hxxp://0[.]0[.]0[.]122

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
373s
max time network
371s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://0.0.0.122
Sample260726-2falsaek9v

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
231	raw.githubusercontent.com
232	raw.githubusercontent.com
233	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5928	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295786664962677"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{CEA13FCB-CD17-4AAC-AD70-431E25F76C97}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5632	salinewin1.5.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	salinewin1.5.exe
5632	salinewin1.5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 2096	3612	msedge.exe	86
PID 3612 wrote to memory of 5928	3612	msedge.exe	88
PID 3612 wrote to memory of 2984	3612	msedge.exe	89
PID 3612 wrote to memory of 2984	3612	msedge.exe	89
PID 3612 wrote to memory of 2984	3612	msedge.exe	89
PID 3612 wrote to memory of 1920	3612	msedge.exe	90
PID 3612 wrote to memory of 1920	3612	msedge.exe	90
PID 3612 wrote to memory of 4912	3612	msedge.exe	92
PID 3612 wrote to memory of 4912	3612	msedge.exe	92
PID 3612 wrote to memory of 4912	3612	msedge.exe	92
PID 3612 wrote to memory of 5468	3612	msedge.exe	91
PID 3612 wrote to memory of 5468	3612	msedge.exe	91
PID 3612 wrote to memory of 5468	3612	msedge.exe	91
PID 3612 wrote to memory of 3472	3612	msedge.exe	93
PID 3612 wrote to memory of 3472	3612	msedge.exe	93
PID 3612 wrote to memory of 3472	3612	msedge.exe	93
PID 3612 wrote to memory of 5768	3612	msedge.exe	98
PID 3612 wrote to memory of 5768	3612	msedge.exe	98
PID 3612 wrote to memory of 5768	3612	msedge.exe	98
PID 3612 wrote to memory of 2512	3612	msedge.exe	99
PID 3612 wrote to memory of 564	3612	msedge.exe	100
PID 3612 wrote to memory of 2512	3612	msedge.exe	99
PID 3612 wrote to memory of 564	3612	msedge.exe	100
PID 3612 wrote to memory of 4828	3612	msedge.exe	102
PID 3612 wrote to memory of 1324	3612	msedge.exe	107
PID 3612 wrote to memory of 1324	3612	msedge.exe	107
PID 3612 wrote to memory of 1324	3612	msedge.exe	107
PID 3612 wrote to memory of 5208	3612	msedge.exe	112
PID 3612 wrote to memory of 5208	3612	msedge.exe	112
PID 3612 wrote to memory of 4292	3612	msedge.exe	124
PID 3612 wrote to memory of 4292	3612	msedge.exe	124
PID 3612 wrote to memory of 4292	3612	msedge.exe	124
PID 3612 wrote to memory of 2660	3612	msedge.exe	125
PID 3612 wrote to memory of 2660	3612	msedge.exe	125
PID 3612 wrote to memory of 2660	3612	msedge.exe	125
PID 3612 wrote to memory of 5452	3612	msedge.exe	126
PID 3612 wrote to memory of 5452	3612	msedge.exe	126
PID 3612 wrote to memory of 5452	3612	msedge.exe	126
PID 3612 wrote to memory of 1376	3612	msedge.exe	129
PID 3612 wrote to memory of 3432	3612	msedge.exe	130
PID 3612 wrote to memory of 1604	3612	msedge.exe	131
PID 3612 wrote to memory of 6004	3612	msedge.exe	132
PID 3612 wrote to memory of 6004	3612	msedge.exe	132
PID 3612 wrote to memory of 6004	3612	msedge.exe	132
PID 3612 wrote to memory of 1516	3612	msedge.exe	133
PID 3612 wrote to memory of 1516	3612	msedge.exe	133
PID 3612 wrote to memory of 1516	3612	msedge.exe	133
PID 3612 wrote to memory of 3160	3612	msedge.exe	134
PID 3612 wrote to memory of 3160	3612	msedge.exe	134
PID 3612 wrote to memory of 3160	3612	msedge.exe	134
PID 3612 wrote to memory of 5156	3612	msedge.exe	135
PID 3612 wrote to memory of 5156	3612	msedge.exe	135
PID 3612 wrote to memory of 4836	3612	msedge.exe	137
PID 3612 wrote to memory of 4836	3612	msedge.exe	137
PID 3612 wrote to memory of 4836	3612	msedge.exe	137
PID 3612 wrote to memory of 4620	3612	msedge.exe	138
PID 3612 wrote to memory of 4620	3612	msedge.exe	138
PID 3612 wrote to memory of 3080	3612	msedge.exe	139
PID 3612 wrote to memory of 3080	3612	msedge.exe	139
PID 3612 wrote to memory of 3080	3612	msedge.exe	139
PID 3612 wrote to memory of 5232	3612	msedge.exe	140
PID 3612 wrote to memory of 6116	3612	msedge.exe	145
PID 3612 wrote to memory of 6116	3612	msedge.exe	145
PID 3612 wrote to memory of 5764	3612	msedge.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://0.0.0.122
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcde21c188,0x7ffcde21c194,0x7ffcde21c1a0
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,8292533886888527417,16696296650111038125,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9618328288418927833,8500048753513134349,262144 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,2967904611454287705,8932199064378476268,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,7991359081714983178,2475559327009941818,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,9615271631300036966,4561036564736406803,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3468,i,872806021478740884,16517046306243703107,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5088,i,4676498332810555406,7673251427265237905,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,5945552031586550873,6210559585770172952,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,7400108380535001718,12711071091314158098,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10544269950783400642,1914514044612389279,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10544269950783400642,1914514044612389279,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4984,i,8473134620811544528,11431944450193808391,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,18176978959702653058,11960167353007058017,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6684,i,2367166887176816531,13122954552871164130,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3756,i,4139059668357597775,18417181391262986303,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6372,i,13767354055637771770,3897017405959183780,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15576701055094037619,5074875486699352621,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,16285201320256966451,1560289936521717905,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,11013270838676181675,8880987814330774181,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3728,i,11823652460094986058,14750806127722489695,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3568,i,9505609882777063142,17220887938649006092,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6728,i,14224726264533404058,12165931834532550961,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,11393161627541390415,9018585225771470000,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5196,i,15290608500218738325,10537644431673727400,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,9245319287792288164,11603280174544735174,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7224,i,3279736347768793525,9182184923640188415,2097152 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,16385124398704336612,18312951627208688676,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7292452303040916877,2311476031154753477,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,16250604668661940372,368945935750891888,262144 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,13389327277832767738,2253922595003444403,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,4203303105727444109,13105393323859443013,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4441004035212346815,16828999402649104328,524288 --field-trial-handle=2292,i,588943533434141319,7334866791176316210,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5984

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x470
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 d3dd1effd9bd5e84bff5ed5b76a70c7f8f8bec9c6729b33a9f7a9f4e8a39ea16
MD5 485dbdee43b9526d884d71fd6519f5e2
SHA1 b6f50dd3ce8458ac732161c5e72a1f605bf10f96
SHA512 22d8aee4d68e1aba1e41f52aaf5481f5c9de80d6f488a59bece084acf64d60b62a220d4087d8764dab25f21e688941a4f2459c9a4fd9fabd1a98a031253016da
SSDEEP 192:TjZQdQQQ9999yyyy///000RRRGGGGjjjoPPPCAGh:TjZQdQQQ9999yyyy///000RRRGGGGjjf
TLSH
T162F1235782DCC3EA9F06208A8DA4725C4171770EEBDCD908179CC9EE344F4ABBAF5691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 63b5b69f77aabf1ec77817501e4b8900bc6a670fbf16430fdb437bf326b922ef
MD5 cf94441948d22e15cef1a23f3692e053
SHA1 3769faca8c3517c5e28b192dfc263c6ddffcedb1
SHA512 3e8fb7468ba52cef1c7b03e65bcc16d9c23d8763c47f6b8e4870c5856b44b0a60497159f7c3a379f47e924a62552825a33c1708f49828ed58d75b7801a261f06
TLSH
T141E026E804CCC22EA648A5478168630CC3803A0FD2C8AA8E5718C8D83403064B7E2694
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 95592b2ea57675e7966fbf0540786eb608a612a5fdd5be5798935053dcfbbab8
MD5 7ed7ceed70ff0871396826767826aac0
SHA1 e3fec8de4479b2c7b0f6f3a09380ff8fb5f8a73e
SHA512 51a51afaad05fe3043b0f8579267588155c8365bbeb3a699b485bb1967d82e15335f0ada5769c55a3f8d6201e6231df68916a503cd6ba12ccf5630b605f94ff2
TLSH
T1AFE02B66D821FC3709FD0B5974994746E74013272680C95F7A3D91088FF06B756C585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 402KB
SHA256 6eef989e45c9c212cc4b61921356602f57072d787e73405ee27f9af787089183
MD5 1bb2c9efb554599a861e5e6cc6305f39
SHA1 ebd2802ff1effd1598ee986516d5642263a0c0fa
SHA512 c07224d384123fcc47990f0d77e1a1347afc9cd4b30ab759e7a368342189b69e40ea2efbd1c7069a30706ebeacb78f77a0135934cdc9202febd0481883125abd
SSDEEP 6144:uqLmFS+6ADtsnXdVBWMncNLB4jvOKUmMtzrlwiIENuaRVPCIA91:7LmhwX7BWMcNLIKNtnl9xb0
TLSH
T1259423CC68DA4CD9EC884EF8F23C23BFC890B557D65D619804877E17A1D8B6D690CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 205KB
SHA256 98a40f49b2c6c699bc84fd494485b7598492a74a95ee9f46c1f0efb35f266c5a
MD5 ce1107a880944ea6fccae45f35dbfcf8
SHA1 484ab447b14e0abcf0272e593a3f8a52436765c4
SHA512 27f5b6c2420a7198c1a8ec5c805b85869904c9b4c078d1244e287a53be8c0cb60aec02dde1d10291d0b237eb08a77587b107cfbe21c63fccbf4308571c8331ff
SSDEEP 6144:7wk0eS057pPDi/HSbMrl4174heP/6lyLS/mdJhu+pTDAnPAr:ZN57Vm/ec4Che60LSAJh9pTDAC
TLSH
T1AC2422ED716E33E496EB952262D4482F31BC68E6966B02806D87DF31F022E741CF5F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 512KB
SHA256 9a55f5b4da42f0b12e14cf3b4959f2bf8c41b356577211d90f2df96e51d083c1
MD5 fe53ea7bc9881cd79475121c91c84dce
SHA1 e467d2c0195dc4c5252b9068db63dd4879dcfbf2
SHA512 1dd6b7c55c1702df3f10f88a4987a0a5618c2e3530062c0b201a7013f5481ab6950bc87b6ffdecab0e0d772042b904f7876aac5d3ef7ac6170adf5969da60031
SSDEEP 6144:yvzOResswwSQmWRPhkcIJd222iXCdBpKklPoxLyz2DIPjpAmZp2wkhAM:y7ORessbNRpudjcg/Ly68dfp2ww
TLSH
T172B412718BF0B7C5C9269972B2DE38CE5D2A1A2C5B0CDC1BF2618D25FCB954EE6406D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 256KB
SHA256 7cf6db9eed43b81665629edbed64b5a629e86cfaa0bb7bc644721687c5017311
MD5 f00ffa59a6f24a79d0a38984f1d1c667
SHA1 9c3ea96bb40c2ddce7d7033914eef469aa562c4e
SHA512 b00e01b45fdba4e8c350c7f27080f5f7bc3d66ca31b8acf702719afd529db4a153451dfe3957d1d72aafae48e4c0bcb16896abc66adc347414197c6386da17cf
SSDEEP 3072:RPm8oBF0z5yYNKxpATjY0DxYK3k+zkF2WNlkE:RPm8oBF0zMmTjY0tYMkWkFT/
TLSH
T19044D0B4F682D782CF432EB8A06C1D335B6614C432C99E0F47B29D21A5486AAD71F75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 512KB
SHA256 3524d8883e4d5781b6215c05f97d1232b442cd41f66cc59723de6c5e19399ba3
MD5 a0355e6554046083e262e04dd1ee6199
SHA1 73f053d90ec3e9ddf235f2f79902350096be795f
SHA512 3e794941897c103033e709913af6e7057295c2e9f4587f19d1a13bcc867c86f6816d168245660195ea96ac17c833696abad4a4f034aa9dc2a45033ca09d52a11
SSDEEP 6144:aVIHGR+Y4LbXL9wD4GR9R9YsRUhovbfxGyTmSfKcKApMqdjdLi9NrMCrx4F:JU+YI9wD4GVwdVALzu9NQCo
TLSH
T1B2B423E9E1268529D30484B1BD769D0939BA3B681DEF3D4B04009A62FBEF1D0761EFD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 16KB
SHA256 97a5ed97257237fb84f8f5907c917a6df036a68355dc3151a12568d6b951441b
MD5 afe638274085e1fcd7ddc05c24596dc6
SHA1 f86324d5bd2389a1e0c84e1d2ab86ec662a8aa61
SHA512 e5ea1da7533d451f5e26fa5523b93397d38dd1998f72759cd295efae2f9ba2dbe34507f7bd853666703293ea8e3bdda8a356920ad792f18713b56ca94b2c585e
SSDEEP 384:op1LXYwCL4Sn3rvDt4XWwTJlEs1AeMXATHLjQVqCCSGDCT:YlXYbLx3r7tCWwJlVQXkrjoGW
TLSH
T1BE72E1FACEF8594A130FC51BB9F42FEDC9AA27B186CDC20B9309EEDB9594C958440509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 a2cfbc62dc9c41580bbd9c5159efcbed30f2a2dd8e2088c930f3e3d69d1fb28d
MD5 2b8b21d343ec0134fb1e14d7c779dec8
SHA1 01a22b2cf663b377581fc117e552773522016cb9
SHA512 a216baaa32979ac9be017e205e1bac3ac510ab3f56e4fec4d0467b3676cca7c620b0b2e56a8d77433185c350c9cd1a8912f30a62261282e4b6ec80ba645ac118
SSDEEP 192:OmUzEuo6sKslQRaHQ44JISo4K4cgrg2c7+T8bpcpPc9ie:OVzEuo6LOQRaHQzISOD2c7+T8+pPMie
TLSH
T15612FE30B4539057CB9295F112FB89843ABB63F7E9635FE6C024E4382D2F79046998DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597a47.TMP
Size 2KB
SHA256 e7b0cba3da3b8ca04de5f1479e7fce5e0bf65cb2de63727672295f8d7858d9b3
MD5 de6fbccab441ef627c54ba40f53faad0
SHA1 ae52c08eabc8f8e42425c605e312756fb584e651
SHA512 d04db4ee1c8a3f3b583eebf1c67e66d693a546590b8cbab7b8f845a799df10ced47688c8ff0a3cf6af65673327c7b56f04deadcc9145591e2c2075e15a2cb1ed
TLSH
T141516339395311A7EBE0523657F00F0435728BE8F9E39ECA457824393E3A7198069E9F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 42KB
SHA256 d90e0b9e83d0dcda26be8e7082eb2e1e9aad474e6391a4c6b60554768ace52bc
MD5 7de4d14e80cf7fa40e6efbcaa489a07d
SHA1 1873b676478828cbcaef2d647109e94f4d72a0a1
SHA512 0dba9c961e1c197d2e306e8243c46c6920429c23ad3d5fd18090456b54c0077e4430b9a89a354021262a133e86efe5ca9084a621ab76ade82db2327dd27385d9
SSDEEP 768:JuCSmAPtyafao4vW3yruBrSrGWsFjx7uEkMEMA0iJrFytL7cDrklMGOGsh0yCogd:HA73yruBrSrGWslxCZFytXcfcogd
TLSH
T11F135666B5F9120AF2BB9E7BE8B657514CBABE461D04C81D58A0620D4C32F40DD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 58671c925604c2b4c8e1813dd98326520c7cf29473fd7d5d9e98db89c809c7f9
MD5 dae362dced1730a9c065c3b9f8b99a84
SHA1 ce634edb2e285718f05ba84c707dbfa263a82f64
SHA512 c59f8ea1dfbc2fb64079bf4f08a990831c0c3b8df62f3c2f50b918592d3b25eb706e3eeda479f6c80ea12255a7dcde704520049f7e738e58ce8d198e3e8bd6e4
TLSH
T1D6E092B884CEC25FB51460975528BF08A7A3B61FF788AD865B1DC9A4B481140B6BA262
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8a04f63d52b296021bcd53b680fc11016ef13c3bc011eeed910899ae04c8f37b
MD5 a91f048f0cc70095c28ac0d41eb0d304
SHA1 e35fba43411061a175327fcdf0e6323ba0330047
SHA512 ba501411443174e37e169a6348efae39f10fa48a93746b94409e658220e7db7d0ec8c8dd98e157d22e781586e7848cdd5179b51d73924bd318e57c431bc6a88a
SSDEEP 192:D1mJE2UTAcamRaaij6l1AOx0igZzAbCmDmDmKvmeGmtmgmDc7g75HsS/tk:D1mJE2UTAcamRaaiGl1AOx0igZzAbCm2
TLSH
T1A7E1CCF783F5862DDA1195F0EA08AF1BCE1C0452836C3D5A85E46F0BA3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 68bc900a376e9661753aad723215d758d2ad71435da5bce5b25b0fdf9c3be246
MD5 6e51ba358909b071c0c8cfe7e2d1c910
SHA1 90a6686c0150f6b17eab71f8d6b57aeb9ae13703
SHA512 4a750075984827516f6005b2f3d127acd9d8f89f76d3584b9d386771e5fb15651d5a96fa2e40f2f6482de87dfcd593ff77c45c6f64e294037186b94598655a22
TLSH
T1F3D02227664030BAA96C3E85C06EBC8FC32700348A43EEE412D2D8AA2931A6C0527248
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 df4c0926745e7a14fa4d102dd316b95fb4964835bb8e170a9c5960487fbcd126
MD5 c7df8770d92eff63f7dcf428336c7c09
SHA1 d089e23a765035b2deea05f675e2267ec0d7a70f
SHA512 bd2312668232887aae81d8492a15cad3442c6f6e7640af47033d41f19268dad9ba78796c2a87c64bbf0b69f1d3907b0b70d98843ab2c3bb4c3b4d1830d3b1e0f
SSDEEP 384:sxZGnnaFuOV/fzxssHUxBazwXmDHbW/Ngjdq:sonaHV/fzjHUbazwoHbMNEq
TLSH
T14392E8176620897BCCD7C619F9667F62D6F80123DD914E4C99FCCA0C04EA6ED261382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 1049563f797556068f143f7121d8f1dfa580bbac71b541d2705d5663ee5bc0e8
MD5 91c6b419070d6a005edad8d27ff030c6
SHA1 230ec2d190907a54aa251f1a875dcefc91f11563
SHA512 9736945ed69d98f80be97cfe37a6cadd4f4b98dba778f7a999095729b84a12424a785a897c72933a32639ca333159457c0f7c169f6712968015694570147287d
SSDEEP 384:sxZGn4aFsm1V/fzxs1Ux8zwCCI+NCMEHR0AlKg/Sgjdyy9/Cj:so4aym1V/fzMUizwJnEHRNSmyyZCj
TLSH
T1B2B2C6576620C9BBCCC78515FD357F62D6E90163DD914E4C9AFCC90C04EA6FD2A1282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 cc6d530592860cc1a24d971212ec89d20c87efe33059d336463be828b027dc73
MD5 44a7d36be96c727c638dfab4889cef1f
SHA1 1b10862bcbd6140b2dc4f11733dba8d4d3b3d9a1
SHA512 006a6798a9862741769e0c53deff593511ce1dcd12189cda18c494387f1c09d7e761d2ad4422fcdbabd3f9574ae5632eadf85c03d46e4dad030bddb89b44fa89
SSDEEP 384:sxZGn6aFsm4V/fzxs1Ux8zwTCI+NCHEHR0AlKg/SgjByy9/Cj:so6aym4V/fzMUizwAEEHRNSmyyZCj
TLSH
T106B2C7576610C9BBCCC78519FE757F62D6E90123DD918E4C9AFCC90C04EA6FD2A1282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index
Size 72B
SHA256 2ee3e0809ad6c0b14f6b74dc229c676dd82901418c68e5b7567df64eb8845479
MD5 fbd0582d44066152f46e411dba8d242d
SHA1 bfb1777f9aadd13b2b1d9ffc072b5be5a6ad4657
SHA512 60bcf832225e9336d23547081e2dad80da742b013fdd3b4aaac0825b83fbb83f476e4dd9da5b6d25b052f9773728204c368bbf4e016aec56116211689a3a4b83
TLSH
T196A002A8C1424606E00803F11CD54EB076B1591421111B1544D10C44DF71559418B30D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index
Size 72B
SHA256 d0ad79ae27b220f1e1580a93a38b40dc94f00f970f92ac1dce385583216fda65
MD5 811a800277b7f265178bdea78fb31c77
SHA1 87e8d1b56df444551fd1187ee1520a0448419e39
SHA512 4e5e1ab6792636234f3aac86a28b3317b42555e248f847a883d5799fc667eebe7d94db9a11bacffad6d5bbd8adc94c57c4fda32f3476b370de10e7be18b03cfd
TLSH
T1CBA0021CC5904A06C04583F011D18EA03398695431910731C4951BF49E7098A874724A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bafe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index~RFe58bafe.TMP
Size 72B
SHA256 4f14fe1fe7c3816bd6f4081f9313e24ea60a120c24e5197c033dadd5e888b373
MD5 a156dbb2ad634b06ce48ae94010103fd
SHA1 fdab10519ab33788c291f113ed1fc244204d9ce6
SHA512 a90f843fbcca3ccd2fde846e1c18b2267407526808d3bb774cbbc2cfa13b68b3755c126a9d08425e47222c41dc98b846f5a6a717955d3880a42af233ba0f1177
TLSH
T1CFA002100240C1C8DB455172304512721610BCE051900FA34AE920989CE50C0B715544
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 60KB
SHA256 b9745f66fa6d0ff5a5edf1e0449fdf579d2012b95caecbd2c8a6a60b7e2de778
MD5 a844837ccc4c5dcb091041f71bd9c0c3
SHA1 caf92d90738d86df5882e67b89e7e2dac4895c77
SHA512 ba6568c042f7da2d2a75c7a850c323833ee1b1737a69b979f426719823071cbfece6bb371ec28b7b6228d974be8724c8995077300edaee4f3ba8cf70d8d1acf1
SSDEEP 1536:cWESYf6kuBHKut3JWWOQ7DtO/YdsllqtZtIeQ36QjRHPwqpzGW/+:cOWFukgMgDtyYdIYZ3Mh/+
TLSH
T132532AA7B262613587AD21D1949A7F00F12B17565404C9EDF0BC7A913B18ECB62B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 6d64e2151faa30c74becf8ac2a037af5df58839d0173c04160f27b0675808179
MD5 8454980a4e7231734a7e0e3e9bd3f925
SHA1 11bcbb984edfdcba9e79f172c56342c15a504d91
SHA512 965b5ab88a28edee3954a170303db00f33f654766b5035ecd98d3629d80f428627dfa7961e1f778f90ec1aafde4e8e12fd4db585d6c740fb8c78d1e408c893f3
TLSH
T121A0023805A94351C01286F15192839123946E5D0113470540D017FA88559DC861A1C7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 4ed65adb6ba2bb917e2523aca28842bdc488d3a8579e1da671ed6e49260f552d
MD5 e68fa47b7a605d7596e22a6af1befff4
SHA1 e7ecbef6fbaaf1c99d81a8d14464e701851097b7
SHA512 31dea11a4d36acbab574e419de22fda71640c1d420741a1f0b3c8488dba5808d7f3d70786760cc64dfc91ab03c58e5e501cf0e2273c44665785183d22254719f
TLSH
T10FA0027C12942241D40517B19543C36033155C155103479550902BD58D629ADC649297
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b6c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe58b6c8.TMP
Size 72B
SHA256 f513ffa9f753177ee210248d6334129589b9bc77238fae628f950d8ec262c1c6
MD5 00118a14c3e2dab2a3919f9f96fc2d85
SHA1 957035ffc6b1451648bae1a8a8d060a51d8d1277
SHA512 3dcb1f9034398f2b804191a5bd10af78b2f21630cc79e1f5b3dd6b3ccb12e6c62d07f0483a14c48e35fe1cf97b23e9a902e922d699b21bacc75f213749a6411c
TLSH
T1D0A0022487648170C5560A7155D18250A30CAC117803574749A204F98E5546D5553484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 8c0d7080857fc2529d9edfd4d522381ac61e69a705c23df6b3d4d5b16f351bd0
MD5 62fdb5406a5a96f21204b9fefb60ae80
SHA1 85ecfe0ac37f40bbc18eac29d235b4cff88bf8c7
SHA512 41b0c86a2615ea80b656570d7bcd15dc763c043ebcfe1197b3115d81e0cca658409346add1b72378c8f2bfcc64ae173e87506d722dfe65a09f2fd2eb70afc25b
TLSH
T17A51C94D0C471F2BCDBC11B364F60484377578DD65885F2B75ACA1746CC36282EED668
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\623cd082b6202da0_0
Size 60KB
SHA256 e56cdfbcc814f4e91dee5bd35685355cabe5392c0d7e70a7e847f3171c512693
MD5 b0da1f0a4811b988f8c56cb08a987f2a
SHA1 57a19337d5c4c017a8ece6bcb6ff88451b88b58c
SHA512 e946da8738cafa05ade8f474e3d9f0f182e1bc89f77ca0d63f732115c3195486dcf0d17a4252ab208a4727b922eb0b37df4c0dd2955665dc38de5feb218b7edd
SSDEEP 1536:yESYf6kuBHKut3JWWOQ7DtO/YdsllqtZtIeQ36QjRHPwqpzGW/2:6WFukgMgDtyYdIYZ3Mh/2
TLSH
T1F5532AA7B262613587AD21D1949A7F00F12B17565404C9EDF0BC7A913B18ECB62B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 8afb7944320cae05147f9f6d0e6e7d2d5d9e8a8dcecb5510954876eb5009d5c6
MD5 35e8013d464bc5562ccc0bd02d8b8df4
SHA1 424275df91f97e0765cbf36209d00228dcb8d482
SHA512 cd84a8e9db000b5c2be5481c10031261dd5c115b12c0a97d0bdc26d1df0c9e7b9f9dba113d7a9d4920c831f16f102629e6c5d538c6d7e7cc1390eaf81618875d
TLSH
T148A0027946844101C40312F17593C3866A1158980313520552A14346CAD1E42C15900F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f102.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe58f102.TMP
Size 72B
SHA256 29fc6647b468c697b333ca246ced33dd854b9cdb0898f6c76e1b95b044f0e286
MD5 d378d483318900de5f01e0365f5acd1e
SHA1 51b293ce784909d94fb096e8ffb07e32a5255029
SHA512 feb2af31d43724006d2904fa32497fe4f1a61eeaba66188cd4d66fb0720fcfbe662b0a85609e34acbbf6149090904ea4f91a3a455751f5c455863d500ae3db1f
TLSH
T1F2A0021017A0A105C92311F215D282421615C9253100120640A301F8DF50490564311D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 77cf7b3615f9154348d12a127ee1602928e0e94850812a508031e4444aa1db9a
MD5 98bd9822d5ac0ebcec6aa167436fd8dc
SHA1 5733f65972f0f9ab56ef46a0968be037903e4522
SHA512 8d4191371535956a029ea00b7a3cfe550fe5984b391c0c3f8c41fd7382f075ad9a27aaa55dbd55747127dab0c38f81887d8013ccc4f44af69f807c4273110d9b
TLSH
T1B1F020B72FFB1810FCABD3DA203169A0010AF8908894DC1F6826B28761B2319205ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 0e7dc0b553eff485b0da59905ed85f0668179c3b1607e5e83c6f31f85a4919e3
MD5 dc7649305bab4e90de0252083de8653a
SHA1 6389d20fad44874895d2a42fbe8893f0883938c8
SHA512 b28e5d4b99c2a8eb7612ceb6920a5ef55f7dae1231f5f2f80eecc22826ab79ebf376f9cf689deb914565678449316446024aa9c7b552764fe480a85a9723fbaa
TLSH
T124F027B72FFB1810FC6BD3DA203169A00105B8509494DC1F6426B28751B231D205ECA3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6dfaa458003817b4ef765c40f2ec5af7ea7924bdcfab8b26cc05ef54d059ee52
MD5 e2e7bbf9af9e6bd071e2718009f8475b
SHA1 fe56d06eead2203418ee90565a615fde306c6356
SHA512 3f49cffc1553141153e3dc01526d2fa8156bd39a020fcdc07aef468b253897c8e300b54a33f254c7de2926fa0d097f45a36475568d1a79c38809c690a18e355b
TLSH
T143A002148E6FD085D40207F5907D5380B3926DD91515136385D9F0EC8CD26A652D6A83
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d900985e65fd981691e750e20f206a98ccfe0423c597f49ac255b32da5caddf6
MD5 7ff35c96ada34680b55edfe85cc5129c
SHA1 6921b609fde16a97de9e8116158b4dc3a3bffa9e
SHA512 4d30a149b6e07e1f0be36b4504234528d9a87837fd56ae311f0fd45edb4db9e6c5d19ce442656de7197c894ed035a3eaf4db2f46432306b8ef4aa5cb7028f69d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGG:05ppxnY753RNBvRJJdt7p5J99lHq
TLSH
T1D5B2785A703A0211397E3988B39696364F4235A33058E4BF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9aadb17a81e25560fb77c10afc1afc8dfbccec3b5e2b5ce33da6bd2e0ca00e89
MD5 b7c156852ea4e1b7807259cad9fa9a8d
SHA1 6db4bbea190b19318cb964089a29217ded78b44d
SHA512 fdfe245d5e4920db222d9411aadf4d74874f431e99c432680e113cfeb89add155da994e1b01ebed6c076f19a35001fe52bf5c2e5c6fb3ea885507ad7788726f5
SSDEEP 768:DF4LDwgNksmooGGr7cjGfkS1dxDVcLCO7w/nBuy:2LjnsMaRuCt/nBr
TLSH
T16EF2D4F2A8D78977E89E4B87A77D2D029AFCD113B6885984B7D81D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5b8c8005a6b4d9a60e4bbdac57faa2892b32e4469f017908442b6ac2227759e2
MD5 fb1fa0458e995d936907adb25687a2d7
SHA1 7ff2a5efc1ed1175b4540a45ecc7c93f15941fd8
SHA512 b9e79bc23119b07f585ac2e18cfeee14f2ce3a29ff63056d20e626e3f0793953be7b7f50a89c9309baa9e964f897c32be14813efba95ca97ad2a70f1e25d1281
SSDEEP 768:DFHbTswgNknmooGGr7cjGfkSpdxDVcLCO7w/nBuy:FbT0wsMa9uCt/nBr
TLSH
T1CEF2E4F2A8D78977E89E4B87A77D2D029AFCD113B6885994B7D81D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0b5af9be46f7c62e6fb92a266b7c9a76f63c9c0b498c631722b7bfa09c15e5a9
MD5 56f1cc3fade42eb246719cf22fc52f37
SHA1 d3939a044d03e96e937b7ce5b38b7b50edd08c50
SHA512 564192ae172ba2cc1cabe385382abe94af4be45773f3f1379d57d58acdf88ed4bd1b86f9459cf331ab733a1127f37d5c3031aede3670fd4afdd9cf7840596d28
SSDEEP 768:pzFQ7s3Dwgyk0zoGGr7cjGfkSAdxDVcLCO7w/nBuy:Y7s3AxsMakuCt/nBr
TLSH
T1A4D24B32E8A4D9BBEDE65F89B75A76479EE48123CACC59D8D5DC1E0C00CB59D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8183c93823d108e58113eaf174421414cda2a8b29544b0c5243168cb2d26b1d9
MD5 7f6b5d92b0a361070de7327208a2bc6b
SHA1 e8e79fbc0b352c5fe9de61876b7158ef03fa3171
SHA512 c81f5ae91744ceeca93a4889f714a9b7a38ebe7fef12571afaebdb2ad83d09ac28c40295d1fecb2d3602572a529891e454f4df877148b12cf711f6f6bf83cbe6
SSDEEP 768:pAFccps3TwgbkU6QoGGr7cjGfkSVdxI8p0IL9:is39LsMaxI8p0IL9
TLSH
T1F4C25C36E858CAB7FCD74F99A75A3543DEE44227868C99E8DADC1D0C00DB1ED530B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ac579c96d5716d5ee634a4e0a0e7be62278c5e4b1074879b705c5f91090b0479
MD5 b52df4c86dbee30dbfa835a2d832ea91
SHA1 4ccaf07f7bd187cfd863c08eed5ab0deb5ab63c1
SHA512 4488c21f215f704ddfe34bfcb34983e709168e6c974e91714968b6d25992095c4a793a1e9699892dd201354f62712670ce9c192d151967b0a875fadc25d6ede8
SSDEEP 768:JFQ7ADwgpkRmooGGr7cjGfkSAdxDVcLCO7w/nBuy:I7Az0sMakuCt/nBr
TLSH
T167D25B36E8A4D9BBEDE65F89B74A76479EE48123CACC59D8D5DC1E0C00CB59D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 23d4b7384dbcba24be4105454272da209ee3a75c344f6c89f91062bc9b4897c8
MD5 57d1b394b906dc4b6191a0c2bdb6e221
SHA1 534f577f513e3a6d432a4207f571b3f6fc0916a0
SHA512 c99f9e26e5a8bc1832087af3906023f1322a8c16367f72c002a10619b828855bd85ce926858454677b7eb6bb0987bd77aad3991a9d6820290018484b4af818a7
SSDEEP 768:JF4bDwgNkSmooGGr7cjGfkSAdxDVcLCO7w/nBuy:gbjbsMakuCt/nBr
TLSH
T184D24B36E8A4D9BBECE65F89B75A76479EE48123CACC59D8D5DC1D0C00CB59D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d1a5165d16877df677370c2d524d40e64b6d27d047c8d159bf2aaaab977bb040
MD5 c752c16e6b77c92056fd6471dd48fdea
SHA1 2d51f791856a234d99b91b10a138de62a6192fb3
SHA512 886f8752a569a9e65bfe1354e6982cc2d0641b4bbc349608f4739762c3c0cbf66e37339e311004f5d88ea49ff352aa175b33f121bc1dd818a1b15d4788e2519f
SSDEEP 768:p5Fccps36wgbkUVkoGGr7cjGffZI8p0IL9:Ls3s8sMa5I8p0IL9
TLSH
T1DCB25C36EC58CAB7EDE74F89A75E7603DEE4522785DC59E8DAD81E0C00871DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eb645d74c7c0959cab451e2cc39263ae2e68f4c76570b041f7fa5737be8a7e50
MD5 feea55a266e3a870226d183558159596
SHA1 4fa44a99f20dfbbf232f70fe7a5bb299dbe60def
SHA512 47e03e85e33dad9be62bf59c278f84fb7ded0f14c5ebe0470592b31f8eb0fb5f12c474616ce1144865950a1d39c70ae6fbd09e48a2a56c8d8029c558b9c2f0b6
TLSH
T170E002569200007EC42B033410A3176026E2801002F20106552001641C677042E30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58cbd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58cbd7.TMP
Size 392B
SHA256 4336e9eb22d3902051115f4cd3cbcb3dcd5748eea7e5acad6a45f2f95bf9382b
MD5 a26abbcd92d6a53bcde5b7df0e4a9d4d
SHA1 256e062fba3e0f0dcfef4b4d4f4f7e4ddad4132c
SHA512 7dfa7201f019ae1b061a3676f3d3c7a769da1212f621240b7d01cd434e6ee6501f4b787b60e1443f554a3a36cca9f3b2d95347d3baa9528b3b15858d66192c3c
TLSH
T177E004575300007DC43F03341053175013D3401001F101055D1001500C577041D30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15f2962ac24b6af7b625e5a8b2cc82998cb2011e0ea28330d0dd10102c100460
MD5 b75fc6285ff8806f0722a2de2b0dc6d2
SHA1 4c298c0b4213d0e119a64f86aff63bedfe166c9d
SHA512 2779775083ce9fea865a7083e8b97ae00f1a127c3d0a4e34bf8ccb97618c8f259097f69e0cfbb293230ec45cc97b8f77078d2d666e6513a79b1d03434064aeda
TLSH
T14941E74CAAE91148B3B76E5AAFF7A8AD447FBD772E0B945E10110D4F0A72B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 7KB
SHA256 bd651796c18c81d8b415e948903d6b3f410ec41050aeddfa4793a032e752d307
MD5 d7781ff49c968d871e52c514964dc7df
SHA1 42ef74ea913d321483cc397a0af3d0f6b32c6b24
SHA512 1a8ab1990b71a860c79436f307b475a7bfa7801910c54d6ed75925de5a4cd2faed5fa323d1f07332253de4bac80cbf74fe199f06ed6ce5ff90307220bc8ad32c
SSDEEP 96:e8JsuEHpuDCIJ+IouEHAZDCIJruEHBDkDCIJnIuEHs:xK6oFM5IBIC
TLSH
T18DF1DE44ABD60B65F2F6DF72A4736711AB3AFE0989144B4D01C442491CB2F0A996EFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin1.5.zip

Path C:\Users\Admin\Downloads\salinewin1.5.zip
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4828-548-0x000001D8B5DB0000-0x000001D8B6DB0000-memory.dmp

Download

memory/5632-1845-0x0000000000960000-0x00000000009AB000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads