bruteratel | 7203d33ef726fb70c254787df34e5eb4f7229a8954c74c1e0af0767bc1825079

Resubmissions

26/07/2026, 16:32

260726-t2etmabl9x10

26/07/2026, 16:32

260726-t12a8sysft5

26/07/2026, 16:28

260726-ty322sysdw10

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
102s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WyvernLoader.exe
Size 18.7MB
Sample260726-ty322sysdw
SHA256 7203d33ef726fb70c254787df34e5eb4f7229a8954c74c1e0af0767bc1825079
MD5 da9351be4dd141661924139f3723f128
SHA1 c322eec6b2243a021903fa682bf5a7a55330d0be
SHA512 0b93cf00510e6b5210ea546eeebd2d71ef39f674bee347f119d1940baf1b7980149f92cea765787366e431f5ea0cfdce6e08d048bc6a368297000923633366fe
SSDEEP 393216:FyfyhxeambspR7yaO3WTb6aujNlI8dcyo/L0bIgmruBzuz:FxfkuR+JXBPoDnr2zg
TLSH
T1EC1712E965D011BDC885C931E28D2BEEF0C578490EB9A81FBFC219411A31D9ACDE6D37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery bruteratel persistence ransomware

Malware Config

Signatures

Family: Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
249	raw.githubusercontent.com
250	raw.githubusercontent.com
251	raw.githubusercontent.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3688	WyvernLoader.exe
3688	WyvernLoader.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2536_1963648248\offscreendocument.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295570130840574"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{9267AB4E-EF03-4C0E-8452-C18E41ACBFD3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{58D283D8-10AF-4F74-A8DE-D3E104656ADD}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2744	2536	msedge.exe	95
PID 2536 wrote to memory of 1056	2536	msedge.exe	96
PID 2536 wrote to memory of 2960	2536	msedge.exe	97
PID 2536 wrote to memory of 1056	2536	msedge.exe	96
PID 2536 wrote to memory of 1056	2536	msedge.exe	96
PID 2536 wrote to memory of 4680	2536	msedge.exe	99
PID 2536 wrote to memory of 4680	2536	msedge.exe	99
PID 2536 wrote to memory of 952	2536	msedge.exe	100
PID 2536 wrote to memory of 952	2536	msedge.exe	100
PID 2536 wrote to memory of 952	2536	msedge.exe	100
PID 2536 wrote to memory of 5384	2536	msedge.exe	101
PID 2536 wrote to memory of 5384	2536	msedge.exe	101
PID 2536 wrote to memory of 5384	2536	msedge.exe	101
PID 2536 wrote to memory of 1144	2536	msedge.exe	102
PID 2536 wrote to memory of 1144	2536	msedge.exe	102
PID 2536 wrote to memory of 1564	2536	msedge.exe	103
PID 2536 wrote to memory of 1564	2536	msedge.exe	103
PID 2536 wrote to memory of 2396	2536	msedge.exe	104
PID 2536 wrote to memory of 2396	2536	msedge.exe	104
PID 2536 wrote to memory of 5792	2536	msedge.exe	106
PID 2536 wrote to memory of 1788	2536	msedge.exe	109
PID 2536 wrote to memory of 1788	2536	msedge.exe	109
PID 2536 wrote to memory of 1788	2536	msedge.exe	109
PID 2536 wrote to memory of 4532	2536	msedge.exe	110
PID 2536 wrote to memory of 4532	2536	msedge.exe	110
PID 2536 wrote to memory of 4532	2536	msedge.exe	110
PID 2536 wrote to memory of 4652	2536	msedge.exe	111
PID 2536 wrote to memory of 4652	2536	msedge.exe	111
PID 2536 wrote to memory of 4652	2536	msedge.exe	111
PID 2536 wrote to memory of 832	2536	msedge.exe	112
PID 2536 wrote to memory of 832	2536	msedge.exe	112
PID 2536 wrote to memory of 832	2536	msedge.exe	112
PID 2536 wrote to memory of 4136	2536	msedge.exe	113
PID 2536 wrote to memory of 4136	2536	msedge.exe	113
PID 2536 wrote to memory of 4136	2536	msedge.exe	113
PID 2536 wrote to memory of 1276	2536	msedge.exe	114
PID 2536 wrote to memory of 7160	2536	msedge.exe	115
