redline | 491e63fea39b517d4df12234f035951db8f6b6dcfc42d117270fce64193dc040

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2023, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca.exe
Size 485KB
Sample231027-sw5bnafc71
SHA256 f9932b364f52c6fe0191e34ddcba772df8460bf579f422cabd93ca192bb3e1a6
MD5 f006571dc0238d9d9cf22d6612aab5ed
SHA1 7e18ee447d59cb7983ada15bbc9631dbd6c70fdc
SHA512 ff04c4cecb59c4f4d70148632090fdbcfa3865631de2bab9b65a7c642a42cf60979e559c0155deabc05e56ee8c754a3004c6bd69e580d4058a525d725aabc7d1
SSDEEP 6144:kC003m7vq8QHH7yqG8BX/3bnSROFiFDKB6enUKKKKKKKKKKKKKKKKKFAIAOUtBDI:B0wmzqbeqTTSMirPSZYT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4224-1-0x0000000000550000-0x00000000005AA000-memory.dmp	family_redline
behavioral2/memory/4224-60-0x0000000000400000-0x000000000047E000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
3512	msedge.exe
3512	msedge.exe
1420	identity_helper.exe
1420	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3512	4224	ca.exe	91
PID 4224 wrote to memory of 3512	4224	ca.exe	91
PID 3512 wrote to memory of 760	3512	msedge.exe	92
PID 3512 wrote to memory of 760	3512	msedge.exe	92
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 2840	3512	msedge.exe	93
PID 3512 wrote to memory of 436	3512	msedge.exe	94
PID 3512 wrote to memory of 436	3512	msedge.exe	94
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95
PID 3512 wrote to memory of 2104	3512	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\ca.exe
"C:\Users\Admin\AppData\Local\Temp\ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ca.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd933d46f8,0x7ffd933d4708,0x7ffd933d4718
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18132265290705127391,9856598915711579546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ca.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd933d46f8,0x7ffd933d4708,0x7ffd933d4718
    3⤵
    PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 38c405978306ed8ea482c991695d8321a0f0bb88b8659785a72388b67b316234
MD5 baaad563aef2140f573a465bc2910936
SHA1 c756175085da455226fe7a4ae636f339b997150f
SHA512 94215755bb32b323abccf27ccb15948473b21db76d5237c0f2e5a07327ea2097015128be5c8f3855ae0a86b20c349d813adceeb401baef5d27056dccea471e46
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 63cc51fb965b12ac4b46ee74c5f5c76995a406d713859a1a88b1754147408714
MD5 96564b6dfce163b029cafa78e73f92ea
SHA1 7720baf311e6f5b0dd8e4c16d4ac3d9063f887d9
SHA512 fe7028805f6389e1106737ee24608ba42d759cf0aaf0acda1f4ee33cfa222512fd2c3e065caa62b2c2b33745bd549feefdea46af9da3c4072d2de00cd72c6dde
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 140d28377d9da296819a1a1f9aab55718303dbf42eed7b0bc23410c14ca015e2
MD5 c2a9ff1717314ac886c547b4b208d4f3
SHA1 aebb594267efd633d784ad7abf9416371881af9f
SHA512 da52be1371387c0ae82a59d0d3e8fbbc5ddaf5145bee32a4e9da4d0bf13d98937e9ec3310bda04907243a68483953a03c840467f247eca84c1c3955226756f6e
SSDEEP 96:nJkIYgm/qumqYVG1hC2xwpvWMoiVmde1Juq1j539UWQyV+VD7AiEwb:nJkRUpVGbCOGWMruqhZ9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3f4a1ffa1c8a07c8faafa5be2987cedf68f938162396e276e27d5a37fa9367d3
MD5 fd503dd2b312a73693873713a4f3fb1a
SHA1 438ecba69247489f195e87d1c096fa1050f36bd8
SHA512 85c705d7a4a3527a0dfbd09893d9ee296e64652c177c05236a28f29059fedd46aa52605ba5c43313452bef78f8efca6e27f2c5162b0ddc0b7cd5f5fabe9def2f
SSDEEP 96:nPkIYgm/qQYmqYVG1hS2xwpvWMoiVmdeH53KUWQyV+VDCzia:nPkRDpVGbSOGWMXZKrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2ca881b49b77d4e31451b41f004a608fbc4992a962f2190b8121f17a30463bfc
MD5 0e20ded615d12719565908137728c6a6
SHA1 3c618a792beef99f1715d302825c2c276a423bf4
SHA512 463882c03ad2ed9bfee09a25f1be2597f75e1b39a0d6601adbace3c8aca3e2d0dce4489887552b7e0026c7b6f7e23c778bc884593f898c46da692ffa52e0c539
SSDEEP 96:nJkJGPYgm/qumqYVG1Bn2xwpvWMoiddROmde1vY7Mkdfopy3EAyWQyV+VD7AiEwb:nJkLUpVGnnOGWMjuY7BQczlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
MD5 e05436aebb117e9919978ca32bbcefd9
SHA1 97b2af055317952ce42308ea69b82301320eb962
SHA512 11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9
SSDEEP 768:necW3O8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwLlTTrUeUVD:necW3Ou1jadLueUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 fcabaed4f6162286e53a43b1bcead3362fea157a904aee4566484f0caf06fbf6
MD5 9b5e40e61a794a51364a455069937307
SHA1 7e1f9df774c06bc5d0bdbc36edc30f10deac9287
SHA512 d331e18a609bb50e1751df982276161a3f496bf6ae34bf435ecbc67b7d8f3a8ad10da64a9884abafb8b9e78ed6a702b9cfe6854f32d721095c47d4566981e40d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584a62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584a62.TMP
Size 371B
SHA256 8c72f8154d637e10e535fe9636ef4786b58d8f203521fecae12a713a3ee17a0a
MD5 11805db7cc94615db7ce232103bc1162
SHA1 3b86fd5c0878375e599e1363b9f606d0383b7ba8
SHA512 0c4f07b9253149baa814a08732a743a7dbf0b73f8b0088c16041e743da1b8c7009946decc26205f929197e6c6cc9a23d330d752dad650555a31531ac1c8815fe
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 83a316e03763a3518af1e4d1eec2e333374c7f5b51eb84c8b2fa1d1b108b78f2
MD5 ea2ea0abf424453008b1e45a756195e5
SHA1 a592cd4bbdb02246f567d17db1dc4c2cfdd1e607
SHA512 4e4e974d6e532ff7012bf96550d57fa922d254e678b8d3aae56680b6c2a5de290f29de373e4ce70e56286d0fd5a4575272661363283a9fdaf3d67f1f7a344696
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJxZdte2RU6kbgdDOOz1wpZ:N9iIxuERzA83h09RZxYJxZD5dDIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e40fab7bdce43e7145a51f277c0df3e960dcb99220af4028157416ee860d0df8
MD5 30a989b73f4b49defba9caabacff8026
SHA1 76c39c3c981a154c248562f15afbc26f71cd0b28
SHA512 082418600aa4d89a3818968b0be07729fb671dcf41922b9189201443ddc4f05d7dbc7f659b698533b65fca774809a14bdbc466dd2a10ce27121290bb32f7cb66
SSDEEP 192:EoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJxZdte2RUdUS3bg4SOOz1G:k9iIxuERzA83h09RZxYJxZD6UZ4SIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4224-0-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4224-60-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4224-1-0x0000000000550000-0x00000000005AA000-memory.dmp

Download