download:

/pankoza2-pl/salinewin.exe-Malware/blob/main/salinewin.zip

Full analysis: https://app.any.run/tasks/df5c1a28-b9c3-4dce-ab50-d2a709a35d23
Verdict: Malicious activity
Analysis date: February 19, 2025, 23:56:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
auto
generic
arch-exec
arch-doc
Indicators:
MIME: text/html
File info: HTML document, Unicode text, UTF-8 text, with very long lines (1616)
MD5:

17E2739E5EA18CF419340BC14F6F7977

SHA1:

D8EB9921893EF90CBBD982927C97BD163A44FBB6

SHA256:

7BBE24207F99EA333345288BDEE63774733C7970A71FFD933FE8412262F15BDE

SSDEEP:

6144:VbsHqpOL/saqkPV9FH2LqgIDSsmwC9WvZJT3CqbMrhryf65NRPaCieMjAkvCJv12:psHqpOL/saqkPV9FH2LqgIDSsmwC9Wv/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • msedge.exe (PID: 3032)
      • msedge.exe (PID: 5096)
      • WinRAR.exe (PID: 7108)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7108)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 7108)

    • There is functionality for taking screenshot (YARA)

      • salinewin.exe (PID: 2624)
      • salinewin.exe (PID: 3812)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 3032)

    • Reads the computer name

      • identity_helper.exe (PID: 2844)
      • salinewin.exe (PID: 2624)
      • salinewin.exe (PID: 3812)

    • Reads Environment values

      • identity_helper.exe (PID: 2844)

    • Manual execution by a user

      • msedge.exe (PID: 3032)

    • Checks supported languages

      • identity_helper.exe (PID: 2844)
      • salinewin.exe (PID: 2624)
      • salinewin.exe (PID: 3812)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 3032)
      • WinRAR.exe (PID: 7108)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6480)
      • WinRAR.exe (PID: 7108)

    • The sample compiled with english language support

      • msedge.exe (PID: 6480)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

HTML

Title: salinewin.exe-Malware/salinewin.zip at main · pankoza2-pl/salinewin.exe-Malware · GitHub
RoutePattern: /:user_id/:repository/blob/*name(/*path)
RouteController: blob
RouteAction: show
CurrentCatalogServiceHash: f3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb
RequestId: ABA4:3558AC:1DD2440:1EC06E4:67B66FB8
HtmlSafeNonce: 9a6b5598658ed04d57b77fa3d767a7f5d5b8dce4c2ff023df607d4553c575730
VisitorPayload: eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBQkE0OjM1NThBQzoxREQyNDQwOjFFQzA2RTQ6NjdCNjZGQjgiLCJ2aXNpdG9yX2lkIjoiNDMyMzg4OTg0MzczNDQ3NDY4MCIsInJlZ2lvbl9lZGdlIjoiZnJhIiwicmVnaW9uX3JlbmRlciI6ImZyYSJ9
VisitorHmac: 119ec4438c461b24bddccfc60bd4cad0558e6d2759ab88b15a6c306fa93b29bb
HovercardSubjectTag: repository:568209603
GithubKeyboardShortcuts: repository,source-code,file-tree,copilot
GoogleSiteVerification: Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
OctolyticsUrl: https://collector.github.com/github/collect
AnalyticsLocation: /<user-name>/<repo-name>/blob/show
UserLogin: -
Viewport: width=device-width
Description: C++ GDI Malware. I'm not responsible for any damages - salinewin.exe-Malware/salinewin.zip at main · pankoza2-pl/salinewin.exe-Malware
AppleItunesApp: app-id=1477376905, app-argument=https://github.com/pankoza2-pl/salinewin.exe-Malware/blob/main/salinewin.zip
TwitterImage: https://opengraph.githubassets.com/4042b16b7c9dec6b7b97ffbc2fc819bf2da98646440272faec53e0f0869e70d3/pankoza2-pl/salinewin.exe-Malware
TwitterSite: @github
TwitterCard: summary_large_image
TwitterTitle: salinewin.exe-Malware/salinewin.zip at main · pankoza2-pl/salinewin.exe-Malware
TwitterDescription: C++ GDI Malware. I'm not responsible for any damages - pankoza2-pl/salinewin.exe-Malware
Hostname: github.com
ExpectedHostname: github.com
HTTPEquivXPjaxVersion: b99cccea3e3f17ab6165db33c4f219c176f794a2c8fe67f288d694019566f099
HTTPEquivXPjaxCspVersion: ace39c3b6632770952207593607e6e0be0db363435a8b877b1f96abe6430f345
HTTPEquivXPjaxCssVersion: 1c71206221e00a0a8e77d94d48d954f34ddbd711c4a0ced954fd49cd786cfa61
HTTPEquivXPjaxJsVersion: 7e82c4220ec79a588b8ee4781df482abcc1877daea3d5e61982761c4d8d84a54
TurboCacheControl: no-cache
GoImport: github.com/pankoza2-pl/salinewin.exe-Malware git https://github.com/pankoza2-pl/salinewin.exe-Malware.git
OctolyticsDimensionUser_id: 77279607
OctolyticsDimensionUser_login: pankoza2-pl
OctolyticsDimensionRepository_id: 568209603
OctolyticsDimensionRepository_nwo: pankoza2-pl/salinewin.exe-Malware
OctolyticsDimensionRepository_public:
OctolyticsDimensionRepository_is_fork: -
OctolyticsDimensionRepository_network_root_id: 568209603
OctolyticsDimensionRepository_network_root_nwo: pankoza2-pl/salinewin.exe-Malware
TurboBodyClasses: logged-out env-production page-responsive
BrowserStatsUrl: https://api.github.com/_private/browser/stats
BrowserErrorsUrl: https://api.github.com/_private/browser/errors
ThemeColor: #1e2327
ColorScheme: light dark
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
206
Monitored processes
71
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs #GENERIC msedge.exe msedge.exe no specs msedge.exe no specs #GENERIC msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #GENERIC winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs salinewin.exe no specs salinewin.exe notepad.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs salinewin.exe no specs salinewin.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3528 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1080"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6108 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1292"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5324 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344"C:\Users\admin\AppData\Local\Temp\Rar$EXa7108.43749\salinewin.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7108.43749\salinewin.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7108.43749\salinewin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=1456 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1556"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6376 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1688"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=1496 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1704"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6776 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6520 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=2312,i,16310888779966113659,8971549300845674931,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 898
Read events
9 849
Write events
49
Delete events
0

Modification events

(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F00000000000000000000000000000000000000000009402050000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F00000000000000000000000000000000000000000000C0304000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F0000000000000000000000000000000000000000000B40205000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(3032) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3032) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3032) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
Executable files
52
Suspicious files
919
Text files
139
Unknown types
0

Dropped files

PID
Process
Filename
Type
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF142578.TMP —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF142578.TMP —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF142588.TMP —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF142568.TMP —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF142597.TMP —
MD5:—
SHA256:—
3032msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
157
DNS requests
157
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.11:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6432
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1740407875&P2=404&P3=2&P4=iJDH%2fjtfb%2b1Hli9W0ev%2f7kN6bQ2A%2bAmnaz23WyAsHAS16z3yQlkUGHK46yL0mJNgEW7hJ%2bMCiv8kO15rw9YJ7A%3d%3d
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6432
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1740407875&P2=404&P3=2&P4=iJDH%2fjtfb%2b1Hli9W0ev%2f7kN6bQ2A%2bAmnaz23WyAsHAS16z3yQlkUGHK46yL0mJNgEW7hJ%2bMCiv8kO15rw9YJ7A%3d%3d
unknown
—
—
whitelisted
6432
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1740407875&P2=404&P3=2&P4=iJDH%2fjtfb%2b1Hli9W0ev%2f7kN6bQ2A%2bAmnaz23WyAsHAS16z3yQlkUGHK46yL0mJNgEW7hJ%2bMCiv8kO15rw9YJ7A%3d%3d
unknown
—
—
whitelisted
4824
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2356
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.48.23.11:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
92.123.104.34:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.11
  • 23.48.23.35
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.34
  • 92.123.104.32
  • 23.15.178.226
  • 23.15.178.147
  • 184.86.251.22
  • 184.86.251.27
  • 184.86.251.9
  • 184.86.251.7
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.3
  • 40.126.32.68
  • 20.190.160.4
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.128
  • 20.190.159.68
  • 20.190.159.75
  • 20.190.159.131
  • 20.190.159.64
  • 40.126.31.1
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 2.19.106.8
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/pankoza2-pl/salinewin.exe-Malware/blob/main/salinewin.zip