8baaef876e070540392c13661a9a0c329a711b401e27781dfe45f1a96c029c5e

Analysis

user interaction
yes
max time kernel
79s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup.exe
Size 1.4MB
Sample260519-xe2xesa13z
SHA256 8baaef876e070540392c13661a9a0c329a711b401e27781dfe45f1a96c029c5e
MD5 1053d236a7440cde253fcb18427c9725
SHA1 93cecfcbda3a3a6c1d87d05ed45fc10cc8b4f867
SHA512 c6c787f7b2526dac8ee0185cc2a3be2ee01920d7c0f56e1725fa1edf47c24fe890fa7b24a4163bbd50cadc6e5eef4c0bcc05328d98bc32d96d98ee8dabb16d21
SSDEEP 24576:TRudie6sFj1FOJK+1V4ZzL3M8smOuspy2A2fAtYpy2A2fAt:re6IUKDJAbQ2AviQ2Av
TLSH
T14865AE16F6E402FDD1B7C279CA528916FB7278464730AACB03905A671F27AE44F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 3 IoCs

pid	Process
5512	Update.exe
4920	Update.swap.exe
1716	Update.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236900505119238"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{14D6CE98-2C6E-423C-B1D0-23E60A1EAA9A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6024	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3232	4260	msedge.exe	81
PID 4260 wrote to memory of 3440	4260	msedge.exe	82
PID 4260 wrote to memory of 2900	4260	msedge.exe	83
PID 4260 wrote to memory of 2900	4260	msedge.exe	83
PID 4260 wrote to memory of 2900	4260	msedge.exe	83
PID 4260 wrote to memory of 3372	4260	msedge.exe	85
PID 4260 wrote to memory of 3372	4260	msedge.exe	85
PID 4260 wrote to memory of 1664	4260	msedge.exe	86
PID 4260 wrote to memory of 1664	4260	msedge.exe	86
PID 4260 wrote to memory of 1664	4260	msedge.exe	86
PID 4260 wrote to memory of 2444	4260	msedge.exe	87
PID 4260 wrote to memory of 2444	4260	msedge.exe	87
PID 4260 wrote to memory of 2444	4260	msedge.exe	87
PID 4260 wrote to memory of 1540	4260	msedge.exe	88
PID 4260 wrote to memory of 1540	4260	msedge.exe	88
PID 4260 wrote to memory of 1540	4260	msedge.exe	88
PID 4260 wrote to memory of 2876	4260	msedge.exe	89
PID 4260 wrote to memory of 2876	4260	msedge.exe	89
PID 4260 wrote to memory of 2876	4260	msedge.exe	89
PID 4260 wrote to memory of 3116	4260	msedge.exe	90
PID 4260 wrote to memory of 3996	4260	msedge.exe	91
PID 4260 wrote to memory of 3116	4260	msedge.exe	90
PID 4260 wrote to memory of 3116	4260	msedge.exe	90
PID 4260 wrote to memory of 3996	4260	msedge.exe	91
PID 4260 wrote to memory of 3996	4260	msedge.exe	91
PID 4260 wrote to memory of 2008	4260	msedge.exe	93
PID 4260 wrote to memory of 2008	4260	msedge.exe	93
PID 4260 wrote to memory of 4484	4260	msedge.exe	95
PID 4260 wrote to memory of 4484	4260	msedge.exe	95
PID 4260 wrote to memory of 1560	4260	msedge.exe	96
PID 4260 wrote to memory of 1184	4260	msedge.exe	97
PID 4260 wrote to memory of 1560	4260	msedge.exe	96
PID 4260 wrote to memory of 1184	4260	msedge.exe	97
PID 4260 wrote to memory of 2392	4260	msedge.exe	99
PID 4260 wrote to memory of 1792	4260	msedge.exe	100
PID 1792 wrote to memory of 3728	1792	msedge.exe	101
PID 4260 wrote to memory of 4172	4260	msedge.exe	102
PID 4260 wrote to memory of 4172	4260	msedge.exe	102
PID 4260 wrote to memory of 2848	4260	msedge.exe	104
PID 4260 wrote to memory of 2848	4260	msedge.exe	104
PID 4260 wrote to memory of 2356	4260	msedge.exe	106
PID 4260 wrote to memory of 2356	4260	msedge.exe	106
