Overview
overview
4Static
static
1Thread-11K...�.html
windows10-1703-x64
4Thread-11K...�.html
windows7-x64
1Thread-11K...�.html
windows10-1703-x64
4Thread-11K...�.html
windows10-2004-x64
1Thread-11K...�.html
windows11-21h2-x64
1Thread-11K...�.html
android-11-x64
Thread-11K...�.html
android-10-x64
Thread-11K...�.html
android-11-x64
Thread-11K...�.html
android-13-x64
Thread-11K...�.html
android-9-x86
Thread-11K...�.html
macos-10.15-amd64
1Thread-11K...�.html
macos-10.15-amd64
1Thread-11K...�.html
debian-9-armhf
Thread-11K...�.html
debian-12-armhf
Thread-11K...�.html
debian-12-mipsel
Thread-11K...�.html
debian-9-armhf
Thread-11K...�.html
debian-9-mips
Thread-11K...�.html
debian-9-mipsel
Thread-11K...�.html
ubuntu-18.04-amd64
Thread-11K...�.html
ubuntu-20.04-amd64
Analysis
- max time kernel
1763s - max time network
1685s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
11/03/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
Thread-11K-Cre….html
Resource
win10-20240221-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Thread-11K-Cre….html
Resource
win7-20240221-en
windows7-x64
4 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Thread-11K-Cre….html
Resource
win10-20240214-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Thread-11K-Cre….html
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Thread-11K-Cre….html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Thread-11K-Cre….html
Resource
android-x64-arm64-20240221-en
android-11-x64
0 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Thread-11K-Cre….html
Resource
android-x64-20240221-en
android-10-x64
0 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Thread-11K-Cre….html
Resource
android-x64-arm64-20240221-en
android-11-x64
0 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Thread-11K-Cre….html
Resource
android-33-x64-arm64-20240229-en
android-13-x64
0 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Thread-11K-Cre….html
Resource
android-x86-arm-20240221-en
android-9-x86
0 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Thread-11K-Cre….html
Resource
macos-20240214-en
macos-10.15-amd64
0 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Thread-11K-Cre….html
Resource
macos-20240214-en
macos-10.15-amd64
0 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Thread-11K-Cre….html
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Thread-11K-Cre….html
Resource
debian12-armhf-20240221-en
debian-12-armhf
0 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Thread-11K-Cre….html
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
0 signatures
1800 seconds
Behavioral task
behavioral16
Sample
Thread-11K-Cre….html
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
1800 seconds
Behavioral task
behavioral17
Sample
Thread-11K-Cre….html
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
1800 seconds
Behavioral task
behavioral18
Sample
Thread-11K-Cre….html
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
1800 seconds
Behavioral task
behavioral19
Sample
Thread-11K-Cre….html
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
1800 seconds
Behavioral task
behavioral20
Sample
Thread-11K-Cre….html
Resource
ubuntu2004-amd64-20240221-en
ubuntu-20.04-amd64
0 signatures
1800 seconds
General
- Target Thread-11K-Cre….html
- Size 5KB
- Sample240311-py3dasfb79
- SHA256 a0ac5442e871c9adbe831612c8d22172983a9e26f76619b7eb1bb7d5e6880b4e
- MD5 334bcd68e3bfb66dca523b8bd7b5550a
- SHA1 6fa54615b106d0956188c68edc9b855b559f2d79
- SHA512 5ae3d2665faf061f545e6295c7ffcd0b2c8bc29cf7c0f58665e4503477d8014875e4d961ed7c8e5cb44983780177d4fae059d432ed25fb6881edb3db75b67361
- SSDEEP 96:1j9jwIjYj5jDK/D5DMF+C8mZqXKHvpIkdNWrRB9PaQxJbPq0yTMQr+Cw:1j9jhjYj9K/Vo+nHaHvFdNWrv9ieJPqs
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4964 msedge.exe 4964 msedge.exe 4868 msedge.exe 4868 msedge.exe 1160 identity_helper.exe 1160 identity_helper.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe 1452 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 5004 4964 msedge.exe 79 PID 4964 wrote to memory of 5004 4964 msedge.exe 79 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4576 4964 msedge.exe 81 PID 4964 wrote to memory of 4580 4964 msedge.exe 82 PID 4964 wrote to memory of 4580 4964 msedge.exe 82 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83 PID 4964 wrote to memory of 3776 4964 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Thread-11K-Cre….html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa3e153cb8,0x7ffa3e153cc8,0x7ffa3e153cd82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:12⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,1871347442878071059,4593404846763573169,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4140
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
- MD5 3b1e59e67b947d63336fe9c8a1a5cebc
- SHA1 5dc7146555c05d8eb1c9680b1b5c98537dd19b91
- SHA512 2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
- MD5 0e10a8550dceecf34b33a98b85d5fa0b
- SHA1 357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
- SHA512 fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 d69fa72849fe43887dc1ef46459a8338ee4f130d3a073d1915b8bcd823f38af0
- MD5 462986bbbe630ac1efc982c117dd4a87
- SHA1 dd4ed493a263bd28d437d562868a051235d8e6af
- SHA512 87c5d68b8e32a9714e9c00a4ed8a0fbc26e044dc16b59d56eedabe61b30ff899bc3e7b674f47712edbb5ae89cd46fe77a67c958d62b4e133335b3ca01eb10e20
- SSDEEP 96:nNk3pUC7kKGwSv0MoiVmdHI1VJXuQUnt0WQyV+VpziX3wI3:nNk3pl7kRv0MAI1vXuQUntLx93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 398548e4e3d0d5d0490d06fbae5762101d58aae541ed6cb5eb9c607fb786c526
- MD5 abd9e087b7227a80b9bd775096cf6db0
- SHA1 6ddc34987a529749cbbc33af90efdd863a8732ee
- SHA512 107a906589b3fea644ae9e2fb6adfe0f3f9bf67e7760dfb4372edfb1a0b2167e42fb00dcce663c64d47a89585f5da581822b77783973489dd5c69a7a5aed1bc5
- SSDEEP 96:nNk3ptC7k2rGwSv0MoiVmdHI1VJXuQUnt0WQyV+VpAiX3wI3:nNk3pE7k2Cv0MAI1vXuQUntLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 05eba67d3e9824de8b0ecb6019b226fa28a2deef4917a1a060d79337e6f35c41
- MD5 b1d56af2ebb698ed3d4ecd67bfd65bbf
- SHA1 3e12156df8521863b42f2ad3757f1150e219570a
- SHA512 2e84be5a3afa113b97f48aa905841d9dbbb375e2069ab3e9c0f6d49a5f2216540d94564308097eda4146f59b25efdbfe34d307974b704b03df0245fbbf595cfb
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGFG0Que2RU293foRxhePGE7EM:M9iIxuERzA83h09RZxASG1l3faheGE7t
- MD5 SHA1 SHA512 SSDEEP