redline | hxxps://github[.]com/gmh5225/Valorant-Phoenix-Cheat/blob/main/Phoenix/Phoenix%20Valorant/Release/Phoenix[.]exe

Analysis

max time kernel
47s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/gmh5225/Valorant-Phoenix-Cheat/blob/main/Phoenix/Phoenix%20Valorant/Release/Phoenix.exe
Sample240607-kpbrrsdf4x

Score

10^/10

redline sectoprat cheat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

51.178.171.56:50378

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aa95-170.dat	family_redline
behavioral1/memory/3264-215-0x0000000000930000-0x000000000094E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aa95-170.dat	family_sectoprat
behavioral1/memory/3264-215-0x0000000000930000-0x000000000094E000-memory.dmp	family_sectoprat

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3264	Phoenix.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
25	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Phoenix.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 364058.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
552	msedge.exe
552	msedge.exe
2764	msedge.exe
2764	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
752	msedge.exe
752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	Phoenix.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 244	552	msedge.exe	79
PID 552 wrote to memory of 244	552	msedge.exe	79
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 800	552	msedge.exe	80
PID 552 wrote to memory of 392	552	msedge.exe	81
PID 552 wrote to memory of 392	552	msedge.exe	81
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82
PID 552 wrote to memory of 1532	552	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/gmh5225/Valorant-Phoenix-Cheat/blob/main/Phoenix/Phoenix%20Valorant/Release/Phoenix.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa331f3cb8,0x7ffa331f3cc8,0x7ffa331f3cd8
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,14794472825628673096,7485476740713888735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Users\Admin\Downloads\Phoenix.exe
  "C:\Users\Admin\Downloads\Phoenix.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
MD5 d56e8f308a28ac4183257a7950ab5c89
SHA1 044969c58cef041a073c2d132fa66ccc1ee553fe
SHA512 fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
MD5 8f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA1 3f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA512 9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 10807471983d9d1650ebd2f89faf7ea17992430f6e0121909002cf3b00e38907
MD5 0ea5af37f2d0bcbf5b32426606a84197
SHA1 4f100a158fab5fd49e16859451501013386ff60f
SHA512 e70cc5239e9a05f7b93f6df234d5b6e7752cbba535b46b6de04daf703e726a88e617d4144fa9c4daa4fac9ccf6ebd817265a177fec2658ce884e3f286f0fd63e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a822b8704ef038a5af49c452fa71b5403e9c33c45cd17fa2d349b2bae14f1b75
MD5 153bde14eb2e4d1dd1f71067f12c4354
SHA1 6b52c4594828ef47a68a57165caad68df21aced9
SHA512 0ad2616c6c5e58bbf9ddb8fe667cec5bf8ae95931fd035186611c9bad5c01be41179463613afc3e74d5999b6a4d5f0dd71becc4e43d00b9a183e3d6df2c04bc2
SSDEEP 96:nomk3nmNcAkxExcGwSv0MoiVmdHIeJbgD0WQyV+VuziX3wI3:nomk3ccAkOtv0MAIcbgDLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 08b5ff1a48a80cbf71c8f7c628e6f8049ca767fc811f36499504215fe1920a30
MD5 dfac9351495112378310b2cb21dd6bfb
SHA1 37ef940a43157974cadb14ab6dbc030e506476af
SHA512 6f6c3ab0b173570ae38b15aa0411181be8c82418b230836f18c2bede809f2ccf29932641e54e3c8025dcf7d3a8ad10a255183c0f2f9ffd0dcabf64f6a3ef8626
SSDEEP 96:nomk3RNcAkfExcGwSv0MoiVmdyutI1jIbJbgD0WQyV+VpAiX3wI3:nomk3LcAkQtv0M/uShIVbgDLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 cdeebfd516a7b3a6856556a35cacee77526d1e68ea36b97a56518a89e13e266b
MD5 4d2b4e5e85a421f5613c9a39a354b8e7
SHA1 c82199579b975dd11ec9e9a1142857bcfce42dc4
SHA512 3574eaf754a7fa03c8d321a4dc506e0a85a4323c127a718e2491a36c782c68c0cfccf00f10c57bc570c01331df62060eb73de917ef8e6365e03ff849bd23a490
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ca55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca55.TMP
Size 706B
SHA256 f47c155087650df0c621048db4db4d3de0f4fcc4e1910d437b6f02d3f6c7e17d
MD5 ca8eb3ff2b6b4fe32d04bb0895713a18
SHA1 046e25326cd7967778395c2e460041d1841a6166
SHA512 cc44b3bac51d7c07c3bd81b1cd2c76cc75e80f34610393ae185627174f995d524c1fef2c3ebdeb4e3f9abbace76d4bfa4f217afc7c6a8e4dab71ec0df79da0eb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5c877f4d81f8221c3f60407e08b912f9848a3e4738322c84865da90291e752f2
MD5 6fa9fca285a38a8813cf063d40a22a35
SHA1 017503944a552c9a92e6f71f7ab7120d77f70d33
SHA512 d6c55cbedca27f39baa67fbd4d1c6909db0a81e49f9dafbac53f2a76de034806eecd3c61e346ee994dba921d1f5337b759d90d9be9c870a01362aad42b5abf25
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGtMlAxre2RUpdRRmlO7Yvmljp:M9iIxuERzA83h09RZxASGSCg5mlO7Ykd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a6e076875ea1f9582e8023f59e9dc233e371d1fb9894090ba662da3772632ea0
MD5 3b5ff90085585bc973ae76fc112ee8ed
SHA1 24fa41df3003854a6c00acde446cb6673d4172f0
SHA512 b6ec118ea0d5bab4f72218707f4eb4620e209ab939fc75e4c41412d1a024c6bc143a1564981328c32ed7755c6ea9068beeae1225767bd01abf1ca77c0429963e
SSDEEP 192:+oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGtMlAxre2RUpdRRmli7Yvmljp:K9iIxuERzA83h09RZxASGSCg5mli7Ykd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Phoenix.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Phoenix.exe:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
MD5 SHA1 SHA512

Submit Download

Unconfirmed 364058.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 364058.crdownload
Size 96KB
SHA256 e6a2f526ba2b181c8fa6dc4f1a751079738d1aa6ffbd0c8a7067eac2ddd714ce
MD5 312d812633bd27cfe777b71cd110d90a
SHA1 12865f062e42c20b335ac65d18276d3724407203
SHA512 151f3f6d6bcb53afe2807051d4f518fb56f62593f64a45127fcf3d0e53e28254908bbea829c398aff27a54e45a9f8d622fcd2f54f978d903a08c25cbacd5945b
SSDEEP 1536:2qsGSqrglbG6jejoigIq43Ywzi0Zb78ivombfexv0ujXyyed2Kt4ulgS6pP:kFkwYq+zi0ZbYe1g0ujyzdiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3264-216-0x0000000005A10000-0x0000000005FB6000-memory.dmp

Download

memory/3264-215-0x0000000000930000-0x000000000094E000-memory.dmp

Download

memory/3264-217-0x00000000065E0000-0x0000000006BF8000-memory.dmp

Download

memory/3264-218-0x0000000005500000-0x0000000005592000-memory.dmp

Download

memory/3264-219-0x0000000005430000-0x0000000005442000-memory.dmp

Download

memory/3264-220-0x00000000054B0000-0x00000000054EC000-memory.dmp

Download

memory/3264-221-0x00000000061D0000-0x000000000621C000-memory.dmp

Download

memory/3264-222-0x0000000006370000-0x000000000647A000-memory.dmp

Download