redline | 2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2023, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe
Size

407KB
MD5

32de9cebc39248cc8e67138dd2c906b1
SHA1

7260a1873f6b6b001aff8cb8e8b4b52ff53dcff8
SHA256

2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb
SHA512

87d9e3aabc2539c5b90d7fd446a49d9dc34ccad93be1ff03df35ccc03c386068392ea75d445b2a9805c16029260737e3b29017f37c8b2d7db03b2d62162476bb
SSDEEP

6144:v3BSC43lAi7422nFfh84fL7suk20UXfRQ1z/tsPEuBZNC6zXLd3RzVUw2RwMRhVl:v3BSCUlAi7e2RwWTwiq81WHb+

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4160-0-0x0000000000400000-0x000000000046A000-memory.dmp	family_redline
behavioral2/memory/4160-1-0x00000000005A0000-0x00000000005FA000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4824	msedge.exe
4824	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4248	4160	2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe	99
PID 4160 wrote to memory of 4248	4160	2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe	99
PID 4248 wrote to memory of 884	4248	msedge.exe	100
PID 4248 wrote to memory of 884	4248	msedge.exe	100
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 1388	4248	msedge.exe	101
PID 4248 wrote to memory of 4824	4248	msedge.exe	102
PID 4248 wrote to memory of 4824	4248	msedge.exe	102
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103
PID 4248 wrote to memory of 3924	4248	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe
"C:\Users\Admin\AppData\Local\Temp\2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe809946f8,0x7ffe80994708,0x7ffe80994718
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3710714577456013889,8250988697703864118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2450890f750ded0317c9aa14b78950356491563bf92c8c710db0ed10186c2ebb.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe809946f8,0x7ffe80994708,0x7ffe80994718
    3⤵
    PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
68e4e9121e962880275de2b87d136191

SHA1
cb9a05d7aac48d95102e3150340242d0642463ab

SHA256
5597f9d73c2fe350236e0532def3fcf7a64a3d838e424ae41fb160c1e5b60c3c

SHA512
80fd7199c55af29bbf526e6b4d698dd6786b5e67062b55b5e6528ae37defd07067b7d4e79e49569c4486cdbb8b99040919df65bc0226a75a4eb769bf2472a699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7e1930c7182a2c762d5923873b00131

SHA1
388818ca1ae27d1460a6b8a9d470e2a3380ca997

SHA256
b0f8bab95545a2e20d4a6923e165d3fdf260ff5f9b50868e2b9ef5784e9759c2

SHA512
c20a757790b67f7ddfb19bbd42a2c6ba708f608fb71da7dac441aa6b73de656fab8665d650586074af6bb7b9161520635ee3e3db857524b9e03546aedbdc9080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a8007a58737b8d558a7aafef37e0a49

SHA1
8e665ed1cd8d9fc21c9f9de7f575546e55a37194

SHA256
41220cbfcd24acaeb12707c39deb8f0ea57ac61213d6d1657e86289e92f04178

SHA512
96655fe85f14ab8c8995d73bb1b6edaed9eead7de338cddaaf021567ccecc8a64d7a35a1d238b460098b0b9428786caf888a1f79c5cf05b28e4c8f1d70b7a9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
53e33e25a468fd7e9908ae33005ce224

SHA1
c6f59662f29010222679447ad77a9ea7779e5941

SHA256
3b34c935a83441f0118c01ca72f612b8077fd2f341dab985985372a8e14c5a65

SHA512
b66e96b2fa9f5a320f44f943bbab2ed590905fede29f961bb8f3ec8386418c5f38ab23b22effa03169a103127994176f6f03a4749b48c4ec7d5bc39610f5fb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586fdc.TMP

Filesize
371B

MD5
1ebc44252736e0f6adaf39daa6270790

SHA1
af7be190a82196e1df8937c1ded02a7cdc9ceb88

SHA256
3576f75c4bd259fa18a73aa103b94add913ce41113cf19e91d639a43ddb8b621

SHA512
1b5cfdb4b29aa0ffd13792a1e88de9e9c76f31e76761c9df615654ef73589baaa8aafd14bf85fa930dc2d272af5db9aa11dd65c3386909919595ae0d627b4b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd91bb37f115fe4457b0026ff9bf4cfd

SHA1
74d4dc8053f22d3b33537a663916406a5f51eb91

SHA256
4aa674f4869db7c143d5763d716844ef626e104c0c04a4d11113c09b0b24cdd1

SHA512
d7523c9a76d9a13e8a8325b9f7acb599844c9b4ed7e88af47476d5be24673a53246e0f5e829c758958ac5c056e7c109e0d85ad07dcb31fb99d34e4813e68820d

Download Submit
memory/4160-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4160-1-0x00000000005A0000-0x00000000005FA000-memory.dmp

Filesize
360KB

Download