redline | ad809b651757ec30585845eb9acdc5c335c8b36244397c8c1a23b1bf35a9648e

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe
Size

391KB
MD5

afeaa39b474fbc97ab20f75b90b340c1
SHA1

dab2838508a187d8c34fa1ca42b604b5cddd057e
SHA256

ad809b651757ec30585845eb9acdc5c335c8b36244397c8c1a23b1bf35a9648e
SHA512

ae2d0d0021ea428222b57a77d11e9dcdccc3efcd1972fa1ecb97c5390f150211d3a9244a8b31393cfe0f1bc204a0146457b7dc5b2d1325fcb99e1ff53af54ca6
SSDEEP

12288:1kUoRUzA/vZoMecqF2ksaSwRobhNnfwBlZRvB7Kpve2Jg0YBmgMyl361+5XFWQFB:1NSJQmy36yHU9q9l

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5024-1-0x0000000002090000-0x00000000020EA000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2568	msedge.exe
2568	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2336	5024	NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe	89
PID 5024 wrote to memory of 2336	5024	NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe	89
PID 2336 wrote to memory of 3356	2336	msedge.exe	90
PID 2336 wrote to memory of 3356	2336	msedge.exe	90
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 4504	2336	msedge.exe	91
PID 2336 wrote to memory of 2568	2336	msedge.exe	92
PID 2336 wrote to memory of 2568	2336	msedge.exe	92
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93
PID 2336 wrote to memory of 3832	2336	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87e7146f8,0x7ff87e714708,0x7ff87e714718
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5183802205109682429,13772948358643957904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.afeaa39b474fbc97ab20f75b90b340c1exe_JC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87e7146f8,0x7ff87e714708,0x7ff87e714718
    3⤵
    PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
36f194b9e6e54ab0d043f0001bbfe4d5

SHA1
ea098ab1eca07f8d7d73a564fec0d340726a00a0

SHA256
d678677395c59c14e5b3559d786128faea33eb4bad61cda4d2ae85b978e8d856

SHA512
ab766e6839b6aaf69a0f069dac1fd3e44d41acdd2eb0da20bc0f7f3d2c1788d149134bdfe2b2e2bdd46300ec7b6b3f1b0f32f016ed3d477fe5cd6bc4a702e3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d07ea03a5154a82bdd7e75d33867164

SHA1
1c3920b79a92eb253005a936cba23cfe253b58da

SHA256
58b3a28231b55f10ac6c2755c0b579ecda177c89d5ca395677589f94f82dc3dd

SHA512
d251fd84b10df1e02dfc32f4b978aa69d7009a2738c0a60c08d80bdf31928f601e294bdef5a77aab69075df3c0a49965713b1b27502e53e3a4ae099d7d86ff56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20da411bee0d65d8eb808b246910f38f

SHA1
37fd6f0301c9768e5db8a85fd26325796795e32e

SHA256
e907d5bd4992b8bad82b94f3d7144f570e35a996844987bc1bac276f114d9283

SHA512
0f261588ac008eaa18df057ae5b8615ea4a52f9dabbf8abf0d4907da1e31cc9c69ec5cb80d590b6fc36e652b720f28b5027d43fd7d25401b6985a5fff010e4de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
de083616e69b0a22299060686ef14c5b

SHA1
6f4ba8279c932e5af57189d7666048f4c77f3d72

SHA256
7059b704d9f1e0778370712403105c60b611b636d4990274d1c55e59d665ffee

SHA512
67f5e816608fe3896f2e3e58b800fb807167f5b2b4dcaeddf7991beafde5e61b49dcdae391da67aff92f501e85e6b28e587947ad8efb215cd331b4ce704166f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ab3f.TMP

Filesize
371B

MD5
eea981550ed71b1f87f75b8b80cbb1bb

SHA1
aa7956a03ebe9824d1810bd8b4ce053c2b34acfe

SHA256
348b9c6e285961f6de9985ce3995f013968d4ad9b5aed1afd1ab4c2efb71f43c

SHA512
9d8b37ef04ca6f391fdf0f9e74cfb0da9cab0536b8a9ad2c314331ce438f9446930171bed5877938b71ee5aa6b28525818717042cb1be4d348c117a7ae78037b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b27183ddc99db4778d619a80f500f8f

SHA1
d8d8f82efa1431aa90ddb23624a91418a95aa03c

SHA256
1034be67312b2100b9258b9e7406e89a7c6591733355320bb1ba4296e8aa6041

SHA512
527d45b4469a2dbd64518d287869aecb459332b11e867d772c8b5f2ad8b4e78405e9dd92925c01edca4b26dcb4214bcdade10dac7f0e1c411206d54c319857cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2dedb29a1bd1cb435c3b4e71c267d64e

SHA1
e47f3acb609e695ae3c4a622e9921d65ee7b5893

SHA256
66c41aefbd56ddf20d9aa1a8e520bf79e7dfa492c6020b99144abd08fdb83f86

SHA512
3f2f616ce14dfe03c41f52bca86e532d18628c0eb18789efbe25fd9ddc3cc1e4c38f08b0bb78a6ebb6d4c7c75b992f942d91decdf8964606425f4ad9a6c81861

Download Submit
memory/5024-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5024-56-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5024-5-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5024-1-0x0000000002090000-0x00000000020EA000-memory.dmp

Filesize
360KB

Download