redline | 564b0cb8a13964bc87dff7d5fb34b7d7dccf92ea2f89d3b9bb84fb13d5a2850c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe
Size 504KB
Sample231021-prrm8agb42
SHA256 564b0cb8a13964bc87dff7d5fb34b7d7dccf92ea2f89d3b9bb84fb13d5a2850c
MD5 d12c99f669f53ca22ad6baf1020918fa
SHA1 e49581976b653855ffcec07e9d05d1bf9a16409b
SHA512 cbf309d5edac47aaf122a1f608d3e7eedb1754de8377f41b947eb93ecea40b684950bf39720556098b8cbd9560c14c4f477861db61afa583f848c714928cf20f
SSDEEP 12288:1/dZvLrTqgTOhc5qf5IsEV1JtYbXwrS+GzZFVy9pUcuP+VRxL:r5LaQ5rdV1sjgL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4804-1-0x0000000002240000-0x000000000229A000-memory.dmp	family_redline
behavioral2/memory/4804-45-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
3184	msedge.exe
3184	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3184	4804	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe	89
PID 4804 wrote to memory of 3184	4804	SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe	89
PID 3184 wrote to memory of 1520	3184	msedge.exe	90
PID 3184 wrote to memory of 1520	3184	msedge.exe	90
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 3476	3184	msedge.exe	92
PID 3184 wrote to memory of 1144	3184	msedge.exe	91
PID 3184 wrote to memory of 1144	3184	msedge.exe	91
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93
PID 3184 wrote to memory of 2720	3184	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff2ef946f8,0x7fff2ef94708,0x7fff2ef94718
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3768984299150721582,10299147816616025231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SecuriteInfo.com.Trojan.PWS.RedLineNET.6.6857.2071.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff2ef946f8,0x7fff2ef94708,0x7fff2ef94718
    3⤵
    PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 54a1a219ccc5c219fe51ec09c44aa6d0a7edf8777c17249176b9aab9e641f2d9
MD5 cfb931d6d1cab388585de06d32429cba
SHA1 802518694a2e4c156b6232a909e806f5b19bd912
SHA512 020a2380c87f33ad2811d8b8db1c4dcf8639339e7a36924394696f09a4df91a4f964b65f0cb31d7d895640bde82c23d1226801eafe3a890cef022a4b6960ddee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 22e7ba2e2618ee0782bb8d74cf0867e2433745f2609a96f2ad4a81d17aa986a4
MD5 fabb9b55c3d869ed8ebe270a2342bdfc
SHA1 3097e6a61f9ba5317d7c269038b2ac1e344cf7b7
SHA512 d90937ae5059bce4f1356042c2c580f9ba3c82971b32e53b2efe87a6fc9cf2b8c3bb973d8063c7e7f4129216bf9df25c2697d6a031a5abade81a101bf465afe9
SSDEEP 96:nskDDA1hgwpvWMoiVmdeHWQUWQyV+VDCzia:nsk3ATgGWMX9rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7889a643cc652138766c562ef99bf1eb7d3b719c2bb7db92d951503c93893756
MD5 81b1f1ec17a34f932ef074be30a70b9f
SHA1 2ea12c5882abbe326fb22939d9cf61ca72a2b2de
SHA512 08a70c4638fdaebf61919df380036049d9f5d1f29058b7e142e3f5eb9fa25f5fda6828e2ff39d4249d9d7cfb7b32e57b6c761d02d8f9da11446599f938c8d02d
SSDEEP 96:nekgYDA1BwwpvWMoiVmde1bYYMkdfIpVcUWQyV+VD7AiEwb:nekZAPwGWM1YYBAorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b039d68da9611c7cc9ee22568d5f4764c8267f6021d22c544d6610bc5389af18
MD5 05630f406eea307dc413b8a5b443186a
SHA1 8fbdac6cc31d56545b457bb269e3bdaea581bb11
SHA512 abfec9c8060d54b043256ff9e58d85810ae4adf229ca34346eaff9dea695e7164b6a4f9ae18a9642e9bcf37fe336a56407aa55bc5c945f9f38cb70060fbc2279
SSDEEP 96:nekgYDA1BZwpvWMoiVmde1bYYMkdfIpVcUWQyV+VD7AiEwb:nekZAPZGWM1YYBAorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38
SSDEEP 768:nMIWzY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJLlFprUHfgxo:nMIWzYu1jakL6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 4826844be20436e7e07176a6d2d7656f04c491d0c7bbaf91802ae33128fe14b5
MD5 f1eb4d96474dfc584b7409011f253c79
SHA1 64c392456f8f0630fd581c82fb16915f3706cc93
SHA512 259f567d22aaf42e4e5e58e15fa484290510323ad575c4f2b05c480029d4fea1d410506646bf74748978cd936a68d9c9782867d33d2245a0ac2f84f7960f9a46
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5821eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5821eb.TMP
Size 371B
SHA256 3b20ea887e9460fd82c3ff2071727789f0f35ac7b0525379b8f680d31b9516d5
MD5 d5ca91cc38fbfe426d06da4e378166bb
SHA1 cff185c8c2e9b3cb6f89267ea66d667eb00fa930
SHA512 a8ecddebc345401bb9410a77c72f60474fdb9b114d72f68b7d114e525cfb930ac60fa4e23f833d3f62099dd9ea9b0458b4b13138a1dae3e9debdf7b52d2d55eb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 040eabcdc4854867890504c208ae45cc31a95cee066173dcf331bab852043c59
MD5 25daf77b7368de468c3e3fcbd7b7e833
SHA1 fc550c124763a3f90211ad8b94eb57d0a7ec8dc5
SHA512 514e854d51bc710faf28fbdf6bd62c4794d967ae4c7ff4c050efce21909ce2d659421e5ca4506e082249774d4e1d1cbbbd2727d1b55e9c3ec4e1c4dd08309445
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFNe2RUpS/Ob26TLdLlAush:N9iIxuERzA83h09RZxYbM+Kpeh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4804-45-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/4804-0-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/4804-1-0x0000000002240000-0x000000000229A000-memory.dmp

Download