2f8afe579fe34df3044179b5d0995df0120a4dbe0e7a9695ad666b0c13bfa57d

Analysis

user interaction
yes
max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/adorn/adorn/color_palettes/kitchen_cupboard.json5
Size 1KB
Sample260623-ww3plsfs41
SHA256 2f8afe579fe34df3044179b5d0995df0120a4dbe0e7a9695ad666b0c13bfa57d
MD5 a41cd18e607f66b214b7516ddf394a67
SHA1 234003a2a8ce5e2218255670e4bed80b79dfcd31
SHA512 1edc7c674fa93aa4fc950aa763c0392d2614b439998e135dbe097a08867b511d5e1babc3fb7682443c3398997284a5a5c08b6ef3b668720a35e787126b243891
TLSH
T169217421AE1B2A5FC347AF9831B60A9605DB0FB445B8244CE4EF35DD164E8C7D8BB049
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_714439899\protocols.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_855530966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5952_714439899\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267122784381308"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{04F0635C-0EAF-4357-9790-A72E747545A1}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1396	OpenWith.exe
3524	OpenWith.exe
1324	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 2396	5952	msedge.exe	91
PID 5952 wrote to memory of 3016	5952	msedge.exe	92
PID 5952 wrote to memory of 3356	5952	msedge.exe	93
PID 5952 wrote to memory of 3356	5952	msedge.exe	93
PID 5952 wrote to memory of 3356	5952	msedge.exe	93
PID 5952 wrote to memory of 1856	5952	msedge.exe	94
PID 5952 wrote to memory of 1856	5952	msedge.exe	94
PID 5952 wrote to memory of 5868	5952	msedge.exe	96
PID 5952 wrote to memory of 5868	5952	msedge.exe	96
PID 5952 wrote to memory of 5868	5952	msedge.exe	96
PID 5952 wrote to memory of 3480	5952	msedge.exe	97
PID 5952 wrote to memory of 3480	5952	msedge.exe	97
PID 5952 wrote to memory of 3480	5952	msedge.exe	97
PID 5952 wrote to memory of 5684	5952	msedge.exe	98
PID 5952 wrote to memory of 6028	5952	msedge.exe	99
PID 5952 wrote to memory of 5684	5952	msedge.exe	98
PID 5952 wrote to memory of 5684	5952	msedge.exe	98
PID 5952 wrote to memory of 6028	5952	msedge.exe	99
PID 5952 wrote to memory of 6028	5952	msedge.exe	99
PID 5952 wrote to memory of 5620	5952	msedge.exe	100
PID 5952 wrote to memory of 5620	5952	msedge.exe	100
PID 5952 wrote to memory of 3580	5952	msedge.exe	102
PID 5952 wrote to memory of 3580	5952	msedge.exe	102
PID 5952 wrote to memory of 4144	5952	msedge.exe	103
PID 5952 wrote to memory of 4144	5952	msedge.exe	103
PID 5952 wrote to memory of 3076	5952	msedge.exe	105
PID 5952 wrote to memory of 3776	5952	msedge.exe	108
PID 5952 wrote to memory of 3776	5952	msedge.exe	108
PID 5952 wrote to memory of 4152	5952	msedge.exe	109
PID 5952 wrote to memory of 4152	5952	msedge.exe	109
PID 5952 wrote to memory of 5628	5952	msedge.exe	111
PID 5952 wrote to memory of 5628	5952	msedge.exe	111
PID 5952 wrote to memory of 5628	5952	msedge.exe	111
PID 5952 wrote to memory of 3096	5952	msedge.exe	113
PID 5952 wrote to memory of 3096	5952	msedge.exe	113
PID 5952 wrote to memory of 3096	5952	msedge.exe	113
PID 5952 wrote to memory of 3000	5952	msedge.exe	114
PID 5952 wrote to memory of 1904	5952	msedge.exe	115
PID 5952 wrote to memory of 2164	5952	msedge.exe	116
PID 5952 wrote to memory of 2612	5952	msedge.exe	117
PID 5952 wrote to memory of 2612	5952	msedge.exe	117
PID 5952 wrote to memory of 2612	5952	msedge.exe	117
PID 5952 wrote to memory of 5852	5952	msedge.exe	118
PID 5952 wrote to memory of 5852	5952	msedge.exe	118
PID 5952 wrote to memory of 5852	5952	msedge.exe	118
PID 5952 wrote to memory of 1152	5952	msedge.exe	119
PID 5952 wrote to memory of 1152	5952	msedge.exe	119
PID 5952 wrote to memory of 1152	5952	msedge.exe	119
PID 5952 wrote to memory of 5620	5952	msedge.exe	120
PID 5952 wrote to memory of 5620	5952	msedge.exe	120
PID 5952 wrote to memory of 2656	5952	msedge.exe	121
PID 5952 wrote to memory of 2656	5952	msedge.exe	121
PID 5952 wrote to memory of 2656	5952	msedge.exe	121
PID 5952 wrote to memory of 1296	5952	msedge.exe	122
PID 5952 wrote to memory of 5116	5952	msedge.exe	127
PID 5952 wrote to memory of 5116	5952	msedge.exe	127
PID 1324 wrote to memory of 1588	1324	OpenWith.exe	131
PID 5952 wrote to memory of 2332	5952	msedge.exe	132
PID 5952 wrote to memory of 2332	5952	msedge.exe	132
PID 5952 wrote to memory of 4948	5952	msedge.exe	133
PID 5952 wrote to memory of 4948	5952	msedge.exe	133
PID 5952 wrote to memory of 4948	5952	msedge.exe	133
PID 5952 wrote to memory of 6828	5952	msedge.exe	134
PID 5952 wrote to memory of 6828	5952	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\adorn\adorn\color_palettes\kitchen_cupboard.json5
1⤵
- Modifies registry class
PID:1736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7fff363cc188,0x7fff363cc194,0x7fff363cc1a0
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,2723872544166603676,3948006389951609980,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,15627165855903306126,7974424028762716892,262144 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,15106920985858467234,6469921614590570664,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,2554535494046000090,157077244102345842,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2164,i,14448781434166360012,7021929765177045571,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17733884303898036719,11517008551415794341,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,11355167730054543403,17055215138563976105,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,15212714771451339245,5701337862091827452,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11274169336163245425,14186721411407407124,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,10642888971864021827,17836443071669753446,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10975086709206620831,1205772478296656218,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10975086709206620831,1205772478296656218,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,7696600641434234589,11622210249806487688,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2397952913914113715,9115751168609447271,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6532,i,15259613388245343117,4423699208904064651,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5016,i,9339013648122770559,6732469832195145583,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,3895848659918795995,2482321773097122964,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,7345680002425569646,1475020476449360941,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,4324568890808983518,1427384483878911729,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5948,i,7755899291839091142,16376482181640540250,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6844,i,1248093053050873106,2196405058148912840,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6988,i,8935344467826485123,16747921466519599392,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,9757895852513653233,14646878964889417473,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7284,i,1518764163435533086,6965920278672039316,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,3563348825693066141,4998118108697773854,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,6867110565610821434,10216370779801340111,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,12292777983450145198,2625562810081219316,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6732,i,4011451858413877182,17163938626628990735,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4952,i,12209939960413256100,3842397637375176599,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5660,i,9982200571657789965,9254407397844521170,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,16907818826506691010,14879244701161742364,524288 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:6688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7784,i,6530290488689385955,14852766730869301987,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7880,i,15592003042941507118,17758583059717465677,2097152 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5552,i,7795380257079807033,5358634926969958364,262144 --field-trial-handle=2484,i,17161879363260021712,3833721797527567281,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5280

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\63476316-17f5-4f6e-b468-24b2873061f0_salinewin.exe-Malware-main.zip.1f0\salinewin.exe-Malware-main\README.md
  2⤵
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 256KB
SHA256 e3e4268545e49178c95c3ce577f482d929b4d3d2529002d227e1e4a4a4179020
MD5 9016673ada3309136cb419910553b486
SHA1 d3699bf16abe8771e94bbf5562babee9a3146e42
SHA512 6c590fb10b73d27e6fbf1367d969a6367f71574fd3bd1c2858ffd03711c16b508b2488cebc2234413534cc883ce09f9028fb2687100d92b26c6eb3e515fce367
SSDEEP 3072:ya9c1xq7uKCqFGJGXkg4RrgrBGryyzDFfQdJhz8WzJcjfV:yec1xq7uMecQWrGH/FAJxxzJcT
TLSH
T1E444F1A5FB41E283CF537FF1F06C2EB30B6956C535D61E0B0EA25C10A099A15E72F52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 256KB
SHA256 adb7287fc26c0521616bb69adf7889e9318a0c1e00398825c51c01d2a06f4c05
MD5 81d44a31aedf4fb57ee9d944ea23dfe0
SHA1 9c1bc458e74d05c7ae5dc59dac6cc4a6dd67c43b
SHA512 d17ddff7df8373d8fb4acde11c43d00ee9bf701959e330cd4a14c1558a83ad445aa6263b3ee98e5de3daf98b431210ee149e7ffac763c6d50c06e93126b00a5f
SSDEEP 3072:zANhizEqXhXHWDRs2JZuEDBy2MoZLyBa09819SQql9jGdrTBvGoVR00I4QzUlW:zACcdZZJM2HZ+0nYjGbB00I4VW
TLSH
T1AB44F1B4FB829740CB036ABCD07C2E374B9A54E672C40E1B0B669D212684765EB17E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 512KB
SHA256 0e169dfd532e84c92cc907faf5b74f77c485659a069564f3fb4df09db5d7d473
MD5 33b8b8aad927d1e6649e19fdaf5819b9
SHA1 a629d5a71aeb436d6ad8b959291088951921d7e8
SHA512 f4551060dda057d499f4a8e7270af0bbd24ffb0f69331198e4975c8c911464aecbc11cabbd8bcb9a99f9ef059bc432a931f92083646e0f435b41238e68baf851
SSDEEP 12288:bOS45uyruFRW8uJOyPmhmOW2QJUVtVpSi4ky:aLsyrmWJJHP92QJUnJ4k
TLSH
T195B423565F931C2FC7FF2232F19BECC35A51A2AC20C82D35FBC454AA619171A9B285C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 32KB
SHA256 261a272a59c37a78d862f070fb5046ee6e3fbb24fa1ff88f7cf526391e368a10
MD5 91305babf6a79f13a1640aaf71897092
SHA1 a1b30c0aa9622d15b750ce317e5474512e826080
SHA512 49e97e649fd8a7e0cbd9cff9c294bb0a63537592c661ddff6743efee72f36f5ed8384f8d25439a3009a459f63d294a3ff68bde3b6a46eebb2f7b07cfc9ea8779
SSDEEP 384:oPvDoX7P0cAstJVAJoo5skbihnNWrhDB4oftmd/jQy8gsmw1adI:oP4AMtXHgV4m4p+mq
TLSH
T1B5E2E187C7052801C92F72B6548144FB5C866B58BBB53C14EEB91ADF8DD099E3B824D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 24KB
SHA256 2beefe7293101d64840c308506967e9e2a0b2a6c4500ccbb7871c1342f2894eb
MD5 dfcada20b4cda38d23f6fec8d0260763
SHA1 373ce141ff860592bfc61220e4b5c82480533d19
SHA512 d8b43808a8ad313a54f2418a2d74dcff9f02648519a7637d580e47fea6fa60e8a57c95e3f00643a33accd6479bf0fdba3a858818e38058775b9aa238761536b6
SSDEEP 384:3xbeyInNsrD5LZCzRFwiSmWR4a7tjVwlgtX/UC7duixIaILK7fjzUmcdq7+RCRHr:lRokgcvP7C7m3SBSIjsDkLYd9dL
TLSH
T1A3B2C6985582703CBA3B852167D8AB4C7234DC06DE3228EDF77B662E0FC67D642B3158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 68KB
SHA256 90e39936fa4a20f0fcdafc8ce17bd53e662b5ac7fe4c810b28ed5356b9da6d02
MD5 8b512e3b59cb89f3f306e9e69f799ab1
SHA1 e0a1c29cf12aa60249c80da1600a2d7778984788
SHA512 d5b39e2618e5cfcde62a34552aa24def071b21cea9913296d33edafc7fb024426ebc8e92550b40f0bb3231c8ddb2945538a7e6c0d4f308c7cdac7d5e53745b87
SSDEEP 1536:phILhlQU1HUf76Z+AGYguWv0KxwhT30N7Xw1RJiuwPy+R3zP5:p6Lhl/1HX9GjuW8KxwhYRXw1z+55
TLSH
T1FC6302008F370176B188A8D9FD49E3B6CAAF58E0914BF595020B188F7F5F8D1A55D2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 161KB
SHA256 7648d3b18fa7faa5225243999c24d6d8e6bcbac92ac4625c174154e4e1ee7467
MD5 014026e318488df97c10837df6d4a2e3
SHA1 6530b35240a993674c35d529483dbecebbf147d2
SHA512 dacda5375d0c3e5dcf3054671c24754488e1e5cc785e27c629164a65d0a4143de9f21b0021f13b1a2d9bc94b9e17096243badb20dbb40790c6c3ddd1a71b50fb
SSDEEP 3072:WPOEeoS8HiW0usTqzdll+5Lf2ohAnE/JFA2g2cc3hSuH8sDYSStXYt:WIbRW0VGJUiTnG/h1cEhmsk1S
TLSH
T16DF322693F2938E859E3B235C518DD4135CB48FAFAABF6A370D0DD0D943675A8282189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0f28a4ecefc2b4485454e41b09fe33ac8ed8ebe648956ccbd1dbcd4acee565d9
MD5 d31c1f24f3efac5e33e3d9a074f8bda0
SHA1 03a0da196f2cb7b3993dedf7ccf2412e91dc48b7
SHA512 26c051dc0f4985c982edc83d6582d67bbe7a2f395b5ce496bdc42ff4b4bd794043a0d2587834fa4c8f5643e4ae9ae1b5af67127937be4ed5f1ba93a0fc705938
SSDEEP 96:jQv/C8fpVMDUf/zJ2Vm/ZmVab9yRY/tz/E/+JT/Rh6vvBw7YKvL6tyQnviqs4TDJ:jQv/C8fnMDUf/12Vm/ZmVab9yRY/tz/m
TLSH
T115B1C89A92D8F823CFB4ACB250E20C6233711A1C67176F5701207BF4B9E36E287B5499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c1c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c1c0.TMP
Size 2KB
SHA256 14b41b1d648e77f66f99f14628f24b9deb3a1892da51a4e855da90a2fef77a88
MD5 2a73109749297c3d3e137a5f9fe2748e
SHA1 9d4d236c9cb9ff8a06b4f1990d5b5b521aac60c0
SHA512 62b7c59df9030a3de3f09f993524c4658de3478e9c2686787c0012212d6bd3d2becc6ecebdbd0567473ee4fe76fee3a6a843e05087cdc592389f3f502bea9107
TLSH
T1125181EC0264C821CB15C8F721D205A833B3984DBA07BE4057B5B3F8BE71B6581FD469
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e5647d2c991ee9a1c1be3162c5007768886aced0191fbfb320117db3a1e14de3
MD5 5603a4b8040bf3579a968f3c4ccbccad
SHA1 bb9b3ae67ee292bca08af5340d2f2bdf6eee9f42
SHA512 6e99883e10a2071b4c7c2246c3582097e103353bbae51be82153082402591c3b62d36e3c832f34131bfa39c7be2fe72275982a90553137f02a54e25ca0d48844
SSDEEP 192:DXFI5NNvj/JjCj202CjhUJcZcj6OiP/ntETjVjgGjgjhtjhqjh+jBPjcjUjA:DXFI5fvjhjCj202CGJcZcGOiP/ntETjn
TLSH
T1F6E1B1F7C7E4466DC91156F0AB187F2BCE1D0955436C3D4A88E4AF4BA3F18B1E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 86654c534a827d31f03837171c1078f2c44bf94d5e527fc05ba2926fabd415c0
MD5 fff91b23abc90d731078356a5da6031c
SHA1 cb56424cd280d9c46a2fdeadf3de0001a500a2f7
SHA512 e50a28b3a6f62281d840eaf215593173e09a93caa7420df22a0ed46ebafca7683033da5d156ab924784988dea9987562cd0ee9e392e56dcbeeb008a91568f4b1
TLSH
T13AD02273168430B9E5BD3E91906EECAFC33700204942FED610E0A8E939328AE090BA42
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 0d01c7df3b229a00594fecb0cc6e990ddcb937ad26c6bdacb82a454ce06b2ad8
MD5 48ca37099896a30f140f87fc9e242919
SHA1 67548f306e35b2575c7df521e71dacd1c4ba2096
SHA512 b254e2a0f8f17e45a89c02ab9ef3cce0c96437934062de76539be5cecc942185ee0e936f35bbbc4f6fc1c0ded4265695840fc2965ca28f5fd985721071f36425
TLSH
T155D0233315C030B4D55D3E91505EAC8EC77900204542BDD550D055F9353145D051F941
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 41c81acae9146f7e88e8040ff26522e97db13a05964de4a89e060bab2ce75201
MD5 d81cb3404d6353169de3104ed85b01c3
SHA1 a072fb3e8603c49e27ac5b5b2b04d77cefeee236
SHA512 51bf3d203427f0f15dc214ea42ecd01423eb8da77cd2e000fa544eb24c66be8eab6ccd19d202da5539ba5de87c00134cc38b974f17e5761d3190ce7ee3f7b076
SSDEEP 384:sxRgzd++Hm1C/f4stACwshMlW4ctB0/5hXc9/iYuTM:s0+ym1C/fuCjeTcc/59c9qYOM
TLSH
T148921A5266248977CCDBD618F9617F53D6F81563EA901F4CA6FCCA1C00EAAED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 83b986b18ad7dd33c41ee5c0a116efa6e591b4841c22e2838edc5497c39e8d41
MD5 d021441da62fda176886723a7fd57e92
SHA1 cdabb13f9d2e41f5777863a4d78009e493b32a2f
SHA512 c998f4b751f2455f6e4ef350aeb0fc50f8093c1dc686b5cffdfdf77d71f5365dc0bf60411c26eb2658e36af44d637bf4dad08f639af4ac6c7a9afb7392ef2252
SSDEEP 384:sxRgzc++G2m4C/f4stACwshMlW4cAUHU/5pd29/iYuTM:s5+Gm4C/fuCjeTcAh/5L29qYOM
TLSH
T1ED920A576524893BCCDBD618F961BF63D6B81463EA505E4CA6FCC90C00EAAED2113C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3e596a68b9a58318e81da90b5a44d6bfc5e59d0ad30662abf0d3595bc339ff60
MD5 bd2f6d479fc4168a4cdece58fd25f259
SHA1 39983f7e2e0d95fbeb7b1c0b4d1c606a0c3caeda
SHA512 c0192aa45e20d99b4aad5f131a80918e0099b274f3f718657953030bbffc455e343096f5bb1647e738fae915db3e679c8aae51ab14a16bf025c3b09e95dd9e17
SSDEEP 384:sxRgzd+mGOC/f4stACw1hMlW4cGB8/5wXH9/X:s0+WC/fuCeeTc9/5WH9P
TLSH
T1C072F7066668493BDCDBD318FA457B53D6F81563E6905E48A6FC8A1C00F6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e48845372f438210867a5c9cb8916a92f5ef3fb2c283028d75ed6d488c9c96dd
MD5 ac798d810f4a865917a38822978d4e9d
SHA1 eed05e130acd4426a33f06987edad861fc916631
SHA512 e2b9f786aca1c34002d3f92ca90205a35185a0a3d66aef6095150e60f61cb1a0312152d36400ef3335065b5466317893e0d7fb0e725efbcf5e31e0ce982baa16
SSDEEP 384:sxRgnn1+wOC/f4sKACw14B8/5QQ/MF9/3:sI1+/C/fVCe3/5QSMF9/
TLSH
T19D52D6166968593B9CD7D219BA1ABB53D6F81022A5D46F48F6FC8A5C04FAACD1203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6fa1d2e64fc1d009122e37b243c531205ddb7a38f9d8d4771bbff193ec71eb48
MD5 224ec5fbf54f2a98ab5f37311b47810d
SHA1 af25d624c5a3b503881705be5e3096e7f129f132
SHA512 9fee1ba283afad8f16febfa789e47254f6f4e4a66af6c028bedb7724a7f3b9bd8b59a77d14d34d71dd66a3c7d67c0b66bb9c965f50b2061fc4abe1002b5ac977
SSDEEP 768:L7sgp47pLuL7gxWgdVfGk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH3nSLrotAKdmY:L7sgpkE7gxWgdVfGku1jag3S4tAKdmY
TLSH
T12CC2FA7B740CCB7F4F800ADDAD197A9F6D6802CB9698CD8047FE981C02D6BEA52154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 47db211e7c0230e52433ffbd2662df25184f09ed2d5aabecaa7d3743a4f95bcd
MD5 90c218811d13823624e6b507d35d8c00
SHA1 2cfb6b8197232b68181f4f0b8ee1e5e9ac3de65d
SHA512 bc8fde91ba04e06f880994403fa36e4e9ff8daa8b49dd0427ebc4de1ccffbdd446ec638cc23924fa4eb46db40208e7db354926498890ca49cc228d84e8287255
SSDEEP 768:LKKgv47pLuL78xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEx33nYLrouFva1:LKKgvkE78xWgdVf7ku1jaXx33Y4uFva1
TLSH
T1F8E2FD7B280CCB7F4F844E9CED29B99E6DA801CB96D8CD9447EA840C03D67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5b7f2bff-5e54-46da-a81a-34a1b5839bbd\index-dir\the-real-index
Size 3KB
SHA256 a31b8b0f8d5711c11f8a80d4ed66eb3c30fb34ea1652c007e4105eb7ea3e3d70
MD5 645455dc53a8e3fa67a4acb46e3b7857
SHA1 825ecfa51ef252250d926224adeca4ad9dba8a74
SHA512 c1b6f1bd34f0c3b657b747297506177c50cea69c2e9e3fb14677f9809d89b6638ac6160b57321defd509482e8d6824553606c1a21c399bbf41817e623edbdefc
TLSH
T10B51B59D4C871B0AD97C217265B204482B76B8ED2A8C4E1334BC9538ACC773919AC798
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9984ed1e-415d-4fe0-a311-a5966054a105\623cd082b6202da0_0
Size 61KB
SHA256 68a5e3fa34f9b6a826d208c2ea8ffdd650f5fbdacccd09856a1bd0b73809720b
MD5 ade537a70846afc110fd01c46056d21e
SHA1 17efb1776d656a84ab902b34df858e930976eb87
SHA512 80f55d5be290bafcd210d122567b6a2d5662a3165f7045075afed1c74f9a5d59f6cbc57b05b85a6d4ff741eaf45ac7967dc85d4b3b75cdf6d81af0899080ad3a
SSDEEP 1536:/9uEE+BHKut3JHjvGEs7RONVIqtNszpRCXpHHPwqpzGi/A:/9U+0ghGEEROfFpT/A
TLSH
T1765328A7A2626135C7AD21D1949ABF00F21B17460844C9ECF0BD65913F18ECB67B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9984ed1e-415d-4fe0-a311-a5966054a105\index-dir\the-real-index
Size 72B
SHA256 91f45a76f91eb62a5e72ff8b10eb06b3ed09661520735cb41abdda23331c91b6
MD5 e2acf1b214c8f877eaebaae075892367
SHA1 b089ad2679f4be2d3bb5c0dea65d95d8a056f944
SHA512 bec2ac80cbb0f085d7f9bb5db0fb7a2a14f5d379e6bee13637e79e0e6a3031cb5c7741347a7596507b1a808650febaab6a12805ecb1dd58ea39803f72869f60c
TLSH
T12DA0021403C01003D012A2B826D741A172114AA0F262130582E84249C860A6D854300D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9984ed1e-415d-4fe0-a311-a5966054a105\index-dir\the-real-index
Size 72B
SHA256 e6466de60d56554177e02b1a9094aa0873525d62cc703c0f6c52e877c3cfeff8
MD5 db74a9958cdac1fc7f2cf9bd37f5c486
SHA1 9a40a973b58fcfff07713be87dddcd514f107ad8
SHA512 5014986be044216f498a84d89f5b118bd586c90211992672ace3ebf2ce9d407df41427c9317a5d7989eb57399a11af1c3f546d81af146754c141451672cecc10
TLSH
T1FDA0025402C8C103C42266B035E7116532144A2CA212130941D04348D8A49769543A4D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9984ed1e-415d-4fe0-a311-a5966054a105\index-dir\the-real-index~RFe592f24.TMP
Size 72B
SHA256 5335cff5dea9830860f4e06692ab3a753a145b2ca0bfd8b4d554249230d58285
MD5 47bdb316192d5805b4f86694d0b856b3
SHA1 30b12db3848fd4c431af7291bee13f7ec2f302e0
SHA512 4aee568e68450f0b2e96886843f8739987214713a187f2a9615e4b75ef2dbd770287ad441268707a9690d0a9869d235af0f337f1c2075190cb3b3a5f622fe7dd
TLSH
T1E6A0021103C04017C1222AB229D2066163288810B305560640950748EC608B04D4351D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6ca40db-b0d3-49d8-af09-9f06b9162ce7\index-dir\the-real-index
Size 72B
SHA256 bffdc0bc8ca456f428bfde66090719f991fcb56fd79b52f69ba542d1b6a3c854
MD5 32dd277f95e234647b4be96a78c4e64c
SHA1 4f59b29417f34c5570c779a245d3ff2a5212d748
SHA512 f821177a4bf523afa78ca5ebb17f2bc161cffc3e455ddd1ef2d75e21d22d9110e2866740a81dc645f2e64fa48f096893eb148d08ac4522d97224af5a2e7c65b0
TLSH
T1BBA00230095A7081C01A2AB361D2157033D4AC9511214365C0A1455DC8D13589509444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f7fd63fd-c8b7-4acb-8b05-7b239b1aa0ec\index-dir\the-real-index
Size 72B
SHA256 d9fdf2bc2bc8b7d8f3e05922b3f799f66d55a7ce1e032c8589c6c23992a98a09
MD5 416beef90ee766b821242349d4faebfa
SHA1 c8531deb12a92d4135d729a2399ade85079ecf67
SHA512 a5879f4c3e2a187c9bba63a139bc6f11e74305f4ff574f8433e8ab26e62bc7183bee166cb63baf8ababe77d7e7521abb97c4d7daf8b658467d411b79f5dc8ae5
TLSH
T111A0023C0DD74202D24C23B025C60DA032B18D2122490602C2D2207489DB2D0992354D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7c75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f7fd63fd-c8b7-4acb-8b05-7b239b1aa0ec\index-dir\the-real-index~RFe5a7c75.TMP
Size 48B
SHA256 5f02bfdffbb5b2db2108a01807df1d059e168bc4d6f388a80f5692b8d07d61e2
MD5 e1f1a32a25c56e5930da8f58d1a803c1
SHA1 ed8ef27353f144f6be5319b8f512e480d6d2a5bd
SHA512 1e0ec866b0a0294863c88b685ff3e609f6ed736eb9937d4fde1680975935c66bc74748efbcf8df275b2d0feb1dd1b8bc72eb40d81851ebbe5e393e5a8773a6f3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 0a3fc5964edb32cd76a44cc76f552e919f84775b57f3928e901da01db39fe2d2
MD5 093f7d99511cd75ee77ae174d8e6a882
SHA1 33fc47ef98cebeb956995788babb01b9ff14600c
SHA512 2aa74c413aa81b0aaa66bea3ed8f5ae60cd09150bc40a1a5748f96a295fe7ac8d937c2d3a07ffa381c7e5711d06b1c8f3fbf437ddaf03dc2e542c0dbfdd541ad
TLSH
T12CF097B23EF72828FE6BD3D320315CA40108BC604445DD9F1406B283D0F2218248DC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7853befe0252169f25349f9469b200f9bfce4ecdb54769cbf17671fb240e9fe0
MD5 3af56d168933606d07c7ab36d4f945e8
SHA1 e50c526b7b798596e733d32c8b44af791c5c2ea5
SHA512 5817f4e6c629409fc0bf0242381e242c421f1ee0355f341ed9a64d6039fca01b8c58e81e2e19dbff3a1dbe6504007782eef89824c6de6f0c4bdddfee821a3b25
TLSH
T142E0D8B639FB2828FE6F97D324325CB50154B8645544AD9F501AA2C394B235878CAC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 056a367e62be048940a65c5dc468021a9714e1be4815424a14e4cc727da3d81b
MD5 ed67e56b585d514acade6630f34121d0
SHA1 b033f198c69a8e64286b7e1ed7f61439499b5aab
SHA512 2fed6ee7a83b92af584da1d22d07ebe038021826094c3359d7827d88dcfd39fd3f63fd73af6bfdfb807ff19e273684bc5b7b318ccf5175e07a2c4d4240d1cb00
TLSH
T10FF052B23EF72828FE6BD3D2203158740108B86440549CAF1016B28390B6218248AC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 74c911d133381552f5801d3885be8e5c227f2a5ff7f1111fe56c20654be22995
MD5 04ca1067bc592ce55a8c48a5f7ba753d
SHA1 f271f0943a4037584d28d819e732d90ad77703b1
SHA512 026049c99d1f4611c41488e76b6883892362259335604b46c3c9594e54e6cff29fa50345e23b2b8021e2caba3f5cf15044ea8710e08a28991bafb96452ca7910
TLSH
T154A002A0924BBC53E41107757585D240F351E8150106132386D6E1ACBDA71445181141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592f92.TMP
Size 48B
SHA256 7c468b9132a460ba605481e6dfd51c098fe8966fb745cda8adc5e18397162eae
MD5 6a78b8a9390c9ee285d9aefa06fe958c
SHA1 4d9d2c180c0d79e64a7f11c047dcd758b6cd13ec
SHA512 be3bcd97f008fb2855b443ffac6dacbafaaa09202ef7cd02821e09fb38c1d66f67980fd04116910a9d5780136714cf34caaf50865ecc2afed450566a11fe1d18
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f3c64425bf59c5b1640905d1635269d160ee654f4f209a1474c1c323d2511cb
MD5 98554a0c24af4bb8b1844f1c39bdfa1e
SHA1 ae5217cce6755cf985d856e4a4c33332cf85ce8c
SHA512 0972e32b0d8d012349d2ceb31db88f5b83d91580452aef69e3040b52cdee621418618c1b0d083cbb0fd6f300d7e0199aa664e52c60f34f0e76f17935609cb0b9
SSDEEP 48:KcwIbKJycfyXtgx9bnrgHvWzISlgK91lzgh1wsGTNtyNDIRKgQ03:Kcw4KJyWCq4K7aamD6KgQs
TLSH
T16E91E301787D5A1129FE254CD5A0862E678230B37056A63F7BBD24F54D3BD040EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1343782-04dc-43e0-a027-0a658052b2d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c1343782-04dc-43e0-a027-0a658052b2d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8575e13b805b6693db741e74165e9db2e963c73cdc8d08335caf95600be63388
MD5 03541a54f822be642fc1031d230a1a45
SHA1 1329d2442a5e71c98da0e0e507f34b9edbe642b6
SHA512 1c3213663ce521493fff124ef7659edfd3869b504de85ea48919f7a88563918eb953c18327e9808520cceef83510edf8082c1b84dbf9d0f4b98985947a442187
SSDEEP 768:9XFKj+9pV3Jwg8BAmOT7s75riXYUsZUgb9eHcb/+0LvHa:9X9pV3+iIUsZUgb9sK/Hv6
TLSH
T1ED1318F599D7C937D89D4787A73D6D865EBCC1A374845884BBC85E4CCC822BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 16840a399c6b133fb18c57a220fb0c35c46f6ce23a2f7b78ddf4312c74b510d9
MD5 32c1573c3a307d313e84284a5cc16cdf
SHA1 420d7117af3c144a3b25a8fec1617ed73cc1e883
SHA512 ed86cbed94860b78498bdc06193151481d76d0f26ef9bdc9d0cfa35fdec9670eee8c4d3a9d5263c9a98c8f08630e88df270abff4e40ba11aa4d8444d8f595ff1
SSDEEP 768:llj+9v3DZD9cOT7g75riXYUsZUgb9eHcb/+0LvHa:lQ9v3oiIUsZUgb9sK/Hv6
TLSH
T175F2BFB1AAA9DC630CE593C5B71A76CB2FE401E394C52D8899CD6B0D09C37AD174FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 31693ceaa48b36d24021eb2644419e87d58e669f46bdf2995d5f452b522f9ac4
MD5 5173137ccdde5d510a2e76052a9285d8
SHA1 c84297d34e9a172dcd645befa29208fa03ed130a
SHA512 96c9674fb879984c735b9173826c516926fbbc4893ae3510edb43a5dbae96e10523af6f18cf03864297c3cc4b2ca09aefae59baf26e5775fd5b860fd3dda7651
SSDEEP 768:l+j+92V3fSD9cOT7g75riXYUsZUgb9eHcb/+0LvHa:l992V39iIUsZUgb9sK/Hv6
TLSH
T1F6F2BFB1AAA9DC630CE193C5B72A36CB2FE401E354C52D8899CD6B0D09C37AD174FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0ee4324dcfbe2fdf9bb32953142d5982ee13d8ecda8634dd3f1f86a97677f895
MD5 6371391ae76a9be7995bd7c6941d3789
SHA1 037cc438f15baf260d26ebfa9ea63b487ccc9475
SHA512 edbf8d00cc11fa27ed863ab6e74f08857155b048da1a37f0c2e27b047dc264348fbec43fdf3d757e18a421e73e28186c74874c7768ad467becf4876eaf2e110d
SSDEEP 768:nqjaeqD4MlshiLdMmJ3K4BcOT7k75riXYUsZUgb9eHcbSTR:nqqcjhIdMG3YiIUsZUgb9sK8
TLSH
T18103BFB9ADA8DC634CB697C5B75676C72FB400E384C52E9CD8C96B0D06D36DE120BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b7b970c299bfccc11c6bf235d22dc93c19a79248828e02b0c23f9a3ba1cd7eb
MD5 c8e746268759cbadf69a336b6321b1c1
SHA1 5e5c04cfd7e2f1d47481f1107df30eaa1af8d3c4
SHA512 b1d5e318cf15e416c7569ee5b6e11243600fd062c0e0d9054a42e06c6e3b1a4f0133675d55b13ba61066badfb64f5cf85401610b4599466b6c58039297d91dd1
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3nUIcOTq75riXYUsZUgb9eHUn+ApXTcHT+:ZkqcjhIdMG3nuiIUsZUgb9sq+KXP
TLSH
T17A03C0799DA49C678CF296C5B36766472FB901E386C52ECCD8CD6B0D02E35CE530782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fb2d506f22d9af17fd34d3900a9d07f6fad79340981e017f7559cf2126d9140d
MD5 2da09049fe72afaa67e2ebd5234fe7f7
SHA1 720bfed5cb37913c98cda339bd5914ef1123d201
SHA512 179e248f31dd35dca29f699edac7f3d59b13fd24c033adf7f5404b961ccd0fa13a3ce923e4d4d6e1ded4e98c299605fc2fc3e268c1194ccf88bda87825aa8d9e
SSDEEP 768:9XFOj+9pV3Iwg8SD1mOT7F75riXYUsZUgb9eHcb/+0LvHa:9X9pV3YiIUsZUgb9sK/Hv6
TLSH
T18D039DB6D9A8CD6B5CE287C5B719768B9EE001E384C96CC8DACC5E4C04C36EE074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3f2e904a6cc8d672ed8d82bd184cdd72885d186473dfe64751033a06c654e491
MD5 2322eaa5c41d0501e4dfb2ee32f43610
SHA1 81fd0d1b4cf026f2d568d638340582a75cec3171
SHA512 3c81b289cd4b9ab4da0da8c0c7d81156f14e5807f06149c4c10e55c2f3175b4054fca6703e8009f06e691e21876511557da1afb1e64c4d128021b078657a8bfd
SSDEEP 768:nlj+9v3DOBcOT7g75riXYUsZUgb9eHcb/+0LvHa:nQ9v3NiIUsZUgb9sK/Hv6
TLSH
T1FAF2BFB1AAA9DC630CE593C5B71A76CB2FE401E394C52D8899CD6B0D09C37AD174FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2d6916b7b230f68e63029ffb5fa4bb789a239732f0b335bd0d2e5f0089e9c760
MD5 58969959d526e6f4b1af7d02a2f5b4c8
SHA1 8eb073bdcd9aa3ee12bfda8a7d381938b63623b2
SHA512 8c9a7585496a22a6f5ffb564d9e363ec4f03a072f35df4e7606790d3b84a0e142a9a273ceadef4efd3b8f8b9c6226339079960dc9051a4ab5b3d845090b72389
TLSH
T1FEE0010B9308C1EEC438033011CB163527E6802052B34306892005A62C13B002F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ca6acef17e2d4c0860b739a0c2bfcf49ba078efa82d24b26b09f320369d695c5
MD5 4702f958d5661ad10cf66f10a38f4060
SHA1 c5e44825b96c0f55784abe58a8a6ddfaf2d238fb
SHA512 1e628e03273275e371fc0f80a1f765cbd289110526303f20bbaa28c9eb17af912a4b55402811944186059e2b1bce210a642640b1f394123a8a466aad02fb3092
TLSH
T1B7E0020F9308C1EAC428033011CF113523E7C03052B343068D1005A22C03A000D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 415fdba6603edc643613e166c3ac1356d44f7439f52b69943a95e577c656750e
MD5 1d5789d27347677be37bedea6f009ced
SHA1 eb6c479a2c0d201eae5de8194ac72bf308d1c949
SHA512 f0725a1d81b2df075266806c3fef9f4278cfafde9d569f4c13c64d91a0f5af56166db57237c492306a402c71c7fb4f08f30a2eb8e2f9024343329643db21899a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a2fbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a2fbc.TMP
Size 392B
SHA256 701f399b86d13e78dc1d90a922f5ba05f66ea9263c146fe012f14dca1f149e02
MD5 fc1c861a12febaba6cd17fbcc7152f8c
SHA1 c1fc282468cd199a4731667b02c4fad9d1c08438
SHA512 43e72383e308a02430b7fc922e182f68c6f464d8c870c8ba1a8c692bc470ed55fc5eb29ad16f5068d1a2ec258dadceee6417e33ceebeb8e3c479737cd4b187ed
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

04831314-589a-4367-bdf6-c0fc06079022.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04831314-589a-4367-bdf6-c0fc06079022.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5952_606040947\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

salinewin.exe-Malware-main.zip

Path C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip
Size 13.2MB
SHA256 ad845ec76220d16eb54ceed420350b9067dee60dc7e6d490979b68930ec90277
MD5 54bbfcf9565f00e5e764c5d362311fed
SHA1 3dd8aa876e064230e2ff1754a368526beccb24f8
SHA512 c195fcb47c14d72bfa161ff37173a3c113a81997273c30049d3e4f90aca5e2b8f2fb6d71f348c572e8e92614c9f5a1b5534728f0b276019b8bc973c770ccbbe1
SSDEEP 393216:W8mQWK1J5ZA1mZ7oIWBb/P6VyeOgMt29aiGwLUd:Rh/V61mZUIWBbXkyeOh6a8LUd
TLSH
T1FDD6332582FA8CD2E164358B12F451A23F480AFFDB8DC856AB0D7AF5EDB564C1B52C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download