kinsing | dbff81f2bdd65f4f99e28fcdbbb4b410f5a12d9882b866b82082602899f610dc

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75184d23f2274ec055b70fb9a78ad166.exe
Size

876KB
MD5

75184d23f2274ec055b70fb9a78ad166
SHA1

d985714db286580a68de67f5717c8481b6490ea5
SHA256

dbff81f2bdd65f4f99e28fcdbbb4b410f5a12d9882b866b82082602899f610dc
SHA512

6897423ddc4c9b53d71547f75974030e58c56d908095186d469e1979fec27863749cc648dfbdf782a7a11c7d77cd5225f6ef5fa5d8967cdacd0db44dad263b89
SSDEEP

24576:nyLHuEU/Ve5SXJe8qXHgaKpr6gLUIpnK2ljS27vs:yLOgR3fgLPpyU

Score

10^/10

kinsing redline sectoprat build2_mastif agilenet infostealer loader persistence rat trojan

Malware Config

Extracted

Family

redline

Botnet

Build2_Mastif

95.181.157.69:8552

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/792-113-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/792-113-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	Install.exe

Executes dropped EXE 3 IoCs

Processes:

Install.exeRUNTIM~1.EXERUNTIM~1.EXE

pid	Process
5008	Install.exe
1296	RUNTIM~1.EXE
792	RUNTIM~1.EXE

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/files/0x0006000000023205-14.dat	agile_net
behavioral2/memory/1296-22-0x0000000000770000-0x000000000087A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

75184d23f2274ec055b70fb9a78ad166.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	75184d23f2274ec055b70fb9a78ad166.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
17	iplogger.org
20	iplogger.org
21	iplogger.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

RUNTIM~1.EXE

description	pid	Process	procid_target
PID 1296 set thread context of 792	1296	RUNTIM~1.EXE	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
4876	msedge.exe
4876	msedge.exe
4492	msedge.exe
4492	msedge.exe
2320	identity_helper.exe
2320	identity_helper.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RUNTIM~1.EXE

description	pid	Process
Token: SeDebugPrivilege	792	RUNTIM~1.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75184d23f2274ec055b70fb9a78ad166.exeInstall.execmd.exemsedge.exe

description	pid	Process	procid_target
PID 4532 wrote to memory of 5008	4532	75184d23f2274ec055b70fb9a78ad166.exe	85
PID 4532 wrote to memory of 5008	4532	75184d23f2274ec055b70fb9a78ad166.exe	85
PID 4532 wrote to memory of 5008	4532	75184d23f2274ec055b70fb9a78ad166.exe	85
PID 5008 wrote to memory of 4488	5008	Install.exe	89
PID 5008 wrote to memory of 4488	5008	Install.exe	89
PID 5008 wrote to memory of 4488	5008	Install.exe	89
PID 4488 wrote to memory of 4492	4488	cmd.exe	92
PID 4488 wrote to memory of 4492	4488	cmd.exe	92
PID 4492 wrote to memory of 1604	4492	msedge.exe	93
PID 4492 wrote to memory of 1604	4492	msedge.exe	93
PID 4532 wrote to memory of 1296	4532	75184d23f2274ec055b70fb9a78ad166.exe	94
PID 4532 wrote to memory of 1296	4532	75184d23f2274ec055b70fb9a78ad166.exe	94
PID 4532 wrote to memory of 1296	4532	75184d23f2274ec055b70fb9a78ad166.exe	94
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 1200	4492	msedge.exe	96
PID 4492 wrote to memory of 4876	4492	msedge.exe	95
PID 4492 wrote to memory of 4876	4492	msedge.exe	95
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97
PID 4492 wrote to memory of 3704	4492	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\75184d23f2274ec055b70fb9a78ad166.exe
"C:\Users\Admin\AppData\Local\Temp\75184d23f2274ec055b70fb9a78ad166.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS8C52.tmp\Install.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1XQju7
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf56546f8,0x7ffaf5654708,0x7ffaf5654718
        5⤵
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        5⤵
        
        PID:1200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:1048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
        5⤵
        
        PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
        5⤵
        
        PID:1216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
        5⤵
        
        PID:3808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
        5⤵
        
        PID:912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:2536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11339710651823036373,12483675928597510757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1380
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RUNTIM~1.EXE.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
4bc8a3540a546cfe044e0ed1a0a22a95

SHA1
5387f78f1816dee5393bfca1fffe49cede5f59c1

SHA256
f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca

SHA512
e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d266b065bb29bced772969b45c685a55

SHA1
e84027bfe21280ed5e6744598fc13a5bed44d569

SHA256
64f14e2b414530e4656e2b756b6a472348c48dea57d9aa6e936fd9ba62c0d840

SHA512
1fb541c102d854b7ca41671a664c6805541375f18f122cef5511650ff81369ed0bead4b09c9374c8605821bfebb3fe80d31134b5c7ae9a1889440a3764130377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35468bd7664ac94a9debf4fc123be797

SHA1
a59bdfbaa34bd12a403afe487a077359abfea38c

SHA256
e35ab92526b0bd8427a77260b65d342bc5e2cb2e94afc0c6f090a2fbdfa27d51

SHA512
91816f305ca87438a96f7ce752602f1cf74b9e09655dec542346e91235246ceca3d0b9abf406d07809950b80278003d332426260cf731d00b5d6004efc2bd3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47022385b6b44a6fcb678b2597fb1e27

SHA1
b540137f5717fdde5252f832829f355cf7e96203

SHA256
d5a5c24edf0c58af4e259a3de4caa817f0210a70fa1a27808b6bf0a5c1e52128

SHA512
44373bab6abb76534039be78e15e07fdb38c1c0b55e25c9c0b84f4eb8ea6074bd80ab90af6b3a230a4d45bfb3367f9075765250b47dc0ece729387c0f5776809

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C52.tmp\Install.cmd

Filesize
51B

MD5
21661026606353f423078c883708787d

SHA1
338e288b851e0e5bee26f887e50bfcd8150e8257

SHA256
6a77796213adbc0eb764c070a3fdfcb5bfa3ad9b6215c1be43f09bfd32014782

SHA512
61760ab64e2c38d9bd5102ab0106e451a5c91e1598906f92e1285b7ae1ca1c6e02480d4157d0f350d2dc816088b5b0838a5d7c7b9d80444ecbf9d62b9ca5b65b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Install.exe

Filesize
117KB

MD5
3973c47bf5f334ea720a9d603d2c6510

SHA1
bf2b72dc12d4d41e08b452e465c40d010b2aba4e

SHA256
4e9a1202844e30f1d62d837cdb440764c851740ab8ee2bd4a8a31475bd449eea

SHA512
cafc322ba71bafad2b15b82553a2a0749d0b6cb8349fe7fd24de25f7dca48c5aa0c9e7d170571c87a55381ec21d33045d7ba9a17891aabee187358da9b406861

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RUNTIM~1.EXE

Filesize
1.0MB

MD5
0c6ef320b361f01d63147dec80c3f34c

SHA1
c04adc3da100118f72e41c1c4645cbf8fa813cee

SHA256
bf89a45619528967430c483c01da54306e4f1b200a8c062697218fdd60bac93f

SHA512
f204ea35dffab3bd703ccf3a52e8ce26be5cde8f24b485b8a0c34a7dc9948bfcae3c7d2d268d5e4fd736dd55245ee995a4bfe0726e2b7fbb379095c69e9ddb69

Download Submit
\??\pipe\LOCAL\crashpad_4492_NQFTUHTXDXMRLKRP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/792-122-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/792-113-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/792-123-0x0000000005130000-0x000000000517C000-memory.dmp

Filesize
304KB

Download
memory/792-124-0x00000000053A0000-0x00000000054AA000-memory.dmp

Filesize
1.0MB

Download
memory/792-121-0x00000000050F0000-0x000000000512C000-memory.dmp

Filesize
240KB

Download
memory/792-119-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/792-138-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/792-120-0x0000000005050000-0x0000000005062000-memory.dmp

Filesize
72KB

Download
memory/792-118-0x00000000055E0000-0x0000000005BF8000-memory.dmp

Filesize
6.1MB

Download
memory/792-139-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/1296-58-0x0000000005530000-0x0000000005586000-memory.dmp

Filesize
344KB

Download
memory/1296-112-0x000000000A910000-0x000000000A92E000-memory.dmp

Filesize
120KB

Download
memory/1296-111-0x00000000081B0000-0x000000000823A000-memory.dmp

Filesize
552KB

Download
memory/1296-117-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1296-110-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/1296-100-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1296-21-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1296-22-0x0000000000770000-0x000000000087A000-memory.dmp

Filesize
1.0MB

Download
memory/1296-61-0x00000000058A0000-0x00000000058B8000-memory.dmp

Filesize
96KB

Download
memory/1296-23-0x00000000052A0000-0x000000000533C000-memory.dmp

Filesize
624KB

Download
memory/1296-57-0x0000000005290000-0x000000000529A000-memory.dmp

Filesize
40KB

Download
memory/1296-54-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/1296-51-0x0000000005340000-0x00000000053D2000-memory.dmp

Filesize
584KB

Download
memory/1296-29-0x00000000058F0000-0x0000000005E94000-memory.dmp

Filesize
5.6MB

Download