PID 4260 wrote to memory of 920	4260	msedge.exe	107
PID 4260 wrote to memory of 920	4260	msedge.exe	107
PID 4260 wrote to memory of 656	4260	msedge.exe	108
PID 4260 wrote to memory of 656	4260	msedge.exe	108
PID 4260 wrote to memory of 656	4260	msedge.exe	108
PID 4260 wrote to memory of 4460	4260	msedge.exe	109
PID 4260 wrote to memory of 4460	4260	msedge.exe	109
PID 4260 wrote to memory of 2548	4260	msedge.exe	110
PID 4260 wrote to memory of 2548	4260	msedge.exe	110
PID 4260 wrote to memory of 2548	4260	msedge.exe	110
PID 4260 wrote to memory of 920	4260	msedge.exe	112
PID 4260 wrote to memory of 920	4260	msedge.exe	112
PID 4260 wrote to memory of 920	4260	msedge.exe	112
PID 4260 wrote to memory of 1716	4260	msedge.exe	113
PID 4260 wrote to memory of 1716	4260	msedge.exe	113
PID 4260 wrote to memory of 1716	4260	msedge.exe	113
PID 4260 wrote to memory of 788	4260	msedge.exe	114
PID 4260 wrote to memory of 788	4260	msedge.exe	114
PID 4260 wrote to memory of 788	4260	msedge.exe	114
PID 4368 wrote to memory of 5512	4368	RealSetup.exe	116
PID 5512 wrote to memory of 4920	5512	Update.exe	117
PID 4920 wrote to memory of 1716	4920	Update.swap.exe	118

C:\Users\Admin\AppData\Local\Temp\RealSetup.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Users\Admin\AppData\Local\Real\Update.swap.exe
    "C:\Users\Admin\AppData\Local\Real\Update.swap.exe" --swap-updater "C:\Users\Admin\AppData\Local\Real\Update.exe" "C:\Users\Admin\AppData\Local\Real\Update.new.exe" "C:\Users\Admin\AppData\Local\Real\Update.swap.exe" 5512
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Users\Admin\AppData\Local\Real\Update.exe
      "C:\Users\Admin\AppData\Local\Real\Update.exe" --cleanup-swap "C:\Users\Admin\AppData\Local\Real\Update.swap.exe"
      4⤵
      Executes dropped EXE
      PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\FindConnect.xht
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffbe01bc188,0x7ffbe01bc194,0x7ffbe01bc1a0
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1848,i,17907525964136844942,2416377903438588893,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,359180497626389290,1869885251146647848,262144 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2548,i,1613698979391588528,8621953741834940236,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,7381379212190769846,1960812081871490647,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,9421011020551253298,15779908387964052436,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17308823818653781914,11728523959494102100,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,7262649273930620906,10228806049210326228,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4380,i,11135025040539762849,11346581167583789180,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,16742148303714241758,3532724664968304844,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4428,i,8558325490187857978,14995267728252046117,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5488,i,7598758411950568379,1682663880618348579,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5596,i,9849641404152330003,16117039898957802084,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5604,i,14251543397162596344,11398832789629953268,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6140,i,1874702883982711353,16063806983444533122,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6140,i,1874702883982711353,16063806983444533122,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6188,i,5291735752082023536,16749031805847449196,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6264,i,11751834322604500013,5792896487102274102,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6504,i,17287906216811879869,3122254967297252615,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6576,i,731785056522510169,8962319461873750737,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6432,i,12921727517656945441,898443465072866659,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6412,i,240363507686839520,9708332912785972664,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7000,i,1456163452234622742,14160456374315542927,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6592,i,1682736608141483174,7520517691178721772,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7272,i,8487109750747063027,13652955944494586110,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7428,i,12863672233294792836,13049868091471802442,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7408,i,15052800158033529820,16905296784208280297,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4316,i,1429892106255474576,10795604763833441310,2097152 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4320,i,7523832278477866729,7252624992816936515,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4636,i,8266412462571862514,2370838299222187383,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4812,i,10079006715983233452,16777900396359620909,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4568,i,12726774412907560977,1510861661866942784,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4540,i,8900977183143300780,4429986729742814302,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5488,i,4047629532629673039,4689630259032835407,524288 --field-trial-handle=2276,i,3995503117454445656,10652239344855146276,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3416

C:\Users\Admin\Downloads\salinewin.exe-Malware-main\salinewin.exe-Malware-main\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin.exe-Malware-main\salinewin.exe-Malware-main\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:5560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000470 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 b882ca2baafea13ae5e7d8426c272408c9a29492947cff46b177092a8789fc22
MD5 e108a0031771bc703d39382910420dcf
SHA1 78d43e2e64ae01d7f1267233f272fbf8144461ce
SHA512 975e6f167927025928ae5c804924f750d4d4de3a1b34dbfa88ed01e3881f6c69dbe05a12b4437e11edebb7be31d2a41920c2f19b7de1521e933101274d22bc92
SSDEEP 192:kJoH+8gOdyF5B7eQAsCRa1uJbNgc0Do98U3X2ZZ+641T3wTxaH1jhhoh/Mbo6Cyb:kJoH+8gOIF5B7enpRGupNgc0Do973X2C
TLSH
T19132812909822313DF9430B698E11F53B63063DF86079FAE13F9EAB9D662FD4C879400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58eba3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eba3.TMP
Size 3KB
SHA256 b644673a866b15726873951568ab23cb9437d2b211d5445b902c8ada8a1d5a3c
MD5 222925d852f9e1c29e2d2fd4b42e0aec
SHA1 379d96aa8a6fdae90a675ccb20dca7bbf82cd4a4
SHA512 75181a25599945dd803a40b24482f2ac6c1af17a2f47dc411d2a6443171c561431672ed27c575b1b7857e08f630d82bf2b57ad4d2afd862e50120d314873a47c
TLSH
T1C671397A06022613EFA130719DE11F42B6B182DDCB93CEDE5148EDFDE6347A5C92E014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7a3543c3b08545589c6c8c283017d35e21370fe67d3ecb1d522adb4c51b5dfaf
MD5 48f31810c79421ae1d5650816e603d20
SHA1 b824e41ee6587dcfec2383055e751912c140d8cd
SHA512 4dc2f2d4e1c6f24ae453bf4d1fa03f6b1ff5fc86371493bc0a44494b5825bf638d7e7c186b1434765266ddea7fae23cf5ef9f9ca4b15b5af14c2f54ef0e28d44
TLSH
T132D0222327A830F5A57C3E81446ABCDFC33700A83883DEE610E0A89D053946C1B4718D
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c80e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c80e.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 3575a62fd655faf4beb5fb6f15931d2c519478792ef6fd259973c05d9e6ece58
MD5 3c5aaa850c11ec0c2132be1d87510ad6
SHA1 de4389bde134be75288327ed1317aac2b1af24b5
SHA512 8366d42531b865ebbc901c137113b4d4d011ab4af75c3101769f190090106d08c2edef233da5b70750884e47227591321198d132e9d4b228eb9facc02b8938f4
SSDEEP 192:sxZoQUnzRmyM/jK1Ml8M8cB1W/fHssgZqRBfbKQoBdps9k4y1q/W6+WNaakoH6pX:sxZenzwEm1W/fHssgQmF+/b/E/5CSJhR
TLSH
T17982D752692489778DDBD219BD257F53D7F81462DE904E48AAFCCA0C00EA6ED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 53c518020edb9544e8c09c193e051a8438fd924315609f3c65dfa68a64441179
MD5 f6bcad5338d791a7d950ce83aa5d9481
SHA1 fa87d499d91a79cc9765734e4b2cf56e1a667fb7
SHA512 571197fd0e820daf75eea572f1a3d1e3d91bb5884b7eb91b4e9354325edebec58560812bfd86f8f50f60dcdf884711ad2428d2aa1c1b62394c6ad7aa4716f3ec
SSDEEP 192:sxZoQUnRRmyM/jK1Ml8M8cB1W/fHsbgZqPefbKQWEBdpjk4yF/W6+WNaakoH6prL:sxZenRwEm1W/fHsbgjmW+/b/E/5CwJhR
TLSH
T18C82E852692488778DDBD219BD257F53D7F81562DE944E48AAFCCA0C00EA6ED2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 beecd790a33c45b8fa87477a6e4ff425a2d1e7ef61b38f7fd876463ac87ecba7
MD5 6da60b93bf201341c09e53689dbaa27c
SHA1 a7175743646c9a99b39c89e81623ee0f5fff7f65
SHA512 179383483706f76dec9c6e0031d9ef5364582972bfe77d578eb34762940b2fb9cd874069087868e82e35a019cc0de85a29fddcb2c155428ce3345993e06a9494
SSDEEP 768:qKc0s8Ww2CU7pLuL4/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zK6OLl+:qKc0s8Ww2CYE4/fWRm/JQg1u1jaKzK6b
TLSH
T1A8031B3B2C0CCB7E4F844E9CED26BE9A6EE8018B6698895447FA444C03C76EB55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 dd774393c38df2c846fe1d8e42fe494a959e48fbdd4ca6b60c12d050ebbca184
MD5 8749905c653ade955742e2c77fc9a542
SHA1 9b4569da4449d0944eb751144bf1e9a9949dc5aa
SHA512 fdfcb3eb1b98de9aee754f47403269ebf27a603d982cfb0b89a0c2a1c7954e2310ae8699c77d5eddd55d660c5ce16e0e7b9ef6a813ab833a9354717f9ce34049
TLSH
T1FAA0029402E20852E06222B167A701623215C9114263D79543E54044C970D49664501C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 f350ae2c81c3412f61edb4295b869234d29cac36a2bb74203a7740616dd069ac
MD5 1ac3746794bd67f6bea7317ad59b2790
SHA1 e37bd3078b37e50d2fa7f962063df4608d9e7e12
SHA512 1945763e2cbd15f13125b152a86f7d98c1868f1b8f4f7bbb9277fe37719c9cee0601ea10830a67b45d9b3c7a4e88751bf63203f66cf6051b54dd7c9daaa5f074
TLSH
