hxxps://github[.]com/pankoza2-pl/salinewin[.]exe-Malware/blob/main/salinewin[.]zip

Analysis

max time kernel
182s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/salinewin.exe-Malware/blob/main/salinewin.zip

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
66	raw.githubusercontent.com
67	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5928	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
4020	msedge.exe
4020	msedge.exe
692	identity_helper.exe
692	identity_helper.exe
2416	msedge.exe
2416	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3116	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
5928	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2284	4020	msedge.exe	84
PID 4020 wrote to memory of 2284	4020	msedge.exe	84
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 4120	4020	msedge.exe	85
PID 4020 wrote to memory of 5056	4020	msedge.exe	86
PID 4020 wrote to memory of 5056	4020	msedge.exe	86
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87
PID 4020 wrote to memory of 3168	4020	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware/blob/main/salinewin.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f5e546f8,0x7ff8f5e54708,0x7ff8f5e54718
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13980908058116647511,13968541126843759592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\salinewin\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5928

C:\Users\Admin\Downloads\salinewin\salinewin-safety.exe
"C:\Users\Admin\Downloads\salinewin\salinewin-safety.exe"
1⤵
PID:5352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x298 0x3cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c27f5cb935bc15da46934262f5cb6424

SHA1
9736e205447ba634b1fa24bf7b6c1c86320484a0

SHA256
db3dcd3e70a0b25b5f597ae994e6786e7f7396a4e52bf01c8da992b92f8bbdb8

SHA512
a62bb089491bc426892ddb2b964a4c7eea2a865448ff54ad28dcd7f28fa67c11e7b204eccf6b2d38991fe01457a1761055bc0920459e06261eae7969daacda46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1269f0ad050b39d2a457a325c872d4af

SHA1
08c677d7db4ad857077bb2377b2704c9bc9a02e1

SHA256
efcbe766d44527d05e96276199fe6aa8bd65bf8a90277bdd43ee9a1370afdaf3

SHA512
39087aafd45a6dbf83afd902055f82cdddf21f24041ab4160dacb92a9a518f18adebbd53de50190997bd259d26b8ff2fd6c261d255568943f48cfead09a3752e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
c746c21f55a8d7470395f433af7f9e8b

SHA1
ebf1afac2be2aefe1ed267dd4447a047f2645b41

SHA256
4a52503a538b09ad33effbbd2f571f258b63e4ed5d2fe1cbfea33d3c1a587e31

SHA512
e19b266cea57b1cd61039fe961d0afebacd23fe0bfe9765592767da40ce589740963f4d9796fa3256fa7de88c026f52861b4530ed9e8f4c93bbee41d9aa8a699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87fd484c627fa8ae3cc1b15403c75488

SHA1
26157fd3424964d73e1e10369487ae017ae55312

SHA256
75700ee352ca395b1dcf3dc31b337778b6b71f0193b23a4e17af8292d184b357

SHA512
fa22330a95525fe1879b2240e36d0c0b7c0547373e84af0efb2c8f5e1f90c97e7ce4254164ff5e0e2311368fb392587a9401948b5bb0e7ed4bdc4815587e9ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73c6749d1c733949c9d979e090165f6f

SHA1
a8417de269c9b9d83b3ac617217108cd559c8fcd

SHA256
4690903bebb186bba30c5a81433d1bfc7462efb8b426fc9d24997d3ca2b03cd9

SHA512
748d5b17ae73cf774ee3011ec828511fcf3f335f851c7fc0a204f9747f8f89ce9d692de1707d2fd179ed055847ba9d9b6fa74676125727e4fd3aa43377b71ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
91dd824d8023845d5ae6c3c82925c1ea

SHA1
5ab3ca88cd5289d0e793cae1a2c2162ff4c2b3f7

SHA256
be059449d82b7b8f9fd74046a82c4db5c654afa94b685ad4d6333d66d8a40101

SHA512
f0da40cdf42cedcbd10c3b70e7582c7138cf9b2f99379a7cfc77bfe2cd65ef185b93a0aa9d5476cb269b2bdf649f7f8b8c21d42c664c35669aabb59fe9057621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582074.TMP

Filesize
874B

MD5
d3bd50a8af71691a974ab72a60330c7f

SHA1
c15bb9e5b785a8448c4093ddb636280f3a8973c4

SHA256
50095530953da51b7398aee9d1ba0cd8d8c585ddcbebae9417d9d95e6b42116e

SHA512
6c6712baab63524f7518b0857818ff63fbbade98a389d8373706dcc80011d33973c2691f33a97a260ec40d8e82b0d9ea0d9aff012cb1ce0bd18f8613e4fc27c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3e6d86a-5b84-4189-8784-07347c4d092d.tmp

Filesize
5KB

MD5
acb99e1807e1c84c0bf4fbc7fdd0592d

SHA1
96b42eb853cca979eb27719b06bac554f87fa6ca

SHA256
279010806367d46c496004812c19bec75bfb590f6e6aef7fca97a9690c8e3f73

SHA512
043386a0b426f23347c02cd4195068de7549664727293e5549a8d4f4092d958b5e207829bc9aaaee4219eb9c7e5dc3f9bcd5c5bf2f75342c58c8a5e122a9825b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eab2f68ad5814a9e5bfd9d944f12a868

SHA1
c0bcfe628f977adfc0a36e14302640ca1adcce5e

SHA256
b663bc8b6d6202858efe6f399bb4ab2ac26ff7e3766bf49ecb6ab2333687d689

SHA512
10dc58d80688dee2822de15b19ea25d0ba73420b92c0d0b7d58ed2352a09e694db72feafdbd609a6a5cda16b3e70d73fcbc7c7c1f9c8d0a7c02a08ed618738fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
628c3990469523436d0271c63711f66d

SHA1
62d9a27a8900daccb701067b8283b7a668a8bd34

SHA256
4768792b764b93fd6efd35288394ac94987d1c599ae1675942a249309429a339

SHA512
6e9b806a84347c35375a1e9fd13988239a491e1fd18b7a23f13a67e922d97db79f5fccccea53bfa83eb785b1d6ee733660e04e9fb9de95a9a705ce935f456773

Download Submit
C:\Users\Admin\Downloads\salinewin.zip

Filesize
203KB

MD5
19a966f0b86c67659b15364e89f3748b

SHA1
94075399f5f8c6f73258024bf442c0bf8600d52b

SHA256
b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d

SHA512
60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427

Download Submit