redline | 5b7ab7f4f1d70392c5fd6e4e44a2dbd478334f8621311a4da56c82a2f6b8f165

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EXloader.exe
Size 266KB
Sample231122-cntbesae6y
SHA256 5b7ab7f4f1d70392c5fd6e4e44a2dbd478334f8621311a4da56c82a2f6b8f165
MD5 a767e35e55347001114d2ec80f7ff00e
SHA1 37fd5f82328acd657e6d9327b4103bd014c3085e
SHA512 b1e45884c8c4538c2cfad78cf1e7bc26fa3948659759c0d59024e5b0c1a76adce0aa15c099763d576c4c6963a233479ea808072f155cc7c6020f92dfd6f2edb8
SSDEEP 3072:TApyYWAx0hn7hQNJvpHeo+6aKGk68vHFH3iWbAw/nxyDfAXhvpLuyIs4QiXkuTQQ:EWAOnm5pHeo+nKGk68vpJnc8um0/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline microsoft infostealer phishing

Malware Config

Extracted

Family

redline

91.103.252.48:33597

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/4536-1-0x00000000001C0000-0x00000000001FC000-memory.dmp	family_redline
behavioral2/memory/4536-66-0x0000000000400000-0x0000000000447000-memory.dmp	family_redline

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
4764	msedge.exe
4764	msedge.exe
2872	identity_helper.exe
2872	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3712	4536	EXloader.exe	93
PID 4536 wrote to memory of 3712	4536	EXloader.exe	93
PID 3712 wrote to memory of 1108	3712	msedge.exe	94
PID 3712 wrote to memory of 1108	3712	msedge.exe	94
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 3300	3712	msedge.exe	97
PID 3712 wrote to memory of 4764	3712	msedge.exe	95
PID 3712 wrote to memory of 4764	3712	msedge.exe	95
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96
PID 3712 wrote to memory of 1716	3712	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\EXloader.exe
"C:\Users\Admin\AppData\Local\Temp\EXloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=EXloader.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe81c746f8,0x7ffe81c74708,0x7ffe81c74718
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15504201691892803450,12766206144070816130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=EXloader.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe81c746f8,0x7ffe81c74708,0x7ffe81c74718
    3⤵
    PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

13f1dd76-d3f8-4117-8601-290d4ca933e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13f1dd76-d3f8-4117-8601-290d4ca933e3.tmp
Size 5KB
SHA256 c6c692a142e6ff0e273fb8a9d57aeaea7d7cec65bf7b69563a1d1e513895dd99
MD5 64bd0297c95f3501f6595d6c750ec59f
SHA1 0fabf91e579010d70f54b5daf7c9d8982ea4eda1
SHA512 becf897792337b9aa0ffa072747e2e33799d87051ddf2cfc759033b28d3f0f8b687c79d9bb4d36f9b3f038a6c24a8358852d11a4e84c40f7e8434977a39c1bf6
SSDEEP 96:nBWkaG1hWSSRwpvWMoiVmdeHF2UWQyV+VDCiia:nBWk97mGWMXErw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 495f8d4df7d1b96ee6c172480f991e16ba196eb57c6e4543d113a0a2a93192f0
MD5 f01bb7ae212c42c5865ca932a17cc5f4
SHA1 d6bee9d4afe68ec29eaab7e5b19b8dd68120d249
SHA512 4843295af32444bc7642080fee4c5341d71fce91d7d44477fafcd0518329bc559dd3c700cf25ea0d18ab917b8ee6aff5950ab516390963b2075ce9c86438a191
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e2a3d92654176b6d08109fda0c787d0091de8134c4d9d7f72aefb2850bda088f
MD5 323c8d6998123ce7e9ffb6e9b1491878
SHA1 e62b94b67c4cc7e710d72484f4042bac2db3c39a
SHA512 83874e1ea984cdd4d03d016a349b41d20daf7361a61e9dca7ad933442c124092aaef162f63cf54bf1c207d972048d631f4fc7bb7e36921b88b89d53df2e3ef65
SSDEEP 96:nBAkJG1hTSSRwpvWMoidbROmde14t9EOfNpi0cByWQyV+VD7AiEwb:nBAkk7FGWMxtt9XV2Blg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e09c73fd7e5c2a85173e5cb5df55794099d1644a212628808a0e087049e9b177
MD5 d1e6c4bf748efdab30f6441de3e0b0a5
SHA1 317e6118ca812c0f980dab5328f0ea0a366a6048
SHA512 33185ffb01ad4eda5a28b3ded688a9f6149c855498f07d75d170c811760a6395f345da68dbae6180285a605a9d2ca15272a8e6b9c5005f7a1755c7d9fa78e060
SSDEEP 96:nBAkxG1hpSSRwpvWMoiVmde1yYjMkdfNpir7+UWQyV+VDCAiEwb:nBAks7vGWMgYjBVC+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
MD5 3a748249c8b0e04e77ad0d6723e564ff
SHA1 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA512 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
SSDEEP 768:n4GWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRLlYIrUdanucX:n4GWPvu1jakLydVcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 ab9965b77e601d407b2089154054e69f2816fcdea6616e31653f49aa0099764b
MD5 90cc47f877081ece35ab97fa7e9f3f56
SHA1 e4edaa736f2bf8b07c40dd24ed325eb038b1e8b7
SHA512 c3ab8042ca73f6dddfd19a4fb148d0e2bd74692be387352ac9be4b9ac64de2af5ee8363aeb4c31a428cf88a64de7740ceb186b25461cabd5953bc666a6863650
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 70127f3f39db291180ac6eb4e533f440adb610acde65d4907269034d9ff128ee
MD5 699bd01836b3b5d9e9809e6b0b35600d
SHA1 d78749ac7859a24506cb14872e99bda6af5a6b87
SHA512 ce8f54a80f3afbdec512ea38e8b48039c3d3af734f9899a53d57587d56b7dcbc93a58186d5d29dc5fe68d77aa6ee3aa1e85cd684782ef1a14b332d6e65a883cf
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584f34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584f34.TMP
Size 371B
SHA256 6f108263a2f216cd00a76afd0dee7db906145d01765ec8baad419b0359dc70af
MD5 483f8d289d311d0ba889088ad66df03e
SHA1 66b39d192982d445edd69f9c2739bbd8dffe85a7
SHA512 adb8fda598b36df35d5566d544df62f95e4d9d1165f6b246be2f74d0df84d69cef4405e62f0dc8d6524aa1fa4e38e7954f67fe32b993905c221909310caf1314
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 dd989f820f1f9aa39897f07e77020aad75ac02ac73334c06bbcd7c5601fa4ddf
MD5 224edc2cb7e44c752d384f87dfa9ac76
SHA1 c1ccfb71406edc5b0a6ad336d61e8b1e2183118b
SHA512 35a4faba439840d962c4905b0be8de53cd7b4d39639af6abb03ffaf1670ab7163707195ab4dd42b2427b10b0897b2885da9ebf996656b90ddfce5157ff807767
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupijye2RUbqSrHbNxX7leImk:69iIxuERzA83h09RZxYijMoq4hxrUap
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 addb4377ee8025d9a335ecbc9e5f7aa89729bdc8a0ad2030ed068edf2065a64a
MD5 1a078cc7f633ad1368cd19d824dd5862
SHA1 ea56acca9673501b621c98a7ba08d95030dd512d
SHA512 a8d9364c9c0653a0c2b57ce8a217512378e2e3e6a0a205b5ad39c31e6529c340f085d508b30d41cf916eb02563b03ebbaff577d7e7a5327dc2960900090edd95
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyjye2RUUSrQNt7leIma/df:A9iIxuERzA83h09RZxYyjMv48JUap
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4536-1-0x00000000001C0000-0x00000000001FC000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4536-66-0x0000000000400000-0x0000000000447000-memory.dmp

Download