T119A0022647C00006CC221DB16996425113C0CE182111970B40A21048CC534C04E9241C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 1KB
SHA256 16903751b2f5cf68c9c60cdfc72e3f20fb3090b14600cc21471a0064c35b4e02
MD5 4d443008bdf2561810d0d533a5be4298
SHA1 9ae6cbbe59e386ab0252972ea8a92e12badc06f6
SHA512 b7f6d82c0da4e794018768cadac3b9968a9a829f82abfba7aa9d6543fa05b4c0fd9ee2c6c9c2c338ad0b9ba9777d5aa3a7576d6ead6e35cea62eb0af1acc6d07
TLSH
T1AA31A54E8DA09C5FF85405B219B368A83770C9CC0B22A633987C11327D0636E0E9F2AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 3KB
SHA256 eb5acb889cb4594df10b23c738c8282cc1459adb5f359819d6029f0011466463
MD5 c85ce438b2cd5c52537fd47d05fed1f8
SHA1 94b747591e7d2b82e3fc7407eef44b714641bc45
SHA512 3670fe867086eb6eefe7de9b6bccb194b519e6a59b0f659fe79fac6ac806a8512421e360432b9215c6975c036806e5a761e93a81d5dd47be534f8b3753735216
TLSH
T14751FA4F4C5239E3C77C01B2547208453378D6EC2B809937E8FC85B9A44B31A1CB7329
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587700.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe587700.TMP
Size 1KB
SHA256 84657b0e1e82d1dbf24950020602a69cc4461a1252a6b5240ea79e175b20b47d
MD5 ec8c0a37bb9e3879b67c56bfc7aa9a6d
SHA1 b492800250f2df14058675c94ed118c6388d6905
SHA512 08091862d7259629783f774c3e12519379c2729fccac33c9bbb7aeb41d197943f57248390e50d450c8865ce2718c57aeda4052395a71263ef7851dabfc8297db
TLSH
T13131544A4E948A1EE88441770AE3E8B8733599404722B79794BC5139BD62BAE1F5E0EC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2c002bfd6132b1c857a80aa122dc2a59f7fe7c4c5f4390662d92b7d6fdacb19e
MD5 26316a9cff9b094ad5c3460bbd109553
SHA1 e6af4851ea35be95a5c23e0851d8f0f0f62a737d
SHA512 c8ddfeaafe805ee0d291a6fc8426ca11d299764203be363683222b80248ee966f45285fcb6537541f0486c1c7d7845cd8b66c03d899c8faf19320a800d4dcaac
TLSH
T1D9E0C0FB2EF31864ECAFE3C614B284F40900385CC080FE1F506A92C710B2365288BC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ce8d837dfa3e8afe30a20eba3a80f7620c4a8b73271580780b61ead861cca1bd
MD5 6e375db09e7f5026bec6b62311a56827
SHA1 41492dc5ded8daa48f810cc11cae5c35526f05bf
SHA512 d157872195c7556088b1a8356f0b938488df85d7e71ee86fd59c52d66efbdcd9babb6e04a12c781b856c3dbd8af999fe4602f506bd855f877959cf9b200dd873
TLSH
T150A0025BD2543141C3102774A0454284B26188E79606237180EA9755F8E13448152004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca6f.TMP
Size 48B
SHA256 f2ad1e9c9c3555f1caf8e42bb976e7d1dda004c9ceb7c3e0116f340a3e1e1881
MD5 bb63df13673f7422f666ffa9246578a5
SHA1 9114d6b19ecb77e6a752262eb7e5bb8c0d9688ba
SHA512 564b35c20d25b1662b33c966de3728481c8ec62f118f32a936785bb18c27bff511d1d5786447428992b81ab9d2a23ade68bcd60a128665cbb499e9846f6fbb72
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 707698d430213821ced88c0c5c49942d01e6796a2d05f58fb1bcdff42819ea71
MD5 db4f05c61a4694d193e224d215d8985c
SHA1 31bda3b37723a8558fc37546f4e16a704e2856bf
SHA512 ad55a2b6b9e198baeb069b23af0ba0d76767817c013a8a0161c224ecb70b93782d8c731cf6ec54af58a26484c83cd06551a9b68c77b46144a5a2600655394180
SSDEEP 48:Kc0I7K1Ss3yF9IVKuIo+UIrKFicvy9zIVKY8AT:Kc0AK1Seu9qKuIJUQKFi2ezGKY8w
TLSH
T10AC1309330B606063C7E3B4CA3958B1A4A4171637518B52B7BE906B61E3FE185DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9635ca46-3caf-4547-acbb-669425eb5fae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9635ca46-3caf-4547-acbb-669425eb5fae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 4c34429692adb999c3e058755eb83d0884e4cfd2dac8e1a4187411799f5ee876
MD5 ee7b72d90aa5d7d6843b75ad08231339
SHA1 277fc7fc7dbf1f4b1830e75242485dd3febbd25d
SHA512 0f0d8b2299f21514cd418ac1120854db13015ac553710f1870ab756e4c30419425389f340d25a4a4cd8afb92e5410497d711c27e823217c60add9729a75d13f5
SSDEEP 384:nMiFGCcmyWCj8ND8TUNTUlIlavTuG/IaqDfQ/u8YiusP+7uW2E3ic4gayyj9n:3FFcpjqwgFW/Ci1Pkl2E3uLj9n
TLSH
T170D2C5F198D78937E8AE5387A73E7E529EBCD06379845984B7940E0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c15e8aff6ed34979026ef31ef5401bc9ff1acc531c58269034ee5ad84d3f6111
MD5 0a5c83c9fd054307c6a6964b447be860
SHA1 794ea76c043ae65a4bad6a62b4d9e3a4308d6b78
SHA512 7f6d165e9af2a34c13c8c348430e1ee60b8701b77f31976b0678dbf64c7c59bf5ebe315c94da1a7197b164df7f75af0bc4153b56accabdc42914b347426981e2
SSDEEP 192:XGNv6jCQmiUyVoI5f4SufoPxzY3Sus6+X+hNSnXKEOU6:XGNv6q9efju8YiusP+A6EOU6
TLSH
T1A502F9346C68687B9EB36E45FA8B37135FA4212BAD812F44CAF81F0C00D769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e7fa6ac60fa87ccecd2f593821628bfd20837a07d52fd222a325cd7fd6b41ecc
MD5 ee883906ab5e5caf28c6cb99b6bf7add
SHA1 510208623eb1ad5c661ba6b0eb570a8cb1b46e66
SHA512 371c27765d696e1bbde393b38861d401c899095eb13b36b064c910e9e3c018d6881844c0188694c623886e5c5591a56bef5874cb0ca271dc93eaefc711972688
SSDEEP 384:nECcmyWCt8NxevTuG/KaUu8YiusP+7uSE3ic4gayyj9n:PcptkzCi1PkrE3uLj9n
TLSH
T19E826C715C795C73A9A67248F54B36639FB4207BAEC41E58D6E89F0D04DB288270BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 4b5f1d68d4177a60e191e47debf6125fc3e600d6cf6f62d28fae6a58efc848de
MD5 c9e6fc25712808d2a459c445effac847
SHA1 8849ef0b7b84bf2a42cd295a715f2bdfa6085521
SHA512 76db05d0b1d5784fe98b541064d9859974b77e8e7b1d5ed276842990db1d03e3dfc4bd09b63eff620dccba283696cd9b65f55ff362e6cc1dca1d559b1e595238
SSDEEP 384:nl8NxL/XTuGpOKaUu8YiusP+7uSE3ic4gayi:ls/7xzCi1PkrE3uz
TLSH
T1C3623B755C39AC63A9B66645F64B37639FB41077ADC42F48E6E89F0D00DA28C2307C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b29504319e6f9c7675636bcaf6df4de287d9171bb166360e7d25233cf52bf712
MD5 f01cf55759096cd6696513b9fbe84a18
SHA1 f6211123ba4b9681b682410308cd87d8cfd16c01
SHA512 99e4d5b1c280dbaa2fbdafaa6d72a9a7286172745ab501c1f1c18543fccb7b488dd5481d681fe6a09ffa849b32a6588fa95e0f20cd53e03244d40de619a7bd4d
SSDEEP 192:uugM8NxL/5Q1y6g9dfQmiU1V1D54JSufoPxzY3Sus6+X+haSutMLFhY/x/E8e:nl8NxL/5eGXNmUu8YiusP+7umEpe
TLSH
T16E4219756879AC2369F76645FA5B37639FB420779DC42F44DAE89F0C00DB2982306C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7942f0d59ef2f37120fee9bfc480d801c37f44e0e0c5e71849e9a8ba3da5af6d
MD5 0ac2531d575e129b5175654ceecf8913
SHA1 dac2dee84119b376eb0a3f59855bb360daa37203
SHA512 b2456cdd553d9a2487663ec695a45e4fe492d6e24e0e1bdf13b520106b6e8ba77c92a18386c75ce397c3a3b9f92b6ce70a2181ba65901454b5b3d6c441cc392d
SSDEEP 384:n1CcmyWCt8NxavTuG/KaUu8YiusP+7uSE3ic4gayyj9n:UcptkzCi1PkrE3uLj9n
TLSH
T10F826C715C799C73A9A67248F55B36639FB4207BAEC41E48D6E84F0D04DB288270BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 785d1da554911c9781426bf33e3df7fecd15b177467ede79b6918fc55f0154cf
MD5 b5a377fd41cef42729df39ccc083a5b9
SHA1 f31374a232a83e20dded5b1b2bf4892335e27daf
SHA512 90b95f7e610d9cf3325d866d06ea611ba1a5ffc9a2b4af13f2b7bdd0ec2263e6cc845d507ccd2b70c979afe96439a5c50f2e4a15d5027a22911a99c8712c8051
SSDEEP 192:XGNU6jHQmiUyVO5y4SufoPxzY3Sus6+X+haSutMSOMY/x/U6:XGNU61Xyju8YiusP+7u7EU6
TLSH
T11912F874686DEC276DA37654F98B33639FA52037AD856F44D6E81F1C00DB68C370AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 20aefe9c6aaea20a1973025233aca322fa4d91fbe3e1d3bbf641212a241ecfc3
MD5 6042f5de5756a900134b3882d70cdc90
SHA1 d09abe1a089bc5d9f07691db4ffad763a92c9f31
SHA512 8ba52a19120aa0fb818ab36d6fddfc48c0f164739546a5c360d8f615fbdd5e155b5b74f5e0a0631c8b37cea637ebe1180cde777e26285eb99a347e063e31348b
TLSH
T13EE00206A30081BDC03D07310047273016E2802101F106150A6412542C176001F30FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589f19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589f19.TMP
Size 392B
SHA256 1f15b77a5309bfab3f01c451f845f3e895960f56b5525da284283b6b4b08e9ae
MD5 3762e73d2cb2f0b53490736f5e8daaa2
SHA1 fd7f84928ae5c58755394dfa3c6d1df4940ce512
SHA512 b2e49deebd04c8042a3c1dee95d4be97549a8be735153f47578a315f917f4807c603841f80c73153d07461124f92a31689b3faf7f48e0e0bc6e11a7757bd661a
MD5 SHA1 SHA512

Submit Download

109c1fd6-a9d1-4115-bced-40d3fb058a44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\109c1fd6-a9d1-4115-bced-40d3fb058a44.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 723KB
SHA256 42d49a89868821e2c996363c6486e8cdbb3b1fd6548dbd5f5184790f2830105d
MD5 1cf58c0c3670f0a2721c1cde63bcf538
SHA1 cc7d7dcb3d5eb5c430c2f0e4d20c1770de5f211a
SHA512 3509498213c95832c43b4abcbdff5306b81b85294abe3aee890c7442d712d9e82e8b58d7e46b23e3800f5672b768d78f51c925e387f63e8ec340705b1ea21dc7
SSDEEP 12288:wde76xJ00cSZFVue91V1WXKgNNL3M8kKH6mou8LuSJMpW3iXGA2FfAt:wJK+1V4ZzL3M8smOuspy2A2fAt
TLSH
T155F49E16B6A401FDD177C279CA528916FBB378464730ABDB03908A5B1F27AE44F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.new.exe

Path C:\Users\Admin\AppData\Local\Real\Update.new.exe
Size 721KB
SHA256 dc544edfbc1c672a639f5f1b2ca544cbf97860f48474faa94cd22724605d2b04
MD5 dffab97c4d2bf5c6c0bbaee255cfd64c
SHA1 847ebdd03e71c06e1b2c09f0425a5700125d2af6
SHA512 a354259eb84c503d022590aaa148e5d153473533a644a8f2fe018fda3db0a0111f4d3a9b569c29bd5e13cb560f1951b5edd19f678cd1f157a4f44d2841d81a26
SSDEEP 12288:pg/Ms4ts3mf+dgk8gwrKY0uqBuG2iLTCfQZ3xiJMpW3iXGA2FfAt:S8sAll/qBdnBZ+py2A2fAt
TLSH
T1D3F49E16B6A401FDD277C279CA528915FBB278464730ABCB03D096672F27AE44F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.2.61\Real.exe
Size 8.8MB
SHA256 64dacafdd8b16adb06a4c4baaa7c23651dee920e9cb7dc8f89b021426ca84b4c
MD5 0f4dae0cfebadac259a6d3189bf07304
SHA1 7d0d22e50326873e02230a0406be7072673af9ba
SHA512 6545d61607e810049def0044b4e3f676ab43d250501b6c6fe1a508362e87c63df401278b45377f50ff406c739a27e933861dd1e1da3cb3b3453ff515b31e3063
SSDEEP 98304:Al5XAA9LaKdtDq4u90A73qUEUi1ZeigRo2O14JJ8I4XieiZUHXHPi8g7jYXh/4L:sz+9k2M4JJ8vXREU3vi704wKcjUhC
TLSH
T15B96BF07E29181E8C0AEC478C35BA637EE32BC894535B29F1BE44F512E26F50AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-0.2.61\bin\Real.dll
Size 2.0MB
SHA256 f7814efd0f46bb0310ae8eb22c62b76676027ebfff7c46b985fa663e70db7422
MD5 c5ff405aa1b3759f09f6283aa68d45c5
SHA1 672ec4c7c0f7b622cd47ef435f7c571cd9c82afe
SHA512 2be583b7853edce0da8305a0367963b8768faf0f0d4240428fb11dc5a657fcde3ed8c329a53662c3b1cf0b3903446ab9ebd6a49c86c6e0b106f29247ebe8e0a4
SSDEEP 49152:oPpsSZWGf2o70Am2Etod4aniO2PTPP3f7PbbTL3Hn/PrrDT/3vrrnbnDPrbTTzXK:oBZ5f06F6uGfcROSZX
TLSH
T129959C52D6A27A8F9B1BAB3B12B03D052F61A9F03B8D654F45D2DB3802C3DD76B4052D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.2.61\bin\Real.exe
Size 783KB
SHA256 c351fb08bc7a5781a5bc3ced6d820d405d06d3e7cf206228569f9ca3df4eed16
MD5 161f54cc8fafeb480f71487c7912a722
SHA1 ecf4cd00f07456f7cc255403281e4ead85dbbeae
SHA512 0e7ca17ff8472ea9c18c0f637fa0159fad10e709cdf3553d32b216d8dbbe4e03d0e216bc7fdfdbcce7da955d88e481c6ea6fd5207b0258cd67c60f6c74b6f370
SSDEEP 6144:E1EUYNySU+Xpu6HolPZr5t7PXkv7aXYelMf7UNQQNm7+5lhKyw5W7z5m7u5DLhXb:E1OGihe+9C7z96bTyKh
TLSH
T17C05A62D92FAC4ACD903A374964AC1B3C20FFC991D312AEB0955CA7575225E5BB31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.2.61\bin\luau-lsp.exe
Size 11.2MB
SHA256 c6c601b62544754adcedf6c11f0f568ce094c6a745deed18385cb031514cdc72
MD5 f927bf2f60203f090d63971bb6732430
SHA1 b1fc40a32517fe33227c2e5b3ce06e44331fd9a3
SHA512 fb9f2fe27cbae3a1db1e1b56b886517c5a62fff51efb07f06bdd761f7871898da60a14880bba5343be05d9da3123d2503828040186908fd5e590e6d28b37b2f2
SSDEEP 98304:oXNMfnrrgR/0RCItDU3TwC346UMjEr1TQW0Jlcd64AQQojltE:osng10YItG4ZMjEVQW0PdI
TLSH
T136C67D37229C02D8E0BBC07D8A8B9D93DBB3340903759AEF05A045565E5BEE95F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fb978db-8ab4-49e3-98a2-445983441144.tmp

Path C:\Users\Admin\AppData\Local\Temp\1fb978db-8ab4-49e3-98a2-445983441144.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9763346-dc05-4b8f-b11b-b859e4a0e72a.tmp

Path C:\Users\Admin\AppData\Local\Temp\b9763346-dc05-4b8f-b11b-b859e4a0e72a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_1272254982\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

189076f6-0069-4ad4-9b6d-67e7be5b62e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_13869299\189076f6-0069-4ad4-9b6d-67e7be5b62e4.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin.exe-Malware-main.zip.crdownload

Path C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip.crdownload
Size 22.7MB
SHA256 4fbf3166276ba34535d95b647614b6176699c2a1754d4efe5420af1024283a32
MD5 6ed03eb12a6ef61aa39ad682a183dfad
SHA1 2e7e0f5ca54e2bbfb866e9f1ef9a3b1940f135f3
SHA512 ecca633f1c86933e7aa78fab9118f11a1878361434f43d8a714b47a6cfb17df9101f5a40068da199f7073b3e2bd8c9af0f1ca1cd23ae40a3907b102c21a66822
SSDEEP 393216:5WK1J5ZA1mZ7oIWBb/P6VyeOgMt29aiGwLYBkVfK1oFmVjVbVMXCacSx3wVqjJHD:5/V61mZUIWBbXkyeOh6a8LYB2SakNVeP
TLSH
T1E73733B5C6FA8CC5F470394721F586A17F480BBEC78189E5E90D3AB1EA9874C1B95C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin.exe-Malware-main.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip:Zone.Identifier
Size 183B
SHA256 2ffbe9258f5c575a512adce4e2d7e70d3ef4aa69ab14e587f67612dcc12ba752
MD5 f7391fce9cc6a0e6175cc5ffec20072b
SHA1 5ceda763c05a0d904bc94fcc5fbde5858e33c037
SHA512 0cc49aa85051dd3b6ff9ddf990019e100d11cca61dc6fb0caf565e2650b398d86395860d6e9d8876e610b4a2d26767db37b7119203c9f3411b8cfcb9dfb9f569
TLSH
T12DC08082694046D91F1930CC55F8580DE0473045C8545DDCC5C13477D9804FABBEDA0A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads