hxxps://www[.]peeringdb[.]com/asn/7552

Analysis

max time kernel
971s
max time network
982s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.peeringdb.com/asn/7552
Sample240104-ybajfaacc6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
1548	msedge.exe
1548	msedge.exe
3460	identity_helper.exe
3460	identity_helper.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3236	1548	msedge.exe	88
PID 1548 wrote to memory of 3236	1548	msedge.exe	88
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 5076	1548	msedge.exe	90
PID 1548 wrote to memory of 4068	1548	msedge.exe	89
PID 1548 wrote to memory of 4068	1548	msedge.exe	89
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91
PID 1548 wrote to memory of 1584	1548	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.peeringdb.com/asn/7552
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9993646f8,0x7ff999364708,0x7ff999364718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11451653886103689469,11922732899777267588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0
MD5 011193d03a2492ca44f9a78bdfb8caa5
SHA1 71c9ead344657b55b635898851385b5de45c7604
SHA512 239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 230e00959c6fec241fc5a32eec9c93f4e423a6b5d226522c83963680e0a27a3b
MD5 d00e31617a0e6a25f27ba86b85d29ba2
SHA1 97b156d538dc2f16ba636404e2619f71bd779c39
SHA512 904d76b230d83ecaeac0900b7a16a34ca785582a3bda51e7e15aaa6a7c49e95fd95a016b72c5ea3b71028835d5e0e967fa30177c02e5737e4a955e27fa687e0c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d6014e6e2a08f5bbf4e87b20b09d5eb4f3d9f2b2f21033dd30db1101700373cc
MD5 87b41e82c5a86da42c4ded270f8afc0d
SHA1 77e35f495cdb966448c98312adffc5a5071f1b29
SHA512 e0aa979af520a932e255d28901cf87598ee679cec058f51558c9d71bc5342131695d6c4df224d523f24f469396601b205185ee48462a1241ffcc3b1190bbc0f8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f56665451c5c6c3b8026d6899119cd9e0e29f28641cc6b377205d679fb2f4e5e
MD5 5bdbcc40ba286af72a321a08b05da479
SHA1 0e19180f7c2826bf38ae2d58fe1fe8718a1bec96
SHA512 fd4b1f29423c83f0aa102768061664eab7519915d815b239a51eaa95c64c5a2518620b15900753daeb5a5f1c40217a296664225b0db7f497f0598bac83b952f1
SSDEEP 96:nUkfx1S9wpvWMoiVmdeHEzUWQyV+VDCzia:nUkZ49GWMXorj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 831afd250aeba134b5344068d579f81fc81f07b5e936d194087a8c42bab7f87d
MD5 b239a7bae7fe6df3f1a566a5de85753f
SHA1 3e2e2bf578a83b16d3d0c5caaf3fb9fe0cf17589
SHA512 42090cc9e6eeb42970e5d652b3c4b4f2cd8acb45bc171a2cb735e10f0f6f03e99ad2858c8dd4d127a652dceea7919d056b35bbe07ffab397bd6df7d44205abb4
SSDEEP 96:nWkytx1SNwpvWMoiVmde1uP1hqEzUWQyV+VDCAiEwb:nWkO4NGWMFuPPqirV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7286d7ef49fd0f1a635293a8c5d34ca27bd431246bc0ddecd3a2f5eea6fcf7f0
MD5 743f71683e849a22d0ae71a6d28441a6
SHA1 a54c8773ff93609c1e3d463aa2311f8826adf1ce
SHA512 0bc65ce4f5746f50893c39c0eed4011c6f3e1cb1947eb4d161d3c2d9df7f81e0a8dc29c5243e537da127ebe2a619bdda7f266a9079cedf615e82559512b4fa38
SSDEEP 96:nWkylx1SNwpvWMoiVmde1uP1nGggqEzUWQyV+VD7AiEwb:nWka4NGWMFuPRgqirg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d
MD5 f5b764fa779a5880b1fbe26496fe2448
SHA1 aa46339e9208e7218fb66b15e62324eb1c0722e8
SHA512 5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745
SSDEEP 768:ntjWGu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLlVkrUufM:ntjWGuu1jaNLjoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 5a953f93ca0480a8c852a76acfec318c754673d810cf037c2b9d428761ac8e12
MD5 ebb7835cb0a08afb036ef914945db7f8
SHA1 ceae60f678d988837c950d4bd82f96a044e6fe4a
SHA512 00f0370d9626f3985525fca6e5a4b9de3143454259a4610ef4e5dd808424a3137383d6111297e6169298d9e7fa5ce7d3222753a707878b4531d69f83e414882e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5801d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801d0.TMP
Size 371B
SHA256 5dabebe730ca06f823ca406173458728153aeac927a7a64f845d616f87da72ea
MD5 754ccc735216b06551c9924c99267bfb
SHA1 4add5a08329470ae6c5b28802aefef282900ad5c
SHA512 e6b973f0a41596cdc3244003201a3e6030285cd66e6aa2c64f74585ce4e2b358eab516aadb9e138508d6dbcadb2580f41cdae8389b5d1b3c166476afd851fc72
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f19d5d66b4f9a814027c6d00af3f17fc62ee3ad7513109b9d82db9e73413de63
MD5 af35148f28d74d6ef9497e31a82412c4
SHA1 1d1b260c0a511e6728c93b3e7f5c5bb2eb504f9d
SHA512 94a8d5fc63f4b87092c62664c067da627344957df29897939b67429d91a1af7136f5347f7063cbcedabde92afdb71425388eebce3608039be70c5ec6504b264b
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupke2RU+LvLEqD38Lk0iwEY:N9iIxuERzA83h09RZxYKzAy38wg5
MD5 SHA1 SHA512 SSDEEP

Submit Download