Overview
overview
10Static
static
38e04860727...18.exe
windows7-x64
108e04860727...18.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3405.htm
windows7-x64
1405.htm
windows10-2004-x64
1SFhelper.dll
windows7-x64
1SFhelper.dll
windows10-2004-x64
1docbook-xsl-update
ubuntu-18.04-amd64
3docbook-xsl-update
debian-9-armhf
1docbook-xsl-update
debian-9-mips
docbook-xsl-update
debian-9-mipsel
head.js
windows7-x64
3head.js
windows10-2004-x64
3networkEve...ibe.js
windows7-x64
3networkEve...ibe.js
windows10-2004-x64
3parse_modified.js
windows7-x64
3parse_modified.js
windows10-2004-x64
3root.js
windows7-x64
3root.js
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 12:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8e048607275f42adff61e4adfee9df0c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e048607275f42adff61e4adfee9df0c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
405.htm
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
405.htm
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
SFhelper.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
SFhelper.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
docbook-xsl-update
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
docbook-xsl-update
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
docbook-xsl-update
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
docbook-xsl-update
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
head.js
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
head.js
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
networkEventSubscribe.js
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
networkEventSubscribe.js
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
parse_modified.js
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
parse_modified.js
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
root.js
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
