redline | 5b757b065a522544a3ca63bfe9ec18274c5908c4ba1c5c413b546025e0916b5d

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe
Size 398KB
Sample231116-dwgs2afd22
SHA256 d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650
MD5 f108227d38726fe1d83281f8c3a6acd0
SHA1 00d1693cc5ce29e97e1dfe598a6803b1066cbf10
SHA512 fab2223fa962c5a7317e36f5c7cd5b1d61699d0f09031633f6e3890d204da562c415693908362ccd74eda049c61783b34817e6d14c4980580a9042cb30ff1daa
SSDEEP 6144:Bx+TY8UHBfSZ8lBNRT0/dolaDA3thSAlS81Dd4WQ+7SpI9EP8krErwaX:B8Y1UEt4ODdLNIi1+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/2256-0-0x0000000000400000-0x0000000000466000-memory.dmp	family_redline
behavioral2/memory/2256-1-0x0000000000540000-0x000000000059A000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4136	msedge.exe
4136	msedge.exe
3236	identity_helper.exe
3236	identity_helper.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 4944	2256	d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe	98
PID 2256 wrote to memory of 4944	2256	d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe	98
PID 4944 wrote to memory of 4220	4944	msedge.exe	99
PID 4944 wrote to memory of 4220	4944	msedge.exe	99
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 2468	4944	msedge.exe	100
PID 4944 wrote to memory of 4136	4944	msedge.exe	101
PID 4944 wrote to memory of 4136	4944	msedge.exe	101
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102
PID 4944 wrote to memory of 3600	4944	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe
"C:\Users\Admin\AppData\Local\Temp\d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe036146f8,0x7ffe03614708,0x7ffe03614718
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7362340620363882111,5518016427362713424,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d2c19e15edee855176d5dbf18b19833779e009573573b419c0513e3cf82e6650.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe036146f8,0x7ffe03614708,0x7ffe03614718
    3⤵
    PID:236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5c1bd33943d9f6ea2a00332a1fb900c6156fa822682cc5bdb22c821fade78df9
MD5 fed7112e41ba9e8b2c15bda6c9c1bb60
SHA1 790f979b3b6eae7a067badd00cc919e66365ef8f
SHA512 4b364e56150217a6253ca7c364982fae4bcd60d68e1d573a9a77f2f299501220ca3524effd0e9e29369ee951007e8b74ca1745522170146372e55fa9632f2790
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c3456d1aca2ea8717895a625453e8c905c5722a474c1ebb1f9ab3f1e6e35f4c2
MD5 e7709544021d76ecd8f7bb3f8a8cfd1a
SHA1 be3af59d9f52b0265c6fd494c02cefac85a1b01c
SHA512 4e4660bb5cdf1ecdea2a9e1673647b5b4948337350228833bb32f9ddb3c2df5ae57a27890fb8e3729782815b59f044ef785c56553ea8e205e4a17ae614c667f1
SSDEEP 96:ngkxy1h7pSSRwpvWMoiVmde19YMtMkdfCpi0AbUWQyV+VDCAiEwb:ngk8TvGWM7YMtBKwbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c04d00732b8aff3aa8ce0cac2754b4ed9bf5541945f5eba904bc5afb53d55c64
MD5 c9d0ef9df06f57b5e56f830b1593d75d
SHA1 d33ac6e1deee3708ce82033fe73c1422e51722a0
SHA512 b4aadccf5cf4e9907413c233bf8ee3986357a01e436e1e8b2990a4115c6b3a3aef432c6086d829723419a5023191a054855441efb532df9840997de4045938f6
SSDEEP 96:n2kay1h7WSSRwpvWMoiVmdeHFk9UWQyV+VDCzia:n2ktTmGWMXW9rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
MD5 3a748249c8b0e04e77ad0d6723e564ff
SHA1 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA512 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
SSDEEP 768:n4GWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRLlYIrUdanucX:n4GWPvu1jakLydVcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 96740c93e84df62bce6c631a85c0ad6893d6b6de7c879630f5372485ecf2b99d
MD5 76675b1d9b549c08f0c515896bb5cd5a
SHA1 10b73aaedcd15266cb655a8073957a01a0db6c6b
SHA512 2c6a84f9e2fe87e85167172a934eb4aa595b5803a3a4f1ab180624605ff84062479e9f47f2d2d7539e18364985fe8084b9cdf845677f362e00be1787db84ff07
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5835c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5835c1.TMP
Size 371B
SHA256 31f1002f18c3756cb4ce61b79315eb31c4f982405e81ff383658d416df1011db
MD5 edf4b6c8a051cf7af5b85bc6db76e822
SHA1 9e3db10acc387f64e14c05e781c1fdf450c9f33b
SHA512 2b702cdeeb88bd39e59d53955e8632af71608aa7c0dfe3a1605e520112f0124bc393f8806022cbce15bac4c294afa86e38d988c3a6f48e5ad1bb9df16109a52b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 dfacd9a25112596d267462ef889333ebbd1379f58ac40dc96af2119fb7da2254
MD5 ca4d4b69520495aea98f02e6349a8e34
SHA1 9bc99e12326d76f7ac11b48dbaf52775b55495f5
SHA512 84e7efe2fa42e001c9d6fdb0598b6b32c201d9b5702b02203bc9fbb45fb35a4c4bd3c4d35d11943773552a532d0d23d9f2e57eef4ed41b37c4c29dcd741692fe
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4R2+e2RUgTSrQNh7leImaG:A9iIxuERzA83h09RZxYrgRT48FUaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2256-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2256-1-0x0000000000540000-0x000000000059A000-memory.dmp

Download