redline | 16b88051fd1e27d08d1408bb51002dd25edb88292807a92ee25ba5f4c0895b8d

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

415KB
MD5

bf58b6afac98febc716a85be5b8e9d9e
SHA1

4a36385b3f8e8a84a995826d77fcd8e76eba7328
SHA256

16b88051fd1e27d08d1408bb51002dd25edb88292807a92ee25ba5f4c0895b8d
SHA512

a3f8deabbb35e4d4928ec6cf836cdef1a57aed879ce10646d3f8cd9cccf93c0c80c89d1e82dc6c9c558f61429eb6416f5ecd8235f8933f90db6bb46f7cf165ec
SSDEEP

12288:zKtCclgms3mGmGmGmuuDLc36h65QoZ5MEK2sq:GR2mGmGmGm06h6w2sq

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4932-1-0x0000000000580000-0x00000000005DA000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
4996	msedge.exe
4996	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4996	4932	tmp.exe	94
PID 4932 wrote to memory of 4996	4932	tmp.exe	94
PID 4996 wrote to memory of 4028	4996	msedge.exe	95
PID 4996 wrote to memory of 4028	4996	msedge.exe	95
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 4992	4996	msedge.exe	97
PID 4996 wrote to memory of 3140	4996	msedge.exe	98
PID 4996 wrote to memory of 3140	4996	msedge.exe	98
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99
PID 4996 wrote to memory of 3996	4996	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=tmp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff9bdd346f8,0x7ff9bdd34708,0x7ff9bdd34718
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14560017835351196186,3147748051487503121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=tmp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bdd346f8,0x7ff9bdd34708,0x7ff9bdd34718
    3⤵
    PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
caf1abca50fa31d29aeb90c44b141858

SHA1
022b8917274a6d835e9c325bde0275ab324fb961

SHA256
ccdf755889318255d4d1a39e88e2bdd02d5c661ef82b6bf7f1963aa47b22532f

SHA512
cdc953df3766feda27132dc1ba08c5709b095b63d4695b2cb4daa223e0999124e77e3e7fe2d1964eebc822b6a3d19c57066c10ca0e3cdac2788b6748a9bc14ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f75e840c094eadb06cfd1ccf3adc4e99

SHA1
0eb91ef706110d32861449af6588edb4409f36c7

SHA256
e9a5bab38f949071fe2c6c93f5dd315836e376ee7aaac43669051252f4711847

SHA512
a4586d07282233263cfcc340f453c3aae53dd21156f7638dcca452560f99ba8d2fb06483263e67ae04f9b33f5ec2d5d8dd178684663d872b0959fef28dc98513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
05b403893e99b9ce4f89cff819aee1c7

SHA1
c107b9a9fed63c21a22c1862e3ac3a61490d27e2

SHA256
ff5fd86486c75ce7128dc1e37fe3034215dd8fc3934c31c3c2e968b89e4a1271

SHA512
b2fc2e5c8580e24a245e9ca718080e56b9bba739d96214c62bb6d198b35261b2d853b282d51c69a29ef7d9b12f3ad4fae8f637b494526a0ec27318aed751cec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
799cbe5aef04ec4d15ba2839577aa66c

SHA1
e21d89ceee31d90b01070953ee3912bedc5df4e1

SHA256
ddf4259035ebdb5e4eca62e29b2de496b24ee43548fac7521d41cc2f58490f06

SHA512
5f5a1abfd1a48a0188115ec078c72c37a4f8bdffd742936dd72fad7e7a620340a5b08afb69376e6227131e9c95ce166f9073b2e79c0a4e652cbb06fa2c29d138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ac1f16dba4b65e67dd279133f809c6b4

SHA1
09f4f22920501dc56b8e867c01db48efefe07eb3

SHA256
b3db5d0655e668dd0fd5c0fc8fd23182bd4dfba4041cfdfe6cabb4e1ef94a535

SHA512
c50d2d72815dd590a0e7240f4c28013b7254c6a9b573d9a95cf6abf90963aaecda00e9dbf1dd28dd00683f005dd7afb94dd39ab0f3589ca0cbc4ac4ee32def4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58501f.TMP

Filesize
203B

MD5
a6ef7ad24541d0224df7b8244354ac54

SHA1
389fc158ccf5e134219cbb222fe2c167a1e21079

SHA256
3c5e2051042f229f9f1fa1f871f35e8c3437be880e26e3a8f74af1284222aac8

SHA512
37f4886f32005c5f69fdcc8d32140eb6bb790cc59ccde545eb97ea67dff7728dd18aae02dee10df3e58fd0ab7813aecd6e44a44658da12eacbda29968c1358fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
1d570601bfc65a98f1078e86e532c90b

SHA1
aea1dcf13364546af29f58e38f731a29cabd47aa

SHA256
3cace587f51d9bd6b4094974abb61bd40ed0abd556b3b651186076495439f8c2

SHA512
79ba0e3fa70f12b4fb63724b2d8b234196df950b985f71f6e09e93b4391b6d23f556edf762f5832e3f766f82ee1fdeb6c99753283d951c369886c89c4edb38ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
532e65bf5470b2eca1da49d727cf22ed

SHA1
20abbdd64650eb7ec364de890fa4a4b4fac14145

SHA256
ade1df0a085637112399f4dc2c4434b267647f3541c1aa453d0b19a7d6f46c04

SHA512
0b6ea49a4c751574f795940f5a2ddee0bf3a0c014064f8bd49e5c6f07be28cca57fa26adf497980d6092dcc527d711d594ca57af034a797b05230ff98dd17824

Download Submit
memory/4932-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4932-1-0x0000000000580000-0x00000000005DA000-memory.dmp

Filesize
360KB

Download