PID 2536 wrote to memory of 6044	2536	msedge.exe	116
PID 2536 wrote to memory of 6280	2536	msedge.exe	117
PID 2536 wrote to memory of 6280	2536	msedge.exe	117
PID 2536 wrote to memory of 6812	2536	msedge.exe	118
PID 2536 wrote to memory of 6748	2536	msedge.exe	119
PID 2536 wrote to memory of 6812	2536	msedge.exe	118
PID 2536 wrote to memory of 6812	2536	msedge.exe	118
PID 2536 wrote to memory of 6748	2536	msedge.exe	119
PID 2536 wrote to memory of 1252	2536	msedge.exe	120
PID 2536 wrote to memory of 3820	2536	msedge.exe	121
PID 2536 wrote to memory of 3820	2536	msedge.exe	121
PID 2536 wrote to memory of 3820	2536	msedge.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WyvernLoader.exe
"C:\Users\Admin\AppData\Local\Temp\WyvernLoader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffceba8c188,0x7ffceba8c194,0x7ffceba8c1a0
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,5545055242281761005,12526961403758062771,262144 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,4525641654602274352,9278234491545168536,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,11301592639688519087,8535237673922028164,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,893128259162012650,8681928031578817031,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,12286979467312592041,251921465335519195,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5884562848805163729,3469899162438056871,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16595159418340005085,17186303272616833544,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5463179245960182361,9429158619517124606,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,17291068650891945994,2086884972916095384,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,17291068650891945994,2086884972916095384,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6436,i,8671704415542346183,3485301026481535690,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4436,i,14481825627256799931,8898057704980667251,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6056,i,14018703024355143122,10761181514747731265,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6508,i,308696527221091957,17917140253662030411,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7148,i,7167003387332392963,7460140276512202459,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,9410505690531832244,11996044405447415801,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,10918015104082593352,7427379288472955711,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,2274402409752677945,9580211169252291369,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,10880951510018815251,10684900115837657889,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5352,i,4684295520871843538,4279399808255112277,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:6812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,10048186817957366354,15262728333813089977,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
  2⤵
  PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,203920499858173476,5304196057913850569,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:14
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7872,i,12792456413554906005,717773691684689710,2097152 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,17202690537692146271,12275095857630049951,524288 --field-trial-handle=2644,i,13098887663962498958,12862025377501998828,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:14
  2⤵
  PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6040

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
PID:2692

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F0
1⤵
PID:7076

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 685088da6e4ca1d4638e9285327e848f359ab3cb637af3d547a40f29e7eb02ea
MD5 c33bb422db616646774ae23526c698e6
SHA1 786855f0a15bfe7cf5d8d05b4cd5292e603b7a5b
SHA512 9f5a128815d40188c1dbdbad182ae15ed48a612e45f6d254081d694fd5f04ddbf490a38aa1cf330fba10edb337a0bb7cf36ad23876055d968e9da6ba8289188f
TLSH
T1D6F0F9A6D821AC371DFC1B1870944A47EB50136B3B41984B3B3C821C8FB063B464681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 bffdef08f584eec39b844eddc6a74f46b0c07bc7ed426f86f807d639b6482fb8
MD5 03444de1a54f05cd4badffe9fdca3d9a
SHA1 75dc09e9f269b8bdf09c8aff28479a98f833a283
SHA512 a6b3bc6632eed9d1f5afbbe9700fa95fa086bd45ed10ff7155fac0418559b6bd6f0dbbd98e165e3436aaa9fbb304f0ffdd9139d213ec23b15de9776477fdf71d
SSDEEP 192:l9ipX07bzozpMl3NM3L4WrddLuafxX4cnXYb:lQ07bUVMtNgpXYb
TLSH
T14902882056681094DB2BCC7124D7986731F185210AA76FCB6A09AD34B5CBF93DDECFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b5b0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b5b0d.TMP
Size 3KB
SHA256 638f0552a052edc3430ecf2212be4bb03e7e207fdf486c2ccd157705be413f36
MD5 367cc6c8b60c0671622eafbac601e49f
SHA1 f391476cef289006a81a34989b2dec5ca04209d5
SHA512 34adbc7a8d8a2be432c56194553f0d2ffcea12a3d19898d772d8324125f15b265ec7d4bea0a68ee886dcb50af6f115de0f48169b2f2ba1c2affcefedc72b5671
TLSH
T1B7613B75233915A1E724C87675D2F8B836F688520F673B0AA11DAD789A0AF14E0DDF13
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 924562466b31f41c6232b9e6305a2028e01deb74809f677f9949f4bd28bc6473
MD5 90de9cd651c04e862cdb933d468668f9
SHA1 12ecd8ecb818f6ae8d5b4cae51f7ef987efde191
SHA512 80339cfafd0ece8ee0f8ba2bed9a4c811448e3e868c2ca1f1ff895a88bc0c45f19185331c164cf223c282236676d8f928529708ddcbe01b6976aac8f21f83340
SSDEEP 192:D1rgSCTDmSmaVZij6X17g57cRGjiis2AbCDT/nGm0mDmzm1watmtmDmgT:D18SCTDmSmaVZiGX17g57cRGjiis2AbO
TLSH
T1F9E19CF783F5862DDA1195F0AA08AF1BCE1C0561836C3D5AC5E4AE1BE3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3d665bd118882f6f2bc44738203f09c9aa8a12f00897e36c1023c79f7cfc1ea8
MD5 43bf2b35a73ce033821a2ff067a57a97
SHA1 e149b994765d35e47e0b7cdba14cd9f85dfd5f6b
SHA512 e84e6ae02a7ba46b4e9a771799ccd17428c7b96c97b4696c9e19e3fbf55e7d45845412fb9e003831887db9323b7a0d5d9310ee31b275bb555999ae701173c9b6
TLSH
T1A141C2F783F4856ECA1196F0AA18BE2FCE1D0515432C7DAAC9E0AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 55476df07622fc341d0ea78e738a2598306614d175eb192231fee2020adc2845
MD5 a32c387d67081eb5f5a7175b1eac7040
SHA1 2ad625ee6b6518499f51d3ce0965633426a83448
SHA512 f02b97016eb70228ce796b610d9545e07a42ad759cfa806fc01c268347b2ce5241b7f54f7cab9d2ac8df53adcfa6d995bc4c71f97ff4ca6ead424317225609a0
TLSH
T152D02273120AB0F6B5AC3EA5696AFCCFC72E05A00852DED460D0999E55328AE1A6B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 aed8c6fea2a347fc9e023a2304790a12f3f3e4e7a854ddc64704066752963457
MD5 c5d82c278131b6e7af637e7c7cc883ec
SHA1 3731ee1d381364b9dc1cf7c44ec2b6172e8c8cf7
SHA512 76629d6fbc34e5cd40221eae999e2323428f0fb18290f81cb94e4b9574d9e4d43ed0f4fc76aac6002c09da41c1a6606a7521f38da5636b9bb228545702808a6f
SSDEEP 384:sxR6ecm1Q/flsDzN/RIu1xCTS/5/F/oCIHsGQAgWm5+jt:smfm1Q/fIZW2/5BZIHsGQ4Hjt
TLSH
T1E6920A176524897B8CDBC618FD65BF93D7F81463D9915E4CAAFCCA0C00EA6ED2602C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 8838b8205fae0e3131f452b71a69180bb7da2c0f412586b2f01507266c2af2c8
MD5 447b9b840bf01a9be772f25c5e0727fe
SHA1 9e026b94194df0835d85109f4fcfd77577846fd3
SHA512 18ad8e1018fe90137e08d58f99b84f403bf0365519bb8eba8790836537250167d1abdfd9236be867d2d5a9300e014bff94618b1b0a0eea7a2a305261369cd09f
SSDEEP 384:sxRZecm4Q/flsDwN/RIy1xpTh/5kpF/KCp/sGQAOEm5+jt:slfm4Q/fIKWQ/5c/p/sGQsHjt
TLSH
T111A21957A524897B8CD7C619FD65BF93D7F81463D9904E48AAFCCA0C00EA6ED2603C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a78409856b4d53f7c5c54fb5bb1036abe9cca4d7b1d3718e5f7e53d86fde9e89
MD5 5ec056c8343a325ab08a6f9a146d29ea
SHA1 3ee6c60148f67096643c8e968470cd396b54f28f
SHA512 c225a099241fb58006cf3d9a3334e1b771f8f0bd0d89e225a94a8a84509b1b55394b07cf7a04575792e4e1bea0aee1369e766274a81afce405d6456b48760348
SSDEEP 384:sxRAecm1Q/flsDwN/RIy1xpTh/5/F/KCI/sGQA8+m5+jt:ssfm1Q/fIKWQ/5B/I/sGQIHjt
TLSH
T1C0A20917A5248D7B8CD7C619FD65BF93D7F81463D9914E48AAFCCA0C00EA6ED2602C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6ad9f3229a95623112ad61e50f3b1c3e2b1fcb422d3a307bfb4d43fb6d2512f0
MD5 01135e9b5de16a791242fe448956b06f
SHA1 48101e55b5b8a9e94df92ad321e29985fed2ea28
SHA512 2eae1b6df66a7b0aa8ab7bf693cb4ec66a9eff614f90787d49fcf173f7166f54bb59489b017188812b69dc8c05474c189e98eae192b7068a4fa45972bd0cf98e
SSDEEP 384:sxR6enQ/flsUzN/RIg1xm/54/oOZHsGQAjy:smKQ/fPZWn/5qpZHsGQT
TLSH
T12D82F9166A248D7B8CDBD219FA46BF93D7FC1163E1945E48A6FC8A0C04E66DD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 81f2b76c2340eaae41654d37a1943f1c07320d6d3aac5d535c68e7a444d00a89
MD5 345adcb5313e8dc627a1e6ccfe3520bc
SHA1 fd8399d95a5cd3d7b2a29a967c7ab55480d785b9
SHA512 c8de9c2479e97dbf9b5eae03679a3540524e1406eba2d52e940794a173bdb79f2a682ba38b4a96e04e96c30af8faef79bb724876a202703b3e43585beba00efc
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUobbDwzroC4q:Ob4YZnE7yTWg1NfwBu1janobHwAtq
TLSH
T14CE2EB3B680CCB7E4F804ADDEC29BD8A6DA8018F5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0365edaa-8af3-4b1d-817b-2f495edc6930\index-dir\temp-index
Size 984B
SHA256 9501970d6a29b7732927c46be8071617896ceb04beaee9013c4a88fe05d2c895
MD5 658f9d437921b0b800d363d836f27f8a
SHA1 8fac7d6ad8a8113fc245af68272d3ce316c610a4
SHA512 ef4643dde96c38922020bf233d24bde65ee01ebb16c3b5e8ff67e22fa564bfcdd50462f207e1c6eb78d3200e1fac648aebc016cf889311d1350e011340acb150
TLSH
T1B51144938CD39C0FDC27F87B2279215A373E44FC210CDF87002C78385D555285610740
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0365edaa-8af3-4b1d-817b-2f495edc6930\index-dir\the-real-index
Size 2KB
SHA256 64e41ac07d3030adcabad9f968a239f09e01f4b3d1802fb45ded22d037018f1c
MD5 980d28ce64a85bd00b0e9613d07f7fbf
SHA1 8de82baf3ab1cdf027c02f2668f75ed89bf7a8d8
SHA512 b0d82dc9f46062328edadb7f85c8dbe1cd6dfe203e6a4d79285312a0e10508d86e6912118af862494fa94b09ae3cc14ce6d9c8ebb63f1a4d774d6b2e498d6d87
TLSH
T1F951D74E1D4B1B27DDAC30B368B50485373578EE1ED94E0B39ACAA343CC321D1DD9914
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac0e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0365edaa-8af3-4b1d-817b-2f495edc6930\index-dir\the-real-index~RFe5ac0e0.TMP
Size 984B
SHA256 9db8ccf8c358b0e6a7bccdd65c5fee064d7d0739befc2cff2e006466a3759f2e
MD5 a0eca6d1a174ce3fd928134720d99387
SHA1 4984637ba04188e34a655f10e2ad46b622d9a865
SHA512 9b63f930d9b702df1e85b420e2ea3792044ac555e4a78c3988cfe363b098d460edd880e83f2340218490e91d75204acd7d195e7d5caea5eebb62102a83bb52bf
TLSH
T17B1168A34093EC07DC26A1B56259146F773FDC352158DB4B30AD7C7D0CA15349951E51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 b152c189b6d2fae3b49c93ef5237b0ac9eb7620cff9909815d2a950552e36819
MD5 75d1fcd9d44305c1ef55709c3f8fda5c
SHA1 79d3aba5a288ddd14575e431d1d11b1b3e23b204
SHA512 7e79812a9f4e84595ae4313e79e55453f7c189cd52c52f8674a974f1189c3b7f92694bd5ac644a8d79b5f02d17c5ff7de48d75cb4f3e71b3ebd25e85efa4ccc8
TLSH
T14FE0C0F72EF71C44AC2F83E52472A0B44041B8E8C949EC4F155696C310713157089D32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5882b2035822ccfbbc8c16fcaab833ccaf8575292bc2f34582ee292410ac1820
MD5 60283430d8267e05967e30acc5b4a48c
SHA1 2f9064ededbd0cdcbc77a3c970914670a66db931
SHA512 eec251e12618d0afa10fdeee3ff6e651c7421a0a685382c3fc6ea40888608512c8ffc3a1104a52a12e3fa3a4f8c18c62c36c39eedd46019d87ba6e30e31b12ae
TLSH
T1BCA002619A6DA089C5035BF194E95280F352BCD9154517014498A0ECBCE136365C5912
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b27a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b27a9.TMP
Size 48B
SHA256 e316b52bde2105ae6a968f8e5ec99ade54dafdac5a40f1d0d2e9f548ebc57ec7
MD5 0463fb966c566fbf42601485b35083f5
SHA1 44ef5818166a6d95b6275eaa12b6d884b6b974a8
SHA512 e170130ac3420afc5a6027892ed05246cad6def619d63a0b56844b7fb6b16fea10f58f1cc41c9d5d0368b93a3db4d51003039d586d95f63342e3c9bfd00f8bb6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 19bb9ce97f74b8d1a94505b37ceccbac90107e95ad95d3771d3327c7fde0543a
MD5 df33b4e732ae99589fc733e0be0a76de
SHA1 7d9aa860464684659f9033fe4ba8ee08f326c961
SHA512 cb61d16d7a9b674f1e7c87f5b879766cb1465bafd9b73f1d416a6342d5ea064b533cfc084e2cb041626dbf28473dae9597f473f7f7c8b8ceb0707034952b038b
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9H9P:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRk
TLSH
T177B25B11753F4290387EA90C81B8982F96C2B4637519F52F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ffb6e8622fd3b592a19e8c62ffb28c56759665979bcd3f3310cc4c99d488291e
MD5 ead2c74a0872edda76e96f5f9b296b1d
SHA1 bd43437a3a19e514f175b70ac17799acf033488b
SHA512 20e6045e9c30709512343420e74a8ebc324c0fc73a25377840b8d9a58f1268fc550660214e3dce5ae61b55bd441aa3529c13e02f4e5963e61dceba46abf3bbb8
SSDEEP 384:nJiFJZcIU8NLN8TUNTUlIRxTxvuTG7W2EqfbzGYnxmrm/h3Ua5tIsNq8LEEIzpfI:gFBUQNwghukWEGYxIOhksi1fZUP
TLSH
T161D27C32DC68CEB7ECEA5E89B64A7246DEF41063D58C9AD4DAD94E0C00875DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b66b24032a999b46f2432ff87c047e0325f50f67d52ff555752c6350ed024393
MD5 2b1e34af61d018fad23450dd9e198883
SHA1 fcb6634283043d4f51153702bec009f0835cac20
SHA512 75b3fc1c397292be88d01e1719aa73226bd44ac6d00095014d23f4da88512fb0e8012fb6447110c25832df4238b4b34b1862ebd271b579ad04d35479e670096c
SSDEEP 384:neiF1tNn/s3n9Sn8Ng98TUNTUlIRiPvuTuzREqfbzGYnDLEOObjI9G6w72D8LEE7:1F1j+9SX9wgUuQXGYHE29M20
TLSH
T13EC25B36EC59CEB7ECEA4F99B34A7646EEE0126385D86AC4EAC85D4C00C75DD4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c4eefdcfa16265d9fefc0026a6efe0eb08df22cafce5a47230f0cf2962d9315e
MD5 31ebf8d20144e169019625c7c4a223e9
SHA1 63339936ca2493bedd6faa24f43bbaff7910cbf0
SHA512 985252860087b33072c8ae526058df24698ee649195c598fac7d2bc63bea5e9532002c044631a893cc7c50bb4ad04db895ace2a04249812087fed5de1b65acba
SSDEEP 384:nZiFiZcI58NLN8TUNTUlIRtTxvuTP5tEqfbzGYnxmrm/h3Ua5tIsNq8LEEIzpfZu:wFQ5QNwghutzGYxIOhksi1fZUP
TLSH
T165D27D32DC68CEB7ECEA5E89B64A7242DEF41163C59C9AD4DAD94E0C00C75DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0ab954fce46f5a403acf2c8418e9da90c90cc9adc94ae1bf5e8d4528ae7b887c
MD5 88c20b9c0eedc16a9eeefcfae98557d9
SHA1 8c95fcc4dbfb04456359557b3ec256d3f6891b5d
SHA512 a3c0b98686b237e022689263ee4a2b031e3d4ae1c0c87862c3e575edb0592d798f81906f34d95fe964e2da46c306d2df453bb4676087d8ae9b99abbdcf4e7021
SSDEEP 384:nJiFiZcIU8NLN8TUNTUlIRtTxvuTG7W2EqfbzGYnxmrm/h3Ua5tIsNq8LEEIzpfI:gFQUQNwghukWEGYxIOhksi1fZUP
TLSH
T17CD27D32DC68CDB7ECEA5E89B64A7242DEF41063C58C9AD8DAD94E0C00C75DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 36b9d6086a7a17e6f8b71273485171e9322e726d6cb53025d3b400c626c42d9e
MD5 00488e418680e9675efd358ba29faa9b
SHA1 2eb5e979b34a5e03000c251193c6969ac9d620cd
SHA512 1e4ddb209ccc77ef8bf366f8972136d01b24ebf29bd5014f3123c706dc74f4f107c0a9dd143aada7c3cfd001b9d93a501a89161ceab9b95c18dab20facd75ff6
SSDEEP 384:npiFJZcIP8NLN8TUNTUlIRxTxvuTGzW2EqfbzGYnxmrDrh3Ua5tIsNq8LEEIzpfI:AFBPQNwghueWEGYxIHhksi1fZUP
TLSH
T125F2A0F298D78976E8EE4B87A73D6D4299FCD053B4884A94F7880D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0c9994b59a3cbed441aafa585c994799e3a2d20b23c8dee338a432dacda95d22
MD5 1c6e01e8ef306e359a047f4edf794320
SHA1 cc6d52e9015f8f69335d07b245a91b491ec68581
SHA512 b00ba3a2db5336395e8a663ec003d857a97838c5ea2db602391e5850bfde56e359afb1033ae9e99e0ac3301827354fb0784a0e14d71396f65b722a9a3968cdc3
TLSH
T145E00443534540CCC07C41710013533017C3C03144540707CD0151407D313401F145C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fef8213292e1ea4bdff3ca04ce0be87710b81c85dabe1ec4e6e1c18c1e5ecfa9
MD5 c40a4b65f37863e4868748f90f09d448
SHA1 a10b484304906651e79830d42b2ff6ca74284823
SHA512 23657f7c1655fbaed16618de454d18178ffdfd6d52a9f894e7c607aaf90b3cd9e9c165f05de6871455be5aaa0bf34a98dcba134d97b60001d6d6316646dd01b8
TLSH
T1FDE00243534540C9C068437100535B202FD3C031456507078F2151586D313403E24680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b0bd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b0bd4.TMP
Size 392B
SHA256 0633803fa1b3a500f351f6cf68609449f061ce8ffe98ca6cbc56222fc132e85a
MD5 af60044045520468ea3f1e99fee72e83
SHA1 541878cd97cb4c17a992f6ca091dcb2ff7b78449
SHA512 7116dbafc0c918b7f391a9163e14f1fe17ca2b2e6c01717cf985c18c27e1903e18cbe9424693fe204bf45f005842dcb05f72657d219bfe43a2925881657dbd30
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

salinewin1.5.zip

Path C:\Users\Admin\Downloads\salinewin1.5.zip
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3688-2-0x0000000140000000-0x000000014238B000-memory.dmp

Download

memory/3688-0-0x000000014065F000-0x00000001410D5000-memory.dmp

Download

memory/3688-1-0x0000000140000000-0x000000014238B000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads