 adbd166acdb454cd7d12f356111df6e349cb6b6d
SHA512 d6e532465be49f4d972c1cb0ec63fc8d85ff234686a45642c6dcce468c3b98c9efbd53e2493f608ca6e431826bda3bd1d5d66faf47afb35c03fa9755111c216a
TLSH
T14EA002109B843005D11771B1155307951300C8E83144231BC6920245DC548498D4100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfb9d8ae-6c0d-4ab2-aa07-c00c885aaa4e\index-dir\the-real-index
Size 72B
SHA256 c926e794477989e7c80e334c1e0c80d466daba5a379edab838d4c2e1a510d225
MD5 8d16cc801d0315f799c80fc514145e46
SHA1 f03bba390ecc947848aabc6cd8a32cc03054d0b8
SHA512 2de948d028a8b79f04646e74ee40d0af77f5512ac5780347f2a33c253d43429a9e163f44fe76086b5595520410a6034149dc6a66b53d3730de8d83022cf4fb11
TLSH
T1AEA002E606B21905E41612B62AD603832218C95443339B0943B0006DC864E49678701E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2ce4e04fa12bfc8f5b58f24b3faa223abcc80159d5759aed17d65dc415d9afbb
MD5 544035fb1ba4e69ca355e0e331e9ca9d
SHA1 77fe97f11ff1b1671da29c67adf478e71f14be9c
SHA512 b975b83905209b5d02392538c8c006b67c82b9413a4b1b9677a49cfefc2b17ad3c0190694f710aedce338dfe4e01429ce47b17e56227ad03846060b242fa1fd8
TLSH
T10DE0D8B669E75E14EC6FD3D52472949405557804D505EC4E242EEB83A0B17153409D71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\da64b4d5-44cb-4fe2-9ade-4cf253ddd7ad\index-dir\the-real-index
Size 72B
SHA256 2894d6208351d9aa4f2c554f1007d977228340a2743db302c611ca5705d280cd
MD5 f74a3dc0fccf68388723e18426067edc
SHA1 9d19dc3390240931e9c438c0d070fdfd037c3548
SHA512 2722763dcc414138f9445bd52a32e95ee0c42c14ea66d1bbc99cf5111e5ab368fc82feed94d0e6081138e70260f8b12b4c56f60d7bb9a171e021743ea6d488a2
TLSH
T1E5A0027059460B22D00DC27F15BA129C33214ADD4256871298E590DC8A595D04613012
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d740.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\da64b4d5-44cb-4fe2-9ade-4cf253ddd7ad\index-dir\the-real-index~RFe58d740.TMP
Size 48B
SHA256 2eeadca178e785b8f4578f0ca504b6ac54de4fff227077900cf8bad858eb9654
MD5 c300fc90a42a6b3065329fe31536f2f4
SHA1 8a0e08e7c8e3a20a660c776af25417801dfdf4e3
SHA512 fc4095f5e15105417a88732e949a191ea89eb398d0face83d09c5e1a2a2de7d0bc4303f254fd29ca017902664466c6ce6fd3db2f0714700f881fa1e3aafd345d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\f70865d4-6736-4775-8b1c-a3442958c10b\index-dir\the-real-index
Size 3KB
SHA256 778f735c0b2bd2538243c8896cde633183fc3aa9470e550fcd9f00c8b8043787
MD5 48e5651f5dd3edb305908ba8c8ac5708
SHA1 e341de1a5dc3e72748e246504e000556bc413767
SHA512 a9ef4eebb1a331201e83673f1366233639ba606f2b54ceb4b0a002d09056b9c5490ae29f56a3fe9ab4ebd45aed91b27e484dec4a3a6fce8ba0098fa1923a7421
TLSH
T1887116C9AC7A8B61CE2811FE35BC100BA5884BDC1A953779E5ACD220B20443E7BB4DA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e579.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\f70865d4-6736-4775-8b1c-a3442958c10b\index-dir\the-real-index~RFe58e579.TMP
Size 48B
SHA256 cacff34156550d4a72dcfe60871611938a7423977d7fd2168161ec246c27638c
MD5 d3be8ceaf8464559896a8ab765172fd5
SHA1 35a4b3227908086873da8b06f59401de578f1ece
SHA512 c8fec7ef58308ccaf97946d5853a4492c582ddb041a3e199e5ae3e493522a744c54ad15e3663b0f10168f939263b870424e37d3f87ba4ef62a43739c6b4d60d1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 f25b747f20c85c8749abdff46cb0fdfbfaa7a9b504b1933c62f38e37f1dce419
MD5 0ce1e091eec384552081762cd4fd35d3
SHA1 4c9f5cc5031d7fb867852d07fe814135aac80a8a
SHA512 8e107926ffb6ecee4af092ed47bc60baae939788d45d80bf6b9bbb8f9c589a4b9536212ce1ef39103249d4f888a4cec404079d1403e8b500778360759a663881
TLSH
T157E068523272A111E7B15AED0A90EA9CC83F2E475AC0CF690081700209BBA2B9993F13
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 bb2976bfc37a19615929403cce1d571a90757f45b26e6d94a85f18b67e80616d
MD5 76de2ab8fe7d115590792069ae7de235
SHA1 8d3ce728597a414f435266dbefb76a3b3544837c
SHA512 2abee8ee57c649de170877109b3a950ecdc38d1b526dcad512e85648a5d41d264ab194a69a5bde1a52219aef54cac14cbcacda4e1b77fcda8e6f9fe06c27a801
TLSH
T12AE0685233B26111EB7156ED0E80EB5CC83F2A435BC0CF6900C1A00208ABA676893F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588901.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe588901.TMP
Size 195B
SHA256 b965709268377b3fa55197bc4096c1f4f281c4ea84ec603e44769d9169e12ea8
MD5 9694c9abb9c10eba7dcc753f1d15fe8b
SHA1 2f92c29020eb007e80aa8f7707bcb52d3815e0d2
SHA512 fb9bef3b8426e6f440a745b9a85acbda5e1d717b34bc0a31a06e74cb71d8aa3bc4f36e650488e7cdbe1f1ed791529b6ca338f0962e138dec73632b65f0dccf07
TLSH
T1ECD0229291311001CB6056A24E11E2C9C46F1E871AC0CDA84086B0810CBA2674083F22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d8d06efe9745de9d10ecc81b541b17d20e664c0aab1a8b8b5d8968a6a72c1b10
MD5 d10dda24d010c46d02ace62b1b5901ab
SHA1 d52d17b00abc00ad8f2f51a6a0c2bd6014456518
SHA512 ed1ab25f3ef7e8c7a0eeb2ad4949826694aff1dcc8083d3fe962b9f32afd4fc159bd76beeeaaa9a4c6331b661c7057585598cf0d89a5f6e790525c8525a22c0d
TLSH
T1C2B022038AA0A0E3C228033EC0C228CC3238CC002B3E2020C0FC08B8E0BC30008A308E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f920.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f920.TMP
Size 48B
SHA256 58f90b9bef0ed33307267b409e04f9f3a8ed54f401602de8104873ccddc55ce5
MD5 efd96c182ffeac021d8be4431036342b
SHA1 016d1b2cbbd8530a476779c50fae69cb91099469
SHA512 c1a15b7e76bbd2d415d9526fd11319889e4e0e2452406421a16071f5fb31e04cc4349b9708fee84cee299cedc3747ecb46c5dbfa1758dba4726631fead455df1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 96e44793b709bef1a533f5335e140c358af3ba1fa2e92aa50f3ac142f3d65352
MD5 babfbd9fe717a2ae23ed35b4f3fa5b56
SHA1 c4a9932448999b1977a39180279610cfda7a587d
SHA512 bb816a90f14c1901ca1b34b7ae35c37ea027ece6d7212c3c4ad927f8327586070d57c045808fcf6e10b0d05bb16e38cdab88424fe5f2c003ed6ec6c735b5e364
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAH:8ptDYDcfvNR1ANAJLfq
TLSH
T1A3B23C17713B065238BF2508A6979A379E4231A33418E4EF7BB814A61F67E215CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0bd5d7f6ec2124fa6779dfdcb9b301ccd2ef61e2f2708718e2e7c9927cef7ea9
MD5 602fa2e74d8159f224854c3c577c9e39
SHA1 64eb6721d123199c53d28888809abee9f7e3b353
SHA512 48a3abcedf9391d54e927d5fc0384bc311571fd6ce1d801eac7f505d1c4f67597b37f8075438fcdb45ad8c87505cd7ec9c6239e59ababef7828a5db89ccf0a2b
SSDEEP 384:n8iF9CcmyWCBsNk8TUNTUlI4kHxLDcYxU1JBfpGJy56ZfKr0+hkP+lFYS/H9NHyU:nFccpBTwgLxnw3GJyeSr0+hkoFYS/H9
TLSH
T132C25B32E8A5CEB7ADEA4B99F75A7683DEE00063CA8899D4DAD91D0C00D71DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 40aa7f582b5b5d88cdd7e0197574b46a811922a366769a0046e0b92fe0b9d4e0
MD5 91c9fd42fa5fc35454eda5e1567e7c92
SHA1 69dbc728557aacf084800f23104345d3d51c412e
SHA512 b76720a50a2f88c366f689beadb008ca744a1674e128955ad2369e11fe223216ad4045b2d8d8987664170f1676bbd2f8e3a27c581c1773297623a5c8d6fd5ce8
SSDEEP 384:nKiFcCcmyWCG1sNk8TUNTUlI4AHxXTOcYqpoJJBfpGJy56ZfKs0+hkP+lFYS/H93:BFncpUTwgPxCjLGJyeSs0+hkoFYS/H9
TLSH
T179E2C3F198D78977E89E4787A77E2D429AFCC063B6888994B7D50D0CCC861BFD70A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7eb9227810f315e82d26e72fd320ad3fc2e1281c0966a0b85bfccd3351ec0a63
MD5 246d29317bbd75e6472677bbade2267e
SHA1 159288010009d5ccc2c87bda598f25664955c145
SHA512 dd315d227a402a23337484c03f45bc2c01e173fdaf08e1d645ffcfb66e27a3721b727d3856039a2bc4aaa968d4f1e1c7299577cbc65d8fec16724589fbb84e57
SSDEEP 384:n0iF9CcmyWCBsNk8TUNTUlI4kHxXTOcYDpJJBfpGJy56ZfKr0+hkP+lFYS/H9NHh:PFccpBTwgLxC/LGJyeSr0+hkoFYS/H9
TLSH
T191C25B32ECA5CEA7ADDA4799F75A7683DEE00063CAC899D4DAD91D0C00D71DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f9234c611c5e17e26d2f78c26662448cd3dea6e130c4377cbd3d0267657201f3
MD5 241cf84eaf3dca89f79a312b53877293
SHA1 01cee59222fdddde6b2f517a8ace8af0d77d7de2
SHA512 05de4604777fdcccb340e5e502db781e74cf89984b3c439c8fed27b74104ebbe6d25a2e8340bb7109acf298ad453958a91442fba669391378fef29cebb985636
SSDEEP 384:nLiF9CcmyWCs3sNj8TUNTUlImk240DcYhp9JBfpGJy56ZfiiwLaJCra5eT7Hy/7k:mFccps34wgQ4MtfGJyeqiwLaArXT
TLSH
T1B8B25B36EC98CAABEDD69FD9F75A3A43DEE0116386C89AD4DAD91D0D00C71DD030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 79e46e3a13989b2678a602d1812ab9493955b5f3ceac7ce5fbea656d59a84e46
MD5 7a416d03698492da6779d8915a766b89
SHA1 eb21baa94524402c30e282897899abbe2afa58d3
SHA512 10ca8918ad4590d6b6491a0e7072f9c16548f42291f1d45ae800680ccd6026c307df7c675f618647aeebe155c8e47e747d356e5608202094d28af467028e269a
SSDEEP 384:n0iFcCcmyWCBsNk8TUNTUlI4AHxXTOcYqpJJBfpGJy56ZfKr0+hkP+lFYS/H9NHh:PFncpBTwgPxCMLGJyeSr0+hkoFYS/H9
TLSH
T127C24B32EC95CAA7ADEA4799F75A7683DEE00063CA889AD4DAD91D0C00D71DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a4643f70be58497b645f08e685167f8d8a733941186617d3aa48c9960b3f3e02
MD5 73a99071ec1914feb539aac6fe02b109
SHA1 88dcb25a74b32d4418b42200e2c6f30f11fc9b51
SHA512 26308c1d4d9fbaa7ac7f684ff9c0f45449d98c4a7d53084eaa864debc0525d66069ca507c6d54f6388797f8e0e5960c1ea126b5f188c0f871c550ce04fafef91
TLSH
T1E1E00103930092F6C32C073405C72B1427E3C03002F6071A49150564AC1360C1DB0F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58d627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d627.TMP
Size 392B
SHA256 0d4e58af7e8faa496ded6a4f967b59f88ca25bb8ec86993673692b1ec0ee1a1b
MD5 38ae88f150ee0d4c359e08f4c9ce25df
SHA1 290b2aef3fea384fe8f1228c4832d43ee47e1b02
SHA512 853c853b1a9b242a8afb5a85f9066bdf9a106bfa280d17b37946eee32d4da743ee69c6458f43d759fba5f15dd7fa916038398d311aa2649a16af5b565359615b
MD5 SHA1 SHA512

Submit Download

975165a2-e659-40cd-80b5-7bd64d39eb40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\975165a2-e659-40cd-80b5-7bd64d39eb40.tmp
Size 1KB
SHA256 9c409b41ac7230715d1ef7429ae9c77a5c9f711fa634d69157ae99755598e04e
MD5 9e933c004918fb042a18b8e95ae39b36
SHA1 8efb71418e382e9510596f87a89f232cd33462eb
SHA512 631c22c769e4f17653e88782c354125b269dbb8208645e50239522a327ac79c88525d0b9ff1e8edb7dd09ba15b5c893a0d245923a489b7bece075766fdb17011
TLSH
T1353165E25D381ED1C4FD0EBEA4C734FC48E9C32AF1A8307E6854D9A40729A0D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f165603242b81548936015d4c6e04bb98142665ea4f3c3c603ba754bdb2835fa
MD5 223c2de30603f00ccb83476d33ef9642
SHA1 57023f053cd12ac2fb562ff220350159cc7889e3
SHA512 51755a9dae8bee520882500a13223c95cf7af981cbc89da2bb44fb26ff993135c8d8ef5ecd7b253f1e29cc2228a7a955e97f9504fad0dbaa55abe0d9ce48cd41
TLSH
T1843142D1593C1ED1C4FD0EBEA88738FC48E9D32AF1A8707E6C94E9940769A4D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68a6318f163bd677043872870f29b9daae3062a1438c9bf26fc81664bedfb1f5
MD5 df15c3ad6b704ff72c57b91ace608477
SHA1 138474333236486162274f1640903c0aaae61e4c
SHA512 51bc78bac73a13c6ae887bf8bf3b5265329a9897e9933efea61ba711acc28b9ae56aff44d7a4721f829c06407be5eaeae3966166769b5646edbc4e20176ba80d
TLSH
T1D14166E15C391ED1C4FD0E6EA4D734FC84D9C329F5A4707E2C54D9940729A0D658143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebe452b0fb977956a64f265bea011c83c87a25c1171343c6f93aee4941776d2e
MD5 efee13647747cffce9ffa259785c3a54
SHA1 695ceec6e856efde4dcbf4e85a4ddc05616fcb2e
SHA512 7621fe01aeef1a925d8bd691e67fc7e27196ef7824f032029494e875b9b2395206c9dfe89a9b2156c58ad297c39f603c7a9d6e67a5e0af37d9d5b685d92d87e2
TLSH
T1A0413B58EAFD1048B3B76E16ABF7686D447B79333E46D59E00010E5F0666B40C972B33
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Management.Deployment.winmd

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.Management.Deployment.winmd
Size 30KB
SHA256 dd314ac319bcf2e9babe336c727a4051f9ee1f8f8544bedfdb4967e9d83c5420
MD5 0694b441b2d73b97a1f565deedd54929
SHA1 ade1af19f659c4903f6c9e2e42801b7687c69ed5
SHA512 4bfb0e90a4bd3e93c9e8135f9ed285c109d263bc64b4cdbffbf7a575b689ee576050dfaedf1f3abcebf16c781f0555a1cc0f5633b81d9605dca72300e795cbf7
SSDEEP 384:0HUqr8CpabLq152JbaaIWSjLw718FOrNE5masj2uUV1Z7HRN7ypUx72vH3rPR9z8:BqrC+2hpZNoFGX3l9zc
TLSH
T1E5E2D7869D94DF72DC4E2A3971B286513B3C73DF2702C797118DD8283D837896ACB266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6D9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6D9A.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

salinewin.exe-Malware-main.zip.crdownload

Path C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip.crdownload
Size 22.7MB
SHA256 4fbf3166276ba34535d95b647614b6176699c2a1754d4efe5420af1024283a32
MD5 6ed03eb12a6ef61aa39ad682a183dfad
SHA1 2e7e0f5ca54e2bbfb866e9f1ef9a3b1940f135f3
SHA512 ecca633f1c86933e7aa78fab9118f11a1878361434f43d8a714b47a6cfb17df9101f5a40068da199f7073b3e2bd8c9af0f1ca1cd23ae40a3907b102c21a66822
SSDEEP 393216:5WK1J5ZA1mZ7oIWBb/P6VyeOgMt29aiGwLYBkVfK1oFmVjVbVMXCacSx3wVqjJHD:5/V61mZUIWBbXkyeOh6a8LYB2SakNVeP
TLSH
T1E73733B5C6FA8CC5F470394721F586A17F480BBEC78189E5E90D3AB1EA9874C1B95C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3576-2191-0x000001FA12ED0000-0x000001FA1308C000-memory.dmp

Download

memory/4436-21-0x000002A0ED110000-0x000002A0ED136000-memory.dmp

Download

memory/4436-2-0x000002A0EBCB0000-0x000002A0EBCC0000-memory.dmp

Download

memory/4436-18-0x000002A0ED0D0000-0x000002A0ED10C000-memory.dmp

Download

memory/4436-32-0x000002A0F0F60000-0x000002A0F0F68000-memory.dmp

Download

memory/4436-4-0x000002A0EB5F0000-0x000002A0EB5FA000-memory.dmp

Download

memory/4436-19-0x000002A0EBCB0000-0x000002A0EBCC0000-memory.dmp

Download

memory/4436-3-0x000002A0ED770000-0x000002A0ED82A000-memory.dmp

Download

memory/4436-17-0x000002A0ED070000-0x000002A0ED082000-memory.dmp

Download

memory/4436-31-0x000002A0F0FE0000-0x000002A0F1168000-memory.dmp

Download

memory/4436-26-0x000002A0F0AC0000-0x000002A0F0AF8000-memory.dmp

Download

memory/4436-1-0x000002A0EBCB0000-0x000002A0EBCC0000-memory.dmp

Download

memory/4436-0-0x000002A0E9020000-0x000002A0E915C000-memory.dmp

Download

memory/4436-22-0x000002A0EBCB0000-0x000002A0EBCC0000-memory.dmp

Download

memory/4436-27-0x000002A0F0A80000-0x000002A0F0A8E000-memory.dmp

Download

memory/4436-28-0x000002A0F0AA0000-0x000002A0F0AA8000-memory.dmp

Download