redline | bfccb304b0ba8564a049b4befd5916d53858c9c252aa648a730b7a75356c9765

Analysis

max time kernel
151s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe
Size 305KB
Sample231119-2b4dascc59
SHA256 6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d
MD5 a478a8a6a11930435e760b596ac144ed
SHA1 8287d86d7c8b187d0637deff2a60c000e146fe30
SHA512 67e38b051dd9a66b85107db9a1668d0b12d5d9f782a06c1064135db217b34e0f97689cb62e366b0b9ff0fd77585e3e4b82596d870134c3a6a0461eb87147d43e
SSDEEP 3072:QoriavRyLrm9Nkae6pPsn1b7i4TzX2ETldYUt15AjlfE/snEcIN4d:QEarpae6psn1isX2ulaa5AB8/sENE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @octav1an microsoft infostealer phishing

Malware Config

Extracted

Family

redline

Botnet

@octav1an

45.15.156.167:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4796-1-0x00000000001C0000-0x00000000001FE000-memory.dmp	family_redline
behavioral2/memory/4796-5-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2316	msedge.exe
2316	msedge.exe
4176	identity_helper.exe
4176	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2316	4796	6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe	98
PID 4796 wrote to memory of 2316	4796	6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe	98
PID 2316 wrote to memory of 2212	2316	msedge.exe	99
PID 2316 wrote to memory of 2212	2316	msedge.exe	99
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 384	2316	msedge.exe	101
PID 2316 wrote to memory of 2240	2316	msedge.exe	100
PID 2316 wrote to memory of 2240	2316	msedge.exe	100
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102
PID 2316 wrote to memory of 1520	2316	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe
"C:\Users\Admin\AppData\Local\Temp\6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8005546f8,0x7ff800554708,0x7ff800554718
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4771405597389920615,7203115555578375981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6ee3240e69f9f078386e729d2f2bc6613a062ca07b157e23e4ebc696f4cf7d2d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8005546f8,0x7ff800554708,0x7ff800554718
    3⤵
    PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 ceb6e2ea5a11f4c349c17401cd5e64d1cd9252ea3868935eb7b1c75f0dedb8fe
MD5 965d4b80edab495136976d743dc22372
SHA1 dad87a0a566e5328cf843d66f946e10a3d63d4e6
SHA512 3abc666b039c175937d2bab0b39e76800a0bab318772a790d4dfa025a458c99e3a3e0d5bb20e62333a0d91b685e1d9ba169f770077c90bfe741315209e32133e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 779fcc17a6d5dbd7f3ef6e5c068ebd69d1e9b2fc13544749caa5fca9cc7af4ff
MD5 6bc94ed5441ffbff42279b1c9affe69a
SHA1 6a7515246181753b27c7162b95f2937f582bca9f
SHA512 be12f0e8cc08ee35b26cff24373ec4c95a8401ff9dcc2026a5c61e8afe47d6ce5a3191e78036cd26ee865acf8ea3b35a8867c7ad76a339837b16e47d73ada7db
SSDEEP 96:nGkaNm1P2uuWSSRwpvWMoiVmdeHFlUFUWQyV+VDCzia:nGknd2DmGWMXjGrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5ef54fc289a9645904c502923d9aa2c532c45257cc534b6aa7a1591751e9460a
MD5 0ab29a393925619c3a64eaf0caed8d98
SHA1 76d3b465f9b58c9a4226d41c810385ab0ea84ed0
SHA512 d1c050646317e90db370ca8e456024a464e91a8cb834448324a435e04e0a83152055babf1812303ffb13f0cc4ed16b8ba35e385c6e23dcc6d7e99717335d743d
SSDEEP 96:nQkxNm1P2uumSSRwpvWMoiVmde1FYKMkdfWpicUFUWQyV+VD7AiEwb:nQkqd2D2GWM7YKBeJGrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
MD5 3a748249c8b0e04e77ad0d6723e564ff
SHA1 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA512 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
SSDEEP 768:n4GWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRLlYIrUdanucX:n4GWPvu1jakLydVcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 58f8b77d26733ab24816db4713a0a3e225121b265582240481ae4149a7248bff
MD5 795f4c1ed1bad3931ef590e0ea1105b1
SHA1 1469e59385b1b0a7171e2999481d6a329b872dea
SHA512 68fbf35b11696a19ddfb1f14b9aa29c3ddbcada3edf1f9197f833ddbe77332bc544fe16e9ac0a68405d1b696b7cdeb9c0b9d03e8ffee91d21df11e3bc8c60070
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe596b53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596b53.TMP
Size 371B
SHA256 3449ae4c67ce94b7877bc84033f244ebdc386833d04afaf313ff947178e0dfb3
MD5 330d7b50ff110897b8290ba332e60233
SHA1 5de05eca510e08fc0e404b2e7b43cae2f6d2b388
SHA512 0b01643579496869fc0f21bb074a14148d467377e53419aab663417b8308e288f4625f53477e47b004b20fd35b2af7d4c536619927c66d9bc5f10200e08d6d5e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e79d60d02f79fdd5b02c50088ab3c606938f6ce150a50c573dd777f2e5b13377
MD5 5b0d3bbc8c71ac17986d10cdbb7e1d37
SHA1 322b7e716cb2dcbd4e3c871f731d41ab0be2a132
SHA512 06fa1cd23fff79891422df4743a36364118c0cc18db4006c43c5518a79a49fc014b42d5d42b786fd9c5fe62ff347f69b5515be5d63486ec9c0bdc84aadc5024d
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzae2RUcLSrQN37leIma/dE:N9iIxuERzA83h09RZxYz0nL48LUay
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4796-0-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4796-5-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4796-1-0x00000000001C0000-0x00000000001FE000-memory.dmp

Download