ce55ae164de4262f2965ff38947c51bfc4aecc873a5575f0bc11175f6542b2fb

Analysis

max time kernel
60s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Inx Obfuscator.exe
Size

1.5MB
MD5

7bc0dde468bdc34ae9ec694a0b047239
SHA1

e43fff1ac8ad5c038577f3289452205ebe75f271
SHA256

ce55ae164de4262f2965ff38947c51bfc4aecc873a5575f0bc11175f6542b2fb
SHA512

386e2d369ca83175e0c5fb40bc020885f2caa940d4e027d1ff76d7c767fec392e157b5f4f0e0df3a31848c636af1336899dc40dbef2f6ba697976c475796c780
SSDEEP

24576:1Q0WKMeVS0FUQHZcHtYlURS58dNvRsOY5jEuBj51phTODD+U5dWVV:GhKM70F/ZQtkXsN5rujE

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
107	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3588	Inx Obfuscator.exe
3588	Inx Obfuscator.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-701583114-2636601053-947405450-1000\{DCA35009-76BB-4E1E-9E5B-2379FB8B27BA}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6024	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
384	msedge.exe
384	msedge.exe
2260	msedge.exe
2260	msedge.exe
3792	identity_helper.exe
3792	identity_helper.exe
3108	msedge.exe
3108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5932	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1228	384	msedge.exe	100
PID 384 wrote to memory of 1228	384	msedge.exe	100
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 2312	384	msedge.exe	101
PID 384 wrote to memory of 4544	384	msedge.exe	102
PID 384 wrote to memory of 4544	384	msedge.exe	102
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103
PID 384 wrote to memory of 1292	384	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\Inx Obfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\Inx Obfuscator.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd140246f8,0x7ffd14024708,0x7ffd14024718
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,9372721446783696919,1889851043568782828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5844

C:\Users\Admin\Downloads\salinewin\salinewin.exe
"C:\Users\Admin\Downloads\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:5932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:5980
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:6024

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x50c
1⤵
PID:6128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d628980f7da669c9a2b27dc961842702

SHA1
1d39adcd129a374350aee6a5a54b1103e29439a5

SHA256
95835d3e24367ab3181906263b01016f52bb712a80f6da52d607053251729f05

SHA512
3da3e861474fbce57ded7606cb7b21385c2cff8449aba7674dcfc5ce0749ba5ceb4d4a5ff569f3c355c39491162731c3eec629ab6091fa7882e100d7140a9b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
948B

MD5
eea2f44fd80a6ff2ca84a9fb9aa7b7fa

SHA1
7fe65c62c78493c390cdbbc890b80904cdc480e4

SHA256
3a7cd75413980511d2ce1ea30d8a8b337497897a7a1e016e2642a25e7eda62bc

SHA512
84d1088d349d5796abcbc1e64c62195cc5d2da55eb7534781ab84096448b76139a31396224140bef2e3ef42b0671d7dbd9e8bfbec82c7509a4624f2b9e15f462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36140ca131a56c5f1b25fe55ee41d47e

SHA1
bc6f8300fdf74453260065099a8baf047a4bbe96

SHA256
a26409bc879b8da99c8feda6b7408971f340cd66652a01c058b18ff29cc49df5

SHA512
b3587512658be4f0c7a6ceb3357f7bc80fe921f6eacb12ae4f793e33156450a373d5cd0160e1656298c055d63cefcfd7832e61005273997d38edebda1710b6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f04abe00b2466356813019c3f639915e

SHA1
53e9051d72d96889c10aa48c5d89e8bbe276e0c2

SHA256
c64b29205575adad09de39269e74648e6259530b5b93654c701a2acf747c0699

SHA512
66746da5a903fd677c08541aa31b2813cfedcb4b92400f7e5431f8dbbc8987a651264a157023e248e7b9350b6fbcd45a06dc0c2c66173987e5c887b2b0c35360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f56e13ddfff324e72fcbde340dfb6036

SHA1
cd9ba1a28469661ad289df0721e15a78a978225d

SHA256
e6f4ee65018a98e221f48e378d3b88d26b69d6036f12eaddbfada21a68a0feb4

SHA512
1025f8ac791c73036dfb307574923ab9e5f6f67f516f0ec0527f3dfcb9dedfe4bfc3f43a9e526b23496df2c328e0d067ac346e8341436931d26ea377183c8429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
843e8199ad917d425df79cf70abb583f

SHA1
900e4bec423edb4a288f3f1b2d6d07386bce8823

SHA256
923429894491f875e6d67fa0b13c026295a21b1df8a3663c35c8502eace69041

SHA512
1433de93f2916da434a2ce0aa3a49aa6068670854bd0882f22ed1c0c6e97c34c5b1e54f60346751b973f7b6a4db95245228ee40402a49764dea73c275d040611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b82.TMP

Filesize
1KB

MD5
5df6746fc3474d971284a7ae53337d2e

SHA1
51b15d9d89524a2a33e306f356e26f82fc95da84

SHA256
f71332dcac3748c0127f79fb8455a18afdf53ad965091e283f1a4fd71fcbfb57

SHA512
def21f838a6fb15694fa9bd17ce5818f0a67bf6b62d130c4c13cb49244b4089b98d6da67f467e2f98f973651712d34b86877a04b576694968f5d260ab163e1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65a52b57ffce3ae4a88e4fdd98f0d98a

SHA1
3ef2750667dc74d840cbc6c0fffa4bc7d00cb7e4

SHA256
ec05d67f60dded3f48f270e7abd6a5052d0d6ec760169aaaa00629ce9cdb59b3

SHA512
352bca1962c46e9854e08c374f0df9e980ea317cfb546393f584480bee1a21f2f7e793598ee054e5500c12823f8590f9a718c8e1cd669f7c68ade027441e3b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4289f8f361e96fc89259c90a5c345dd7

SHA1
cbcd8c47841928eb53fa6bf95182a37be0bc95bb

SHA256
b87c3667ee9889015b5f933edd2762d5947a0a5006c03649320fc7b06fd0e670

SHA512
607d2877341b835b41480343bf8b84374686631fc0e6eda8e2d7a955f97cb1bb18ad3a924ba4bdbfd0c2aa25f405514d0712a514ae510dcf23ed7c1af09ab23f

Download Submit
C:\Users\Admin\Downloads\salinewin.zip

Filesize
203KB

MD5
19a966f0b86c67659b15364e89f3748b

SHA1
94075399f5f8c6f73258024bf442c0bf8600d52b

SHA256
b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d

SHA512
60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427

Download Submit
memory/3588-0-0x00007FFD14463000-0x00007FFD14465000-memory.dmp

Filesize
8KB

Download
memory/3588-2-0x0000022F42F40000-0x0000022F42F41000-memory.dmp

Filesize
4KB

Download
memory/3588-1-0x0000022F40F90000-0x0000022F413E4000-memory.dmp

Filesize
4.3MB

Download
memory/3588-3-0x00007FFD14460000-0x00007FFD14F21000-memory.dmp

Filesize
10.8MB

Download
memory/3588-4-0x00007FFD14460000-0x00007FFD14F21000-memory.dmp

Filesize
10.8MB

Download