redline | 14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d

Analysis

max time kernel
160s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe
Size 398KB
Sample231116-v925kaea86
SHA256 14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d
MD5 6290b812abc18144dc99f31c272b6bc7
SHA1 b3ae930cb63dbe02f8e5271dd228a7206ab10f05
SHA512 9e356a4684b5e8a7ee6616df7e44d5414de316dd3e8d0b8dd151524659acc7cf91b0b6945d755e357bc4c91fe0c634da6e80b4e2af8bd791aaa69b4495670f01
SSDEEP 6144:2PrtbKYQ9NK1hrg7lBOhRT0/dolaDANelB01Sj/zOV57SC8ozkzkrLrwav:2hmY2yzeLOV5zts+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/3856-0-0x0000000000400000-0x0000000000466000-memory.dmp	family_redline
behavioral2/memory/3856-1-0x0000000000570000-0x00000000005CA000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
3960	msedge.exe
3960	msedge.exe
4924	identity_helper.exe
4924	identity_helper.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3960	3856	NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe	96
PID 3856 wrote to memory of 3960	3856	NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe	96
PID 3960 wrote to memory of 4512	3960	msedge.exe	97
PID 3960 wrote to memory of 4512	3960	msedge.exe	97
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 2032	3960	msedge.exe	99
PID 3960 wrote to memory of 968	3960	msedge.exe	100
PID 3960 wrote to memory of 968	3960	msedge.exe	100
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101
PID 3960 wrote to memory of 948	3960	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb5ad46f8,0x7ffeb5ad4708,0x7ffeb5ad4718
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8850163778158536454,1457254838818278944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2624 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=NEAS.14b8daae29a4a354bdb62a5c3034941a1be3a161193489a624c8de3450a9442d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb5ad46f8,0x7ffeb5ad4708,0x7ffeb5ad4718
    3⤵
    PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5b5b39cbf4ede66c75c3c2ccadc820b6edf32aeec666e21adb82623e0590f6c7
MD5 7a338e4cdec6aa3c74b20f5de5b3ca54
SHA1 9b3d8e87949660792881a8b1d624a94dc433f839
SHA512 3d5dd49fcef544adbbcaf9f2459bb04dcebd98921caaf6aad7a856b6c353547ed331c864c193a17b5067998648b0a124a9f0afa7ac0a10879b77518e6e95b324
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6c960cea476e5c7e9418bba94a95fa8d4547c01ed53df7897f389e0bc4fd1da2
MD5 9eacfa4b2e787a76c1e85bd43f5020ef
SHA1 0d8c7a1c04c25f02754181a4348f5dc2a39dec11
SHA512 fb72720a5a2bf6ca64a14d782c56387580b84fcc0cdfb01c04043bae0cc8d14fe8b323aabf333400c25ee5ebac7a6a754164ed33e2cabcdae9771fbd4bce4ea3
SSDEEP 96:nHb7kxXbi1WKLwpvWMoiVmde17YoMkdfQp2UlEOGK6UWQyV+VD7AiEwb:nHb7k5bioKLGWMFYoBoU4WDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cc52f5fdae894e64278fa0c27478697f84cda6cb0930b8f1331fc481b87d1ce1
MD5 2b81bd628aa66d432a16f918caf49d3e
SHA1 61a531212f8113c55bcbf4cbd992f9863d2b10ad
SHA512 9dfa2e754fbee293011eafc1e4692e38491e7719ebba9e5f29b17ecefb8abe3224b0704a4388ce0e45390b91f64200994dd2735d143460a0d89c31c3717bc511
SSDEEP 96:nHbxkaXbi1uXLwpvWMoiVmdeHPUlwGK/UWQyV+VDCzia:nHbxkebi8XLGWMXP4Nurj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5ad0a2b838e83a0e3878652d2852b2090a8859304ef207414d4677be398390f1
MD5 b6ed3f3ca5fdfae05bad79db1ad3b3e2
SHA1 8323ee8e26d6bbb9b596a73935a0211011a38dd2
SHA512 cf356efc88d8c62d13dea542a86e808c14009dc1a4cc0dacdca05a84cc492fa2e13ba8b09d1fa13f9c419fba29ae9804fe333c0de59825fd7beb3ced42eb2394
SSDEEP 96:nHb7kxXbi1WnLwpvWMoiVmde17YoMkdfQp2UlEOGK6UWQyV+VD7AiEwb:nHb7k5bionLGWMFYoBoU4WDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175
MD5 918ecd7940dcab6b9f4b8bdd4d3772b2
SHA1 7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4
SHA512 c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2
SSDEEP 768:npyWSi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLlKIrULq1xA:npyWSiu1jaZLILgxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 a5804afcf8d205755564b8c81ca9a435862384d538297aa617d8a1bd98d91444
MD5 0fc84c0e9fd1034c59a436bace7855de
SHA1 fb0112365299544196e71344561bc79be57f4eee
SHA512 97807c44aa0b27ac90638fbc0f286bcf1e43a7c9ce43d9c6c0ebe3e8daba07e0fdb28edb9a2991ed2f6b9713097233752901d023b53cb9fc7abc774b17950e9d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584d21.TMP
Size 371B
SHA256 1afcd66196b27da6cbf80ac811922c7784ed98e54bc7774f4f0ef11db83a5ffc
MD5 219b219a76c982e5038d13cda6625c94
SHA1 a232a3cbec2a0132c52116517ebac79c60dd6d01
SHA512 68495a3b4bb7059d34fa3cefc91ba6eca92aa65927ebc0404ee41e5449fa612b35c9c897e2db3325b1a04272737b35eacae1ec722cc52c6dceafef8f1577f2b2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ac0e24050e5d4bbe238e42373e803c8b458bcd9cee5a991321d385d6d10a9a76
MD5 7b2aba51a64ac03564b74f6e25f6221b
SHA1 063d49b788fcc187f881e3a4a597607d1c521096
SHA512 3af5d95858fd08f09baf4fdff31282c968ca77d9104b3658007d9c8b79588cbff2e16429bafd58200f1bb67e8f3c792cde3a94db194745fdafedb56599f7fd03
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDuxe2RU5SvbVU7leIma/dx:A9iIxuERzA83h09RZxYDwmIWUaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3856-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/3856-1-0x0000000000570000-0x00000000005CA000-memory.dmp

Download