hxxp://linux[.]die[.]net/man/touch

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://linux.die.net/man/touch
Sample240424-bdz6jsdd2v

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2177723727-746291240-1644359950-1000\{33437C18-7FCD-40B0-BBD3-9ADA99251FE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2952	msedge.exe
2952	msedge.exe
2748	identity_helper.exe
2748	identity_helper.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5052	2952	msedge.exe	85
PID 2952 wrote to memory of 5052	2952	msedge.exe	85
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 1492	2952	msedge.exe	86
PID 2952 wrote to memory of 2304	2952	msedge.exe	87
PID 2952 wrote to memory of 2304	2952	msedge.exe	87
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88
PID 2952 wrote to memory of 4460	2952	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://linux.die.net/man/touch
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82d4546f8,0x7ff82d454708,0x7ff82d454718
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,358337133136745329,8459909645126940310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b
MD5 e36b219dcae7d32ec82cec3245512f80
SHA1 6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466
SHA512 fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10
MD5 559ff144c30d6a7102ec298fb7c261c4
SHA1 badecb08f9a6c849ce5b30c348156b45ac9120b9
SHA512 3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b4f3f8b7d7595ce56e191e98aac9e7c9c2448a793438e8ba43dc14afb12ef191
MD5 cd8d1ddbc3b0c951bb5447b97302073b
SHA1 a65b1bc3d475f6659ca02f2ca2efa8d0403a7eec
SHA512 af1585277448d525f817636a4539209631a22791a41398d534dfc336601092e1fd136d21a168a5c3df0acfc6ab8101341377586251be75e49be95de271b73669
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 474B
SHA256 dbe560a3bc9c851f096118121126eb67724ddb85d243083e8018cee0e858e453
MD5 b2c7337807108372162135a24a9b44e5
SHA1 c58a95b930cf9652503e2e207f65ac93d4a57dcc
SHA512 3a6ab1d55bb915b0561a650bfffaa624df07c11e1b514b6299143227aece917816cf5c128f359275298bcd390924cd8a8205731cfdbdb10e1cb53c789ad3890b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 154ade22ecc69c57e8f3518844365cc0712a090a4cf3c3702c7a937a4339e85c
MD5 a6b83e1b2d1af9da1861ae80d133ea20
SHA1 c25ad2e748ec41746cd3b05805131969234ab190
SHA512 50d29428398379d57f8995759fa72a701305a9c4ca76c3450b46ccaf5d3bf1f41eefb087582c4642768ae4e6f44f3f48462dc0109f29763d87b43cf4e0481971
SSDEEP 96:nuClksvxm/YQYmq+Ct1LjcgDRwpvWMoiVmdeHvxernxdDUWQyV+VDCziEwb:nPlksE96tRjcgDRGWMXZYxtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 70712f6db669fa4023741f3e2574f172e50e4b75d2a2155d6759a61057195556
MD5 3ea9b1293f74caecc93ed08cff0e72aa
SHA1 34bc5b583b84a5ca6663b269369d7a2e1de7e266
SHA512 33ff0caf5f993af69081acded4b9a1a6053dfb00a772ffaadbfc1ec06497bd0b675483cc4113e268513e44f265418ee6c9bf2d84de7f97d6b464eb58e86c58a6
SSDEEP 96:nuClksvxm/Ynmq+Ct1LjIoDRwpvWMoiVmdeKjuaOS1eG5stqvx/YrnxdDUWQyV+/:nPlksEn6tRjIoDRGWM8ucItqZuxtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 37bb41ee9c6e32d425c5285bb56f31c9d2a58081f5055e94837f3ee23187fa04
MD5 8d3168d8a883a71cf0309a6a781cf00d
SHA1 4fd961b8897f62353c8bd56e778ae6db012741b1
SHA512 4bd3f2cbdec60f584506e6651fa83c324c75ce0bff8377048804ca99a507db2e2084ddd8ad6152937bb685eb69a2f0ba3604699cf3617e99c9146a2a742d4577
SSDEEP 192:nPlksEm6tRjIzDRLsWMQw7hucMqn2Z7xtrg:nN90ZISW2X+7x2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a510d05aac0015a1d57040c69d4b6172854f347f510e6367ebb4cfb14ec28e11
MD5 84b8b803fc5cf3c97072361eebdcec75
SHA1 c5c35e0c4fee91fbf1ce42987d1928b0e479130b
SHA512 92a91e77f200dbf29a42a596db6856b4fa83446c2966204039f7de891a549da8176d107e23d58d6fe1c6a56fac103e853593fce2a3441a41befa7cf54660a3d1
SSDEEP 96:nuClksvxm/YOmq+Ct1LjI2DRwpvWMoiVmdeAw7j0Guqn2vxX3rnxdDUWQyV+VD7l:nPlksEE6tRjI2DRGWMQw7kqn2ZDxtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 0a29940260132afd40d31fff7778f667b0065e87012a742ddd0dd8802ee9b677
MD5 40386ff41d45bd376ebfdcfa5848b690
SHA1 963062a615ec103c5aff6607fc4bfaafa17f81c3
SHA512 af01fd519a6b6b802b531bf32c27a2653b0a196089b7758b382da3c2f230cf95889a2c6db55578af758f432fc36618a079e0e3ca989a283d0a872c5045887254
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 87b42f5674fd3b346a4e8ef474a8f10c861a025342f4a3a467dade05b6dfbf8e
MD5 f10bfa3a8df13d990f5fb1f85d4f953d
SHA1 4cb8f035dd46d7953190f569f961b696f78e3465
SHA512 b8cb068aada1df247e3fdc9c129257c613b318da681a3eb44ea2edbd9c7bf0c430531944465faee625283b7435507f5534c9bc7749caa5abf09c7adfbfc63e6f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58eeb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eeb0.TMP
Size 369B
SHA256 9dda35b07735b044f6b5ec8a8192f35f92ace0d844fdf46f62b45933ed31ece4
MD5 6423558dbfc5eecbd286e5abef5aba8f
SHA1 3443a3fc5d30a10cedb6ee126a76e08bec998c5b
SHA512 5b7f6e5e4c8c51413ea9ca99c626ec6f8dbe5bd429763b5958ceecd91bc5929649dc013530d96aff9068e6d4fbe5ee0c3f43b5f870f2b085baa52c1b29b5b9f8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f5401cb866cae1c8b998a4dd3bfbd3ddb883b3e79fd42ed37e94d49ded094db
MD5 bba78a366047c22accc23158ee42892d
SHA1 19e52132b5b8e526aa7448bfa9d35341f86101f5
SHA512 129c7484b602d516cb4c443249a187dbe9ff520e794774f8e628f85bd4e0e8ce7db7df0b8aa5c360ddd94e14aa5ca69b1de1d77b73abe7ac65234122bbe2b968
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5I/b5qZe2RUWS9fzvpo88M:A9iIxuERzA83h09RZxYCi94vpo8aP1wD
MD5 SHA1 SHA512 SSDEEP

Submit Download