redline | ec2ebe78e74c14e0c4501202df94bfe2a966ff560d367e37899b55a9305cc6ba

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1be014d414593a061836642ce7eaa4ae.exe
Size

260KB
MD5

1be014d414593a061836642ce7eaa4ae
SHA1

389c5cf54314e50caf35ea8f603ff8cf1b7013a1
SHA256

ec2ebe78e74c14e0c4501202df94bfe2a966ff560d367e37899b55a9305cc6ba
SHA512

ace61890c426bbca89b4587a405f25b5ce6829a8970f69e852b44098047163e08ac139414b3a3470906b4a78c60875bd4730d7c82eeafc7bc82c4b11be01541a
SSDEEP

3072:z0JUz8Kz6s3Y5IyTo3Zp7ix6tDmRB+Id7i9BO7enUMRjkvMt5:vH3YDQcx68Xd7i9BoeDAvM

Score

10^/10

redline @lightzee361 microsoft infostealer phishing

Malware Config

Extracted

Family

redline

Botnet

@lightzee361

vikaneleneer.shop:80

Attributes

auth_value
1c3c5d1241b4c1d5baf83287cc9901e9

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
4860	msedge.exe
4860	msedge.exe
3436	identity_helper.exe
3436	identity_helper.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4860	804	1be014d414593a061836642ce7eaa4ae.exe	85
PID 804 wrote to memory of 4860	804	1be014d414593a061836642ce7eaa4ae.exe	85
PID 4860 wrote to memory of 1268	4860	msedge.exe	86
PID 4860 wrote to memory of 1268	4860	msedge.exe	86
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3868	4860	msedge.exe	89
PID 4860 wrote to memory of 3684	4860	msedge.exe	90
PID 4860 wrote to memory of 3684	4860	msedge.exe	90
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91
PID 4860 wrote to memory of 2776	4860	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\1be014d414593a061836642ce7eaa4ae.exe
"C:\Users\Admin\AppData\Local\Temp\1be014d414593a061836642ce7eaa4ae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1be014d414593a061836642ce7eaa4ae.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc068d46f8,0x7ffc068d4708,0x7ffc068d4718
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6028173002278584184,8608774492645223338,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1be014d414593a061836642ce7eaa4ae.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc068d46f8,0x7ffc068d4708,0x7ffc068d4718
    3⤵
    PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8c41c2d390b1e97227f1eb58f10b2945

SHA1
c23b50440213e2468f13f82364710dc7cfa65a4f

SHA256
a95eac6b45d75d98ab79c20e6b614d2fc9e77dab487e740175058b6a3016f97d

SHA512
9c0331c78e15e55554278dc77fd6680af6795f0438bf29636c6c7f2f68e9b1beed262088d8454c3b1af2cbb0f9ce03d41b5a7455052b91a6d44651963d4d95df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
118338f5c2656a433e5be479b0ecb960

SHA1
fa128399c0b188119aa0e028ba8094a6ab649fd7

SHA256
2011e5dffa391fc589241d7a05193f61094ad55f51fb23328b1528c2593d717a

SHA512
3435951253833bd5a7da85a7f52b41ec675dade27b6870cbe96d8748fb50a1deb96ee0adf16330c6f92e3ab84ee3841f0f64a3b705a23fb3cff4ac88e6653994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6406c9ceb7319a6355fd3872afe85b9e

SHA1
0251182bfb5dda57b686c13db01682e79b4a6351

SHA256
1f02b53c64f7c3c4d878f365ca1de465d17125cdcbd68f427c75de93d585ecc2

SHA512
6c514bf726d459d07291ce35faaaadd6bad88a0ae69c91bca5d9ff4abf71987d0184263103d0f69f5deda3cc5993579a92c649f15ed0db3a57ca9c4e08685236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e51baeddcf47e6bea937f2e423d01c20

SHA1
f74373bd8b83a60be809c5844580c267439e8719

SHA256
342620fd4cf7813462ff36020862feb94b01c8d9487e1cb04eba617a3b9fd86b

SHA512
083fd4a8e57e2f4f1d2b28ff1f6deb8ed41e06d892a4771bbd660ae761f34652dcc7cacac7555f6b76be33e452b9efd2f8a4053c49866531ee7d08a41f6de8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5892e4.TMP

Filesize
371B

MD5
7532d21fc4d2ffe68ffe80187d37167b

SHA1
80d33a6ad5863925af5b7fcf1c9a12e0d07afa41

SHA256
a66aec6497b1a96ae7695f90f18dc957856a7419ccd7d61b87f3994e6df0475e

SHA512
3133aa2d77b437446c1a9986677665bcc53d2e88c5cfa80a95ebe7671486264ad12e075def8e2348809b77a9e056620c9898b8ce062029a8497e48fff7bd2e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
acf1023069968487abdd9aa573c730ef

SHA1
c6c6bd928afa42c822784508ba70269dbfac0899

SHA256
1f3162fb28ce358fe86911c106d3fbc2d7a0d5c22a3da296bec0965504ce5a41

SHA512
634617c8f3dcd8f5fd7ba7a46116c377c4fa708c6d563fbefec3352b0cd827a03a7eb50081cc02d16ef36e192022555994c7229d776b0e96cc7fb146252fb6f4

Download Submit
memory/804-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/804-1-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download