redline | bdf51bec10ffe9224a476224317213979598f7b18af279b6d0aea7da1647653d

Analysis

max time kernel
140s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2023, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Akrien.zip
Size

8.7MB
MD5

404ed26a45fa12434cb97b8c41f98165
SHA1

549e4eb010a873bbf953a84be30332cdc2728c47
SHA256

bdf51bec10ffe9224a476224317213979598f7b18af279b6d0aea7da1647653d
SHA512

8b613a8c689db875033863580de4581a155930b61074901fcdb56be45b8839827b4ff11ae555dbd871dc77cb9639c09ff1c0a5a2bc22ee6b37435f2431735901
SSDEEP

196608:jXUADm9a+/R03WZ6igsUwqFHAH38XIcN/hyatF73R3Zgg:Fh+/u3W8iG54cNwatF73xZgg

Score

10^/10

redline 317323864_99 infostealer

Malware Config

Extracted

Family

redline

Botnet

317323864_99

cellrepairs.top:28786

Attributes

auth_value
f2e3e444ae87c9cf96cb2fcb7e8a63c4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 102532	2736	Akrien.exe	129
PID 102784 set thread context of 101824	102784	Akrien.exe	135

Program crash 2 IoCs

pid	pid_target	Process	procid_target
102656	2736	WerFault.exe	127
101904	102784	WerFault.exe	133

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
3896	msedge.exe
3896	msedge.exe
1404	identity_helper.exe
1404	identity_helper.exe
3856	msedge.exe
3856	msedge.exe
1124	msedge.exe
1124	msedge.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	101956	taskmgr.exe
Token: SeSystemProfilePrivilege	101956	taskmgr.exe
Token: SeCreateGlobalPrivilege	101956	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe
101956	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3480	3896	msedge.exe	98
PID 3896 wrote to memory of 3480	3896	msedge.exe	98
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 1684	3896	msedge.exe	100
PID 3896 wrote to memory of 396	3896	msedge.exe	99
PID 3896 wrote to memory of 396	3896	msedge.exe	99
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101
PID 3896 wrote to memory of 1552	3896	msedge.exe	101

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Akrien.zip
1⤵
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://aikren.zip/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff457646f8,0x7fff45764708,0x7fff45764718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16694844158941092463,14310143880980543633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff457646f8,0x7fff45764708,0x7fff45764718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12707650519420408986,8630355162957419946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12707650519420408986,8630355162957419946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12707650519420408986,8630355162957419946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12707650519420408986,8630355162957419946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12707650519420408986,8630355162957419946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3268

C:\Users\Admin\Desktop\Akrien\Akrien.exe
"C:\Users\Admin\Desktop\Akrien\Akrien.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:102532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 98692
  2⤵
  - Program crash
  PID:102656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2736 -ip 2736
1⤵
PID:102612

C:\Users\Admin\Desktop\Akrien\Akrien.exe
"C:\Users\Admin\Desktop\Akrien\Akrien.exe"
1⤵
- Suspicious use of SetThreadContext
PID:102784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:101824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 102784 -s 39332
  2⤵
  - Program crash
  PID:101904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 102784 -ip 102784
1⤵
PID:101868

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:101956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f0cdba3e639a70bf26cf85d538ce1a8

SHA1
b457faa0d6c55d56d61167674f734f54c978639b

SHA256
c1e48c2dfaeb607efc713e1b5c01d1ee8a9491d8f3a2a5f4f3887e6c1f8c2f63

SHA512
3c270fc58170c37f51427aac2d3092ddbbc17832556718612cebb0c32c04e7e3b7e157969d458a4b9c3e8bf781c23489319338960cefb5cf530673f2b8f81609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
da26ff834b2fa236dee4013209cc2c3c

SHA1
1b7622df4748346b7b9b82364cff82849cd8785a

SHA256
d268ef2ce8fb9d4a8aaa4d688d6d4858fc62ede2525481117cc10c3c4da2bdbe

SHA512
4d268f31f76a2056cc07fef657a6267749885fcf233bc384b46d8072a4ac96d639a82d5c22a6d830bb7d3a40b86182d3e74e3f15a929e118091c87b8f6315a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f0cdba3e639a70bf26cf85d538ce1a8

SHA1
b457faa0d6c55d56d61167674f734f54c978639b

SHA256
c1e48c2dfaeb607efc713e1b5c01d1ee8a9491d8f3a2a5f4f3887e6c1f8c2f63

SHA512
3c270fc58170c37f51427aac2d3092ddbbc17832556718612cebb0c32c04e7e3b7e157969d458a4b9c3e8bf781c23489319338960cefb5cf530673f2b8f81609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
0b0d403848119581d0df9fc6770cfb1a

SHA1
92644ef650770ca81f13fbaa5130d9c99035a59e

SHA256
d6331e79ec322a4a040f12bd40deb743f02c2487f64cdb1e8f4afadf077d2827

SHA512
b6baa945eeaee4035250e081ef54dae97d1c903fddb5e0408b4cb001b2ea2174e111b675afc8fbf50842d1c4525b227fd499605441a3a5c76109777343c820bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
008c12030eab4e57b40ea12659d8ae1a

SHA1
54545f651f70e6ef0db97f03ec650c45cf679776

SHA256
060fa6cd4c56a4427bceee68f7b007e74e8d1d427bd97793c94619f5116c10ac

SHA512
5cabef1c283eaf41a2b35058748cedb199799d5ac93b78544443fe104622e9efe25f9ebcee10fb56104e914320d17a77aeba9bfb3d93ed5aacee7fbbc1c26df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
9da960800067bc84e697e0f224458731

SHA1
8be5b71a3a4bc64caa1b21093cb5f7f66f4de3a0

SHA256
0e2a2c6ea045e2ee0051803c59c8f6d1613de508d81ba71fdd188be8b3530c56

SHA512
4e893f49f8456d09356795968c0b8ec6ef44a15f5a23d1396e26324e3b78558a893051a7ec51d29d7e8cd4a33a96af311391b209bed8b430522d9689ceb2cc75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
fa83e16f2a0777bfb313837af2be3339

SHA1
d3e8b63933d41dff5948f519260e0feb0a1bb8a4

SHA256
963f3401c026a9495b2be9a90ea971561f2a9b8e59190fe430ac763118dcfd98

SHA512
0dc30211f9fc10f639db9bdc1417e0953b405eae0bb3e2ab295ab60eac44d1f153eb31078bb964ed88ee61a0407f5285b42799a2a7eab86664b6768d1f83977f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34d31ef65cf86a8759f1ee007cb898dd

SHA1
02769ed383e4c8fed12f70efd93d2d6d2f845917

SHA256
918ea2ad75635d2b3a1d69a95d954e0ad9699c68a134d63a3866857f13213d0d

SHA512
578c9f7aa798199da864b6fe7f8c831113a27c3ea1e135e249f804cb528e1dcdce5d895c673bd34c77b3ed48808da50d581f25c669ad959efeefa8f0e03fa5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
535a65f9395b5a0d48eb1f27748dd65a

SHA1
843544e96795c3b35556eb3c96ab5a46e8fb79bd

SHA256
904840b519790810b7626d28ce0921a1373f730a9dcbe37e624427f516e5dbd6

SHA512
6953b9df1080f5b676732f17c7a9f071ae85aefb4d531864722e60832571fd5a79ffb0695cca53cc50a8e1627c9064dbc8606e58a8fcf06a9807e3e35445e339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
535a65f9395b5a0d48eb1f27748dd65a

SHA1
843544e96795c3b35556eb3c96ab5a46e8fb79bd

SHA256
904840b519790810b7626d28ce0921a1373f730a9dcbe37e624427f516e5dbd6

SHA512
6953b9df1080f5b676732f17c7a9f071ae85aefb4d531864722e60832571fd5a79ffb0695cca53cc50a8e1627c9064dbc8606e58a8fcf06a9807e3e35445e339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbe0ab145b2ecf652f99e5667db3c7d9

SHA1
25f667dc6942121c81234f51b6daf35fdf838e0c

SHA256
379b4660720cf454b41f2fe74e8f1bd709e4fb6d2054448d1366498fc4292770

SHA512
50c56f4f6d3572c6f98f33d70bc35166bb567cfe18c5420a5c656442c975fd3b3004879d92303bc0acf39152e8cc107e4e50d7128c0c13ed7ba37ad432ae0ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d92bee4dcdbdd930d75704faa1801bc2

SHA1
d0227f77ec29f624e78c10486a32c5194052a21a

SHA256
f84c841a0063428b46fea2575e602843d8b58697522a336b473b3a2b7c8b2ca0

SHA512
691b24a5346a27d27b589b57aed6b4e9fa5acea2d3dd204b11c28090976bde12084298f1cabda21cd91a79e39ea26493ba96b5ba5807bce75185913e5f026ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
232db701e62758945bdf81b88c9fca79

SHA1
8acd2e0ef674279fdf98e570a9e962ec62f7b0a9

SHA256
bbfc078a91e9b2b8783bf654ce306f694bf5698bcb2cdab3c829105f2c6bea0f

SHA512
a4e749878c431c96d305c62f37353bbf1fa294519fd9c3a34e4b37a77bfd56d6ad2042aa36ca55b4d83a50bf80ac5df86d736465e794830d084006605e40328a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
232db701e62758945bdf81b88c9fca79

SHA1
8acd2e0ef674279fdf98e570a9e962ec62f7b0a9

SHA256
bbfc078a91e9b2b8783bf654ce306f694bf5698bcb2cdab3c829105f2c6bea0f

SHA512
a4e749878c431c96d305c62f37353bbf1fa294519fd9c3a34e4b37a77bfd56d6ad2042aa36ca55b4d83a50bf80ac5df86d736465e794830d084006605e40328a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
ca4e09895f9d7d64e0050d9c72405e80

SHA1
683e8a92755b0d4e1234e284c7e6445f5a207488

SHA256
f7e19d05c1cd492d3a74c980d6e20aec9ecad7f7ee7efbed7af9151d70b3abf5

SHA512
5eb6465dfe8e509d5eff5d86a3f0e6f1e3f534aade768940fbb40ca3cb5e44e6781deb8adeac8c05fdf26ddcad3dceee904b31820d9c465f119f18c840518e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13346017062588951

Filesize
1KB

MD5
acc92e60fc0683dc295d05c0c6508e88

SHA1
1234f90f4de62f07ba776fe2cda7ac291562cf9a

SHA256
3f819850c896ea1dafd0c51fc0d9af4507dfc32270036a6a09e4b98e7acfd7dc

SHA512
383b60510ae9871785e7ba837f7c194725d1abf65b7cd0119b5a768cbda85283e4b3eb2d0a54d1226591fd9cbb839166f2abe201849e4a30162659696a6b955e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13346017062603951

Filesize
1KB

MD5
e8591d0c6fc6d4395cc054133e49b320

SHA1
4fa5542e7d5d49d776b43c27dd9c2639cc330367

SHA256
eb7fb6a6d3b8f4d75ce58df2a7f324229df901a60687a518b255cb000366886f

SHA512
5c304aed7ce4e04fc9c70e9192d810136817a82cb2650fb4abbacafdbb0e108cceb6e0989c57482de67b6168426a68ae2b0934d9fe4e6957bb1cd04f9ee25d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
aae7b2ad08b9be7863af5db98edd4a69

SHA1
5616a3f7aa055c8f185454d57cd9f31531e10a39

SHA256
98801cd8b59fa3788c1b70cb1490b1778d3f9d19c4952da5e2ab2fce51fe7b28

SHA512
f5ee272ad4e242e8a5352fe7c14e02965d84cfef5058120edbb26b5f4e4507b709b5bc9c6c0d753cc726b146d9fb2f3723399ffe970a84004411f8a0b749476a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
7eafa3ca943b3e9b16affc396974d439

SHA1
0ab21503601c9d485ae082418a12d12225b0dc79

SHA256
f252efbfeda2156fae91a43f45f66070419c5291e517d7aedc7dcaac4f5d1714

SHA512
5bc9e7e4edd5f80cc06574f79f588494a8e14c906ec53670e1d2c23bbc76382d02c61a9e0c3a70eef24365d33819c2fa5d649e7c5e00e20b4b3895d5cc7a66b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
6b3878ef701e7f0b8a168badaf67ea73

SHA1
f5d0d0babf156c2beea726ec929ea7b12e3ddaad

SHA256
445a8603e65989c6ded1508e350a6b0587e968b764613a28aa5824a3aa19224c

SHA512
3e3ef536a8b465bcbea59cf2275c8be4597dd3a2bb76a4c4b6b0821b1ba015407a69a208002bccae11c9122c0a8a8eee6b93e4999a9729ff892e4c3de7a69262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
03ad1f9a56bad46270377fbdd2b34e87

SHA1
125d6f44a5dcfcb7d7e006367dfb7ac88f9a785b

SHA256
1eed7280c8808b718268ce6dfb59da8c026203bc7f59d266364c879a8cd72ade

SHA512
47bfd822d2e8e937d4a84f854ad3cf568af464231abc2a28d5f206aba5e6688c75a700ca6c23a3ce30e58bed246523ef6d7c65e5c5bc6bb84fa2586eea263f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
206B

MD5
06f677f10855e81214dee397e6c4e490

SHA1
604cf0c077b7782903ec16af25c884418bb73a3f

SHA256
e8c65ba3449c5051c0a36bd47f2f93645bc72cb40b9cc3d9179f760e7a73bb9a

SHA512
ee66be16fea3e4fa2a1b0f6e26ad43a406df8b30472facfe18ffeb4e27fcd68053d70a2b483c92d5f5736fb2e0749d6d2d7191000c15198d6872dc4c29aa0b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
d38743b80ca89b9e4785a73c06794390

SHA1
acd0a39e88ed1b484379f6f94070b1a8778e7aba

SHA256
317d4de7c4cf2237338f8d9128cb39ef6e63af46230d04ad7bc6d1a3839b4215

SHA512
12174486e03e6b1c6f9621c77a8196be07888dbb7a9e8771b835ef8f273f2c0d49fa2e090b9bb2bb4c77f0c28773787666e722ea2a4f25dd667d698ecf973d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
6f68f678c06ec833585764bfc5c878f9

SHA1
3be64e07ceffb9242feb84b96f0e9fa4410a62d8

SHA256
e76842c9abec9b7668dcdd7f3d0fce940fa169a4b43c67a278422684d17e10c7

SHA512
e2e7531d12acc330d1f4c5ae0e9edba50060ea87464ebf07965680b907fd495b8bc64fa944b7ab89d848202bd64f04dad16cb8211ca11ff1ff7fd5fc11f97e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
530e13359b93f8255b4446bb15782dfd

SHA1
e1aa2015d34124d349a9d0bc3a10bd386b603711

SHA256
3396e44bf9a8b47355749e4d7ace000a804e7291eb6d136bbe31788ec9a9803c

SHA512
43eefa0108aaccdfceaa7c0374375fcfd078befed9c25a97ea9d719830effa877f43f0053b12a83e417f5bc4ec34b1a166621c6c1528da7acec742fa1d2d63bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
ccc4201bc95af70143beb8eccba5cd99

SHA1
72bb58d998a42c1ebb9f5295b127ffd3577f741d

SHA256
1e49891ca3fa80f35e12779b53b49100e068a584dfb86033b55f600e5a3d4aa4

SHA512
3d4085253a9a6187d51604e676e43248636e5870df079289fda76164fa6afa96eb72eecea7b5c58857ce7c84179aa9c0e488088e21738642d0591b51c7993351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
c741dbf53c18ec9295debd3c5300ccea

SHA1
32a0b884d656fed72242d7e965d59b1daa464483

SHA256
35d2989d36b6910d2701b8d2dc0811fde6161d0f4858b8e49f0f4761701ecfa7

SHA512
b5a3216b63a80a50a120299bc344867b3ef82e3e405092931020bc96a8e9a8691925e1b8ad6caa4c8574877379d480312b6bf852c508e74b66b6e24d4d6feba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
47be219b98b99fee450672c511ce5bd7

SHA1
2dfc25f6cff7c1edf68c60a013032002200647aa

SHA256
dcdecffb055620286c1dc9065417e66fa4dd91e875f4d4988fbc79fff1a95124

SHA512
facb75b2956037a036fe2bb2a3b957fb86a057e13c542b5089481e63a803682d093a6ba7679a89c02c397dca6d1df8bd75a331291915de1e188aed9b778f6fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
52b1d9478dca2b2e20b7a880568186a1

SHA1
433885a70d4bbcc8f19d41696c4cdefe70ff8002

SHA256
247688e15848e9ea226e099b63b138c34ab93c5b0f4594cc7c2f129ee85df943

SHA512
48b2e4406fedf1a33faba96f48a8bd0cceae88427f0a66e29dd76533fc0a6451517f0a6aba63dc2af207ace910bfc9ebd797579f8fc86ac112b845a793456ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
e1cb1d1a018971a1b1e0e757f96c57c5

SHA1
696ac63dcd6f2555e15911c300baf89bf34cf104

SHA256
d3b8a124fd6fc71636d1eee6f3c5bb67bf06ecffa5054b5a3945de7203a140ae

SHA512
d2e0e74d9dff7dee9161296acdc791f094d8aec7b64ccd4343f9058111b35319c0fe537cda37b171a030dd0730fc1cbf7681764dda2024ea3dc6b53a46cf07c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
52b1d9478dca2b2e20b7a880568186a1

SHA1
433885a70d4bbcc8f19d41696c4cdefe70ff8002

SHA256
247688e15848e9ea226e099b63b138c34ab93c5b0f4594cc7c2f129ee85df943

SHA512
48b2e4406fedf1a33faba96f48a8bd0cceae88427f0a66e29dd76533fc0a6451517f0a6aba63dc2af207ace910bfc9ebd797579f8fc86ac112b845a793456ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
3B

MD5
1b0cb513f2ac66101ba793bf6072d1cf

SHA1
c54e9c30011b3201d38fb98c3fd76fa8efb065ff

SHA256
ee0821d1b8433ed22d0d739b16c0fc1759f0afcb8597f353e4d9a0268dd47e3f

SHA512
f498f1c3daba7f6c6103c35dda01fc777a894b650adbabfba1bfc19ce7731dd6eec79af9b0fef626cd1dc1182001cbbcda9156db778935c11fcc19f35bdf553b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
9a516256cc4c98ee077bb67aa5d30460

SHA1
298aba1a409da7b998c446ecad4ebb9d98a0b13e

SHA256
12734c5bfc256425b0a4a7964ab4c671bb5361c23f589163987434b583c187db

SHA512
fbf49cb8872f5be3bd5b95f9a27a809ba6a4096b719061b875bdb495bc32b112b3d842472646f061b4d8ce9ce85bb37dd9b19475fe20983dee2b44817d168abb

Download Submit
memory/2736-242-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download
memory/101824-263-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/101824-264-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/101956-274-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-275-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-276-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-273-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-272-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-271-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-267-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-266-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-265-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/101956-277-0x000001C29E930000-0x000001C29E931000-memory.dmp

Filesize
4KB

Download
memory/102532-249-0x00000000054F0000-0x0000000005B08000-memory.dmp

Filesize
6.1MB

Download
memory/102532-256-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/102532-255-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/102532-254-0x0000000004FE0000-0x000000000502C000-memory.dmp

Filesize
304KB

Download
memory/102532-253-0x0000000004FA0000-0x0000000004FDC000-memory.dmp

Filesize
240KB

Download
memory/102532-252-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/102532-251-0x0000000005070000-0x000000000517A000-memory.dmp

Filesize
1.0MB

Download
memory/102532-250-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/102532-248-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/102532-243-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/102784-257-0x0000000000400000-0x0000000000543000-memory.dmp

Filesize
1.3MB

Download