redline | dc5cf343121b5e6ac962622babf726b1ca590760793396176546bbd7420400a3

Analysis

max time kernel
170s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac8f7a45a57c16b994a015d3cc3c4071.exe
Size

422KB
MD5

ac8f7a45a57c16b994a015d3cc3c4071
SHA1

0cdd6bfa4db900674addd15d294798417dae5c1a
SHA256

dc5cf343121b5e6ac962622babf726b1ca590760793396176546bbd7420400a3
SHA512

85b1e73b0e916daa145a480275ca68c40ca95ea8b3f0e28d7c97f5c7d203bdc320e73c6c0be3d7ec00da4fb25a7afdb7a39692fa6b9c2c3917079e78489a830e
SSDEEP

3072:QUaWHhdKJMcrUnx+he4VSp4qbrJ1OZIaxzZiqqowg7xrD5XpYwNLx:QUXh4HUnYQSKazUUpN

Score

10^/10

redline 5844778753_99 microsoft infostealer phishing

Malware Config

Extracted

Family

redline

Botnet

5844778753_99

https://pastebin.com/raw/8baCJyMF

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
2820	msedge.exe
2820	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2820	3860	ac8f7a45a57c16b994a015d3cc3c4071.exe	89
PID 3860 wrote to memory of 2820	3860	ac8f7a45a57c16b994a015d3cc3c4071.exe	89
PID 2820 wrote to memory of 1428	2820	msedge.exe	90
PID 2820 wrote to memory of 1428	2820	msedge.exe	90
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 4772	2820	msedge.exe	93
PID 2820 wrote to memory of 748	2820	msedge.exe	91
PID 2820 wrote to memory of 748	2820	msedge.exe	91
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92
PID 2820 wrote to memory of 2904	2820	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\ac8f7a45a57c16b994a015d3cc3c4071.exe
"C:\Users\Admin\AppData\Local\Temp\ac8f7a45a57c16b994a015d3cc3c4071.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ac8f7a45a57c16b994a015d3cc3c4071.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb84646f8,0x7ffcb8464708,0x7ffcb8464718
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:1
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11255515323239810853,12038710060254297416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1368 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ac8f7a45a57c16b994a015d3cc3c4071.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb84646f8,0x7ffcb8464708,0x7ffcb8464718
    3⤵
    PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
387f2418204c2049b1bb5670e3760424

SHA1
e0d0095a389efe69f5c2476548252ef4d1ef2312

SHA256
860d6eb667729eab70b8437e26767fa1fd7e559420bac96d4831089370613366

SHA512
6a0e699f99cb665c6113854b4b90202873a90907c643b70211816b17d5460f96c9f3b8d22facaad79287be9e12475cf51199c605275eb6e1201f2e592cc40714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fef0a707f4846c85c65cc55dff2d288

SHA1
5e5bf32b74fd382fc1f9ea5b11bace262275f089

SHA256
428c5d83fa1c7bf68676087743abd3f9789d55978467798d77dde98e901c887c

SHA512
8bad919135c60a218cad646c0d96b231c24c7b3f34aa557836ab0bcb6c44d037cc7040232a2a948335a66c114f7e6ae7b752a28381ca418ce1b6091ed2fa63a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c7bc48dd0beee384c5b7ab0c01d4b0

SHA1
2fca7f624735c3bf3537334ad765ccf7e91bac8a

SHA256
46b5e2e06c1aa3fdeef4dcb763b489ac267b0d25f4d3988bc8cfc4e5b5622bd4

SHA512
a3dad4ba62167755aa96e733140a8b4e96530adb0c29410502c7ce66c07e54ece1a9acd0777d9f4577b5298ea6df87d69cdef20beb0bf657a91d41fb9f693bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa98287722fc94285810aabcc514b217

SHA1
64455d94239e869442462819ae0ec5e034db4f66

SHA256
f1a67a9c80767d3dc65e1be9e20e3676660fb87651ac7fa00cb3ab72b6417701

SHA512
6d90497febc90fb773509057fa2944952df3ae0d51f9f72b9a245087a10ffc9c139291e68efc4fc6dfb10715a811afc44247431138f9e887d526599450ecb6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9df34be3390530bbd9abbef23a34729b

SHA1
952d131e43774240c918c7e2c963f6d3c45d3679

SHA256
532df6c1beccac89873e23e7a038c2c27675c2c1098acc13d0f9bc2e8a6d53d1

SHA512
0ab1ae4d9df70e13e566a72845a13e9654f37788758c250276203fdff2672419f393536cd0503fad3a10e01b63c5350456f339cbc3f9a4825f7532383986e521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e068.TMP

Filesize
203B

MD5
13e27d440d36e9f8379e01f797c4b3da

SHA1
303ec547347c266d2d695596a7d54b3268ad47ae

SHA256
14ee164494238dec3330359d8b5a3336e8a7d06b3e823b49d8692cddac586ba6

SHA512
1c6d43f89a9364a7a616a84cc2bb5a8a78615f0177b32a4e4a9713ddc3cc28cf1aa1b9a02b1cc461266b2f0ad830e3c7c37ca290ca6fa03ca83925dda7a9e8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7d689eeaed83b441fc1e87097115db5

SHA1
f03bed43cb1c15310882bcffbe843c61283a900e

SHA256
bc301359530ae1ab7219ab9a1af7a41c7270b35e88aa6a6d853181d2aab2eb8a

SHA512
b2c469d50243e352463761194873189775cf92e8799c03a423571192068423addbca9ab742cef79993a85c62ea071a1de6de2b41ae2d33d2c555b51030e350c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a601c2475dab9e4163197b253e2b33e

SHA1
4db087a9309444b8f4dc7f4083779da8b74547b0

SHA256
f585e828bc08fe5a6bcdfcb8e6e73cc6568fe9df3d5ab95c307a35cc4e1f30de

SHA512
bc910fe57577f98aa8a8df30d6d0be877450b0bebc8f92f0792b412210e80e44736e42e7a8c45d7fdbda992430fea7d80db8b04110cadf8a97b5be0215d9841d

Download Submit
memory/3860-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3860-1-0x0000000000680000-0x000000000069E000-memory.dmp

Filesize
120KB

Download