hxxps://github[.]com/pankoza2-pl/salinewin[.]exe-Malware

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
255s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/pankoza2-pl/salinewin.exe-Malware
Sample260802-b5wbnssamd

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	salinewin1.5.exe

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
112	raw.githubusercontent.com
113	raw.githubusercontent.com
114	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin1.5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin1.5.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301102302159172"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{5F7CDC00-6364-49B0-BB6D-A34B460C3C57}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
452	msedge.exe
452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2944	salinewin1.5.exe
768	salinewin1.5.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2228	3188	msedge.exe	85
PID 3188 wrote to memory of 4840	3188	msedge.exe	87
PID 3188 wrote to memory of 1892	3188	msedge.exe	86
PID 3188 wrote to memory of 4840	3188	msedge.exe	87
PID 3188 wrote to memory of 4840	3188	msedge.exe	87
PID 3188 wrote to memory of 4960	3188	msedge.exe	89
PID 3188 wrote to memory of 4960	3188	msedge.exe	89
PID 3188 wrote to memory of 944	3188	msedge.exe	90
PID 3188 wrote to memory of 944	3188	msedge.exe	90
PID 3188 wrote to memory of 4932	3188	msedge.exe	91
PID 3188 wrote to memory of 944	3188	msedge.exe	90
PID 3188 wrote to memory of 4932	3188	msedge.exe	91
PID 3188 wrote to memory of 4932	3188	msedge.exe	91
PID 3188 wrote to memory of 3684	3188	msedge.exe	92
PID 3188 wrote to memory of 3684	3188	msedge.exe	92
PID 3188 wrote to memory of 3684	3188	msedge.exe	92
PID 3188 wrote to memory of 3952	3188	msedge.exe	93
PID 3188 wrote to memory of 3952	3188	msedge.exe	93
PID 3188 wrote to memory of 3952	3188	msedge.exe	93
PID 3188 wrote to memory of 4988	3188	msedge.exe	97
PID 3188 wrote to memory of 4724	3188	msedge.exe	98
PID 3188 wrote to memory of 4988	3188	msedge.exe	97
PID 3188 wrote to memory of 4724	3188	msedge.exe	98
PID 3188 wrote to memory of 3824	3188	msedge.exe	101
PID 3188 wrote to memory of 1716	3188	msedge.exe	111
PID 3188 wrote to memory of 2456	3188	msedge.exe	112
PID 3188 wrote to memory of 2348	3188	msedge.exe	113
PID 3188 wrote to memory of 4116	3188	msedge.exe	115
PID 3188 wrote to memory of 4116	3188	msedge.exe	115
PID 3188 wrote to memory of 4116	3188	msedge.exe	115
PID 3188 wrote to memory of 2956	3188	msedge.exe	116
PID 3188 wrote to memory of 2956	3188	msedge.exe	116
PID 3188 wrote to memory of 4684	3188	msedge.exe	117
PID 3188 wrote to memory of 4368	3188	msedge.exe	119
PID 3188 wrote to memory of 4368	3188	msedge.exe	119
PID 3188 wrote to memory of 452	3188	msedge.exe	123
PID 3188 wrote to memory of 2484	3188	msedge.exe	125
PID 3188 wrote to memory of 2484	3188	msedge.exe	125
PID 3188 wrote to memory of 656	3188	msedge.exe	126
PID 3188 wrote to memory of 656	3188	msedge.exe	126
PID 3188 wrote to memory of 4032	3188	msedge.exe	127
PID 3188 wrote to memory of 4032	3188	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9b409c188,0x7ff9b409c194,0x7ff9b409c1a0
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,4386292681658569397,2596900108726088354,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17611110143875894105,6393438909744096466,262144 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,15063704187214955264,1111728220466151208,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,17902570945624937125,7925284084296644096,2097152 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,5414175304530991826,4430488450179543484,2097152 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,1009513461702297144,9905395061720939554,2097152 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,1160325035612633077,10815020060916376287,2097152 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1962489776885714932,14820875125130972973,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,9900446614287278239,4941154424659001919,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9203024005523210863,2543610143893857290,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9203024005523210863,2543610143893857290,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,17557140753930329584,2662239304270089247,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,11827369114124408290,1082891578318533719,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,12287191926305284947,10664966622929067569,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5180,i,2468573782534885021,14721061384431990904,2097152 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,3351151974447659015,1752235563343094786,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,2640173522565524618,8461194224826371080,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,10849283788641099339,18442865766549226134,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1236,i,18141096151323340653,253841234876351844,262144 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17020674255660355283,14621270247356379977,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,7982060017604105032,1090624549587056611,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,2741160591327717242,5440545384078686517,524288 --field-trial-handle=2272,i,13622948620383083951,5731008230095745887,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1828

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe
"C:\Users\Admin\Downloads\salinewin1.5\salinewin1.5.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x3d8
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d3cc65f-6d4b-4158-aeef-0ad325f904c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d3cc65f-6d4b-4158-aeef-0ad325f904c6.tmp
Size 19KB
SHA256 ab2a46b0e01cc4fa7ff5de3068a4a5041df990db051b98675ede7bc6baa61159
MD5 178ff782b7f008966d5613d97562402f
SHA1 5c3a6db800999c9e8ae2f9bb0487c1421b80a1b6
SHA512 1f81bf997d1bb2560cde666cc77b6566e88e35d5a770cc2cebd8c30b8694a832b1d9368fd72dd65986c898dee5994e1346ed06aa97b3d09e07c92b833a624ca5
SSDEEP 384:Xp3yFaeO8WsNQQNC/yXKEa+fd4a6UHYLUbFqeq:Xp3IzhWlCha6v6UHEK+
TLSH
T140928D356C786C7B5DA7B940F84B361BAFA44027D9DA3F90E2DE9F0D01CA2E81307915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 760bee8b8db574f70afd1526ab1a614ef930a3a901974411a130438c2a9bae34
MD5 20e279c26e003e9e48244651b35c95cf
SHA1 bd1eebf30324267ded110dd129564ec1bc0464ea
SHA512 42e42085fd3b9a2e00894ee973e46f990b769f723962be16dd2b04125f8ac0f19dd6953fd34d04c9e49db275637268c588f087879303cade6b4a016d96b3dd78
SSDEEP 96:Lg1943U7Et9RJzELhyvSU8qeGSBpljPgT5wf4NBs81cHKtTPTvaP:zDChOZIzPgdwQNBHx9U
TLSH
T1B9C16E3B95E16295D33A337082C2A4E4F8B03FF8F103DED613907939552579ECB119AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58dfeb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dfeb.TMP
Size 3KB
SHA256 597239c7d7edef9a3d623a54676cd31688da2e4617a10d1bf13154aaa64e3698
MD5 a0a907540d93ccb47a8a245f62cec6fc
SHA1 60367378f590b7f38878dd6a0061e5899c4340b1
SHA512 55e98d13c381a5ef28122dc425ea42f3446a9cbac4422feb7c55a59b991c08ac1bfdb6c2b71f8c5c5b42e36ccfefae0233dac03b49f828443cd12f88b7516157
TLSH
T15861D73409E14B95E36133B083D2A5B0F5641ED8F917EE862390B87D4624B6FCF156EB
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b97eed7333f85185365515d8d4a469487cfb3165804a8ba581531f0ff5f7c71b
MD5 7c6e14228bf062e584b7b174143f3e89
SHA1 45c6fd28d70febeccb380a6e218c2e188b0cfb04
SHA512 a046c1ff822b5695bbe50b5169fc18ff26c761522cbccb67deea0c0b653594d26c331cd0d2ccc04fa2dc135915349dda78ecc6fed631d764a39d012f11008609
TLSH
T194415AF787E1956D8B1256F0AA18EE1BCE2C0511831C787989E0BE57D3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b68291f944057429e86ad2fedd343f52e99a6324950ef9a84d00dd82645ce6b
MD5 aebac1a10e45e31960b3056c07769666
SHA1 092a72e062b475acb057a8172b1d912dc6dc60f4
SHA512 4cd34b51933f9b79319643ac8a5d6969429e734660fbe9e34c7dee9dd771a81abdb0bfe2d1dc4e02b0f2034fb4d2a67c730092c6f23344dd7f5e4ed7b6108fba
SSDEEP 192:sxZvRukZ/fRs82pIdp97vHW6+WNY0K/YCHs0rA3IgrJ:sxZvnZ/fRs82iRHbS/jBi9
TLSH
T12522E9526E28A97B4CCFD25ABA19BF13E6F5003291941E58EAFC961C05E7BDD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 be44d53f94046c0d8c96d04fd27e46590269bb751de5312b519a372b1b6ba9c2
MD5 b3d9b4fcb6b6dea6920618cf4fea3757
SHA1 cd531b37753e33b82aefb51e4addfa4422529e12
SHA512 7a9a2ec258333e1a60203186e8cdc7304e0a5054e7dd76c90a692551369e0e8910e7e278341ae7f4e4c48c6ed7c4728c151778a493437ba5f863ff594d0daef7
SSDEEP 192:sxZvRu9Z/fRspOpIdpv7vHW6+WNYkaXYCaUArA3Ig5fJ:sxZv6Z/fRspOiDHbmXcif
TLSH
T1C832E852AD24697B8CCBD21ABA19BF53F6F9003290D01E58E6FC961C01E7BDD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0db2f353efe973b79fbd46d724e4a267594d44509d1a25f9775fa7474fa912c9
MD5 b66adb9e3b3398aade202a04ecefdc54
SHA1 2c6aa0b11c4bf744715633d769d9177cc9731859
SHA512 03648883f7e2c3ba6fcc1c1a1666bcbd292c5deb17934f6b767ca360611c556a5c0059770db6c9a59559f790af39e20c0df3eab48822f7ed06b82aeeb7e2620c
SSDEEP 192:sxZvRukZ/fRsp2pIdp97vHW6+WNY0K/YCHs0rA3Ig5gJ:sxZvnZ/fRsp2iRHbS/jBiC
TLSH
T1CB32FA12AE38A97B4CCFD21ABA19BF13E6F5403191941E58A6FC961C05E7BDD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6a4d67b902af2e435922177357734930a0831a8846a1a705d09e7429ee410ec3
MD5 699a61c04bbfef0f80295ec31b8a4a26
SHA1 9f76931ea26f3c2dc6ed3a3e660ac87adc3d0f91
SHA512 43130d12e010797c8ab2bf020b7b32d06c8624b34e17b3a3c953474fcdf718f5f4b750bc9233a3a9814d51a0aa5d0af77fce94f5719c62bd067735f92b93d53e
SSDEEP 192:sxZvRukZ/fRspOpIdp97vHW6+WNY0K/YChirA3Ig5SJ:sxZvnZ/fRspOiRHbS/SiA
TLSH
T1CC320A12AE28A97B4CCFD25ABA19BF13F6F5403290911E58A7FC961C05E7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 da30d5b8e91d2cfaea6f645442cfe3eaf0881b2bf187c29921b149178a6c3828
MD5 c60f6e80a97991f2da1b0e972ee03729
SHA1 252b4c4fda7a957a5551b3583cbd99efca68d833
SHA512 0456fb58def3655eaa77334d4bb8c8d9e310f9ed7fa858f366299b6ce06f19ae78374f06448029589583d6003992a7675f7938a97fe7dfd86c07e32ca9de2841
SSDEEP 768:ieqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrtro7:ieqbUj+WvSCs6u1jaaZLbWrG7
TLSH
T145C2E93B340CCA7E4FC01E9DDD5A6F972EA802C767588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596920.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596920.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 45e6fcbeb8cd14238b0db35f5d88fee6f7eb682edf43dc4b7b20d575a3cc372e
MD5 e70ce43b14e1744c52ffc096cc36be44
SHA1 361358aed12456bb274c6259290914bf99adaafd
SHA512 e7f18f97b2d949af62b9d3866162c2c33c172c9950600dd377813e33a0111848c6b74e60dd0646a24c308ff52674daec5494c2bab6963538877a5e28d2d1d97f
SSDEEP 384:MriFM3yFaeO8a6sNQ8TUNTUlIlBNC/uXKEa+fd4aLUHYLUbFqeq:MGFM3IzhXlwgc+ha6vLUHEK+
TLSH
T1D2D239F258D7483AD96E5B43E77E3E179EBCC067B8952A50B3895A0CCD861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 aab7a74c0eafcdb5ceaa86608210e11d386e027f874298533e5864d18665407d
MD5 1de8be76b34f7775df8606529535dcfa
SHA1 8ab9dbd75d2869b6f6a184148d8d385071853041
SHA512 a3f1540fb765252b5f20849913201313901171882449a3317a9b6919372f4c675392f23b3c9ad44f8da0424f7d3040a3ce3f3abc85ed09fdf75020885d03b56f
SSDEEP 384:kp3yFaeO8WsNQ1NC/yXKEa+fd4a6UHYLUbFqeq:kp3IzhW2Cha6v6UHEK+
TLSH
T150928D356C786C7B5DA7B941F84B361BAFE4402BD9DA3F90E2DE9F0D01CA2A81307915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a517079aaa905a0254e3c0100da2809993e403054363285159e028ea2f728849
MD5 70c09adf6783412556d3e64371e19274
SHA1 70a1979bbf28a48ebb1a618eb561a36da4f3ce87
SHA512 dbd157e7344c3c65173509d1e789c51aeb12955eb6ee75a5c79810b2d1652dc01dcdb77859d8dbb2af7c1140cb0eca36929da66293c99c26cff4b875ad9ff851
SSDEEP 192:OzONh6DbgaQmiUyXyWBa+j4+FdCXmRy/FaENzYquHU6:OzONh6oWhWBa+fd4aEUHU6
TLSH
T17A121936A8686C7B5DE26544F48736135FE45167DE8E7F90D6DC5F0C00EBAAC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5bbc8d8fb3a30ba646774e086a9265be9482e93112bae4f30a853554f2b71006
MD5 d1a78eff909e2ee7240f2a5b03d607e9
SHA1 73c6676e666e4dea63053f6ac67a8bc1c247f5d2
SHA512 0d673168e0d6e57964f528d89d31bbc3aa2096366c3dea9eac07651e2e0f33ee469cce74f3cd0462f27ed2032710fb155c7d3e8ef6ce75900acc65d408157154
SSDEEP 192:vONL6Db6QmiUySyHBa+j4+FdCXmR2RgoiU6:vONL6u6HBa+fdF3U6
TLSH
T12802D735A8786CBB9AE26E49F88737276FD4103B9A962F54D6D85F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed3f96e8-ced8-46b3-8d27-d3a3a3d037a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed3f96e8-ced8-46b3-8d27-d3a3a3d037a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 22c0cba4042ceacccc279e745456a7b99048ed138780dced6335786f268bb8d5
MD5 738f825f782c08aa0682f571e75dced1
SHA1 af9c30f491407aa0df98a16bca5980a9f0448a60
SHA512 429ddb93cc533ed063cd9976fb5c42532227799a7fc4f479e35f5ff746bb06637a2d9c01e7a6db9c7c286fd2dae7db751917f98cdd0dc17fe9a1994563317ee7
TLSH
T103413A58AAEA1158B3B36F56ABF6787D447E7C772E0AD89E10010D4F0A66B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

salinewin1.5.zip

Path C:\Users\Admin\Downloads\salinewin1.5.zip
Size 202KB
SHA256 6ae2e736bcd1c612314ea49facd22f08753c6047763e7b62ef7abef9aa9d7ba9
MD5 065a26b3f9570081f54201dad1bdc0e2
SHA1 e311decefee96fc9afc2e96ccdedbb7b6bf5a6ab
SHA512 a5710b30641d22db9fc2174d1f4151c76d50274df064207f5817fb80f4d5fc3411621b54d5775da3973b607c228a7ad58b6a02b79a6fd56ac0ae7bb56aa0e706
SSDEEP 6144:oxNMcpOY7qY2Hglyi6x5LSBDdmz0DpQL/5:oxNMcpNWY2HEyF4/rw
TLSH
T186142375488F32D2E0A633C622DD06240D79C95F7333DD35C6F8BA5A6CD50296E42E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download