redline | 84468bfdcb264e3eca47a0c5a803fbd5156a75166b40bba97e55c9282f42988e

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ceac37a2e5adc388941f60c927b8e84a.exe
Size 496KB
Sample231022-kcemwsgd52
SHA256 84468bfdcb264e3eca47a0c5a803fbd5156a75166b40bba97e55c9282f42988e
MD5 ceac37a2e5adc388941f60c927b8e84a
SHA1 e545de7fadab4c718b37fa235b23e84ebc5119a6
SHA512 950ba0292b3f7885de39d75407a83fcdc601834779a2e0990a50c10afda0c7f842a8bd7ed66f20ed37e38d906296a71b9896de4d5739bb0fd77ae3569cd6904f
SSDEEP 12288:z8U8MJ4QB2o97Hr62k3n/+pLsv9+eXUeF6e1L:8MJ4QkAr62k3n/+pAv+enL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4972-1-0x00000000021C0000-0x000000000221A000-memory.dmp	family_redline
behavioral2/memory/4972-56-0x0000000000400000-0x000000000047E000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
1224	msedge.exe
1224	msedge.exe
4300	identity_helper.exe
4300	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1224	4972	ceac37a2e5adc388941f60c927b8e84a.exe	86
PID 4972 wrote to memory of 1224	4972	ceac37a2e5adc388941f60c927b8e84a.exe	86
PID 1224 wrote to memory of 2364	1224	msedge.exe	87
PID 1224 wrote to memory of 2364	1224	msedge.exe	87
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 2340	1224	msedge.exe	90
PID 1224 wrote to memory of 4296	1224	msedge.exe	89
PID 1224 wrote to memory of 4296	1224	msedge.exe	89
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91
PID 1224 wrote to memory of 228	1224	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\ceac37a2e5adc388941f60c927b8e84a.exe
"C:\Users\Admin\AppData\Local\Temp\ceac37a2e5adc388941f60c927b8e84a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ceac37a2e5adc388941f60c927b8e84a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff931bd46f8,0x7ff931bd4708,0x7ff931bd4718
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2388 /prefetch:2
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,13321808815401278227,694500490167318484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ceac37a2e5adc388941f60c927b8e84a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff931bd46f8,0x7ff931bd4708,0x7ff931bd4718
    3⤵
    PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 064a38e8fc74b6f698ceb60f2c74f781f7007e511cd3c05ba5fe5d0db2d09f9a
MD5 a42ff08273dd9b42ed2001be4a04c52e
SHA1 b9634151f88a8a170ec317d0275018b1c6f049da
SHA512 4898e6aa1b3683fadc80d15f7ae10ab21a2bc74fd9d60f40ac47c9229d0365c92ebb271810251ae5cb6b1e38d961611e6f47a20f932617398cfd7504cf73a914
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8be26c8e3f9d289f506d12408a917d2f4b7c6a13d239a500d28b2e566aba9af2
MD5 04173baea5d07bda494eb6f9864b762a
SHA1 69b433991380d2e131f1ed1b87b8c152c9683d3e
SHA512 48fc7215e38cf96ba0e0a826273cef588d5218c9649fe3b1977a60cf9636d4b2844100766b90f43b86a8699b86756946e956e9b8d5fbf7a2967931bde06db50d
SSDEEP 96:nBkDK1FgwpvWMoiVmdeHWM+UWQyV+VDCzia:nBkGPgGWMXp+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 72db19ffbd1f90e5ecf833dba1e1ebef6a12ca80216db791bab22452c5b7f9ea
MD5 144b02151948b189c8074d04a9c3fe36
SHA1 52962d0249959a047dbff7e0579a14000207784e
SHA512 48cbaec8e1967bbdd0aa6df4d0ff16322d138e28f62c5e6dd575111c1065b2afc489cf07f1af6a811ccdfbe2b5eb815150c8ef39b2cec5cdd3e362becbd36e4f
SSDEEP 96:nrkgYK1NwwpvWMoiVmde1JY6MkdfWpVNFUWQyV+VD7AiEwb:nrkAjwGWMbY6B+hFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 52f66a00d331542826d65bdeedb94e58643e1ee87a9a2ec183e4e36ab9ba59bd
MD5 59ac400cc1149e0060c7f27ba77156f8
SHA1 1121cc8e9c5d46366ff5593c6541ed29f38b4e46
SHA512 317a50dea6c0e48a033218d5040d880601754a4e7ae98c31e43783e1083dc13503c0c550b73c38cb4f1d80bd409c740fc379e34f5428b9207fc1a9457d096c75
SSDEEP 96:nrkgYK1NZwpvWMoiVmde1JY6MkdfWpVNFUWQyV+VD7AiEwb:nrkAjZGWMbY6B+hFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38
SSDEEP 768:nMIWzY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJLlFprUHfgxo:nMIWzYu1jakL6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 85aa026e2d59fd454502adfb51e67527a37116c63bd2729b5cfd59dd79b620b7
MD5 1bc4d9a54f6f75717bff69f77a843d18
SHA1 c3535f3279008905286bb0c7b8818dae91fba503
SHA512 6951a97b2a6d7bb04dd9d08990c2c5be643eed7e909cce7bf0add263ca02ccbf480f6eeefd0b74b79b25fbb2212164b0a8decea8f5e27b2818367826b1ec8cdc
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580fe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580fe9.TMP
Size 371B
SHA256 23b057e9aea2839189ddf6479d15ca1fbf128b7e7d7432c40936ad894a114c96
MD5 06f39291d6409f41b0c2618f2a741540
SHA1 8c4b72062c6b61b1b639a86ccbf045e054f6f966
SHA512 41ba4047db30f0c759bdbf7e9e084557bd4e57125063a3f7f556c9279c538c4cfa0fd7a708239816afb1c2ccf45e2d223969c2e5ee086044b36f52a7010c5371
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0207877770738ef43df8521651eba5064dcb8035bc05abeb08d1162d8ba25148
MD5 789a36b69cc9b825e542e74c1a6cc007
SHA1 38ec0781676f7a1b121a1be235c4cb2e46a28214
SHA512 d3a56d939e0ecc93a3f055d0dde1fe2293637a71cbf794f40f7d1d0ad9a861c275f57d82114abd19aed29c026d43d467d20396def868310ac4471c65558938d5
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgme2RUBS/Ob2YTLdLlAusU:N9iIxuERzA83h09RZxYDQ+MpeU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4972-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4972-56-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4972-1-0x00000000021C0000-0x000000000221A000-memory.dmp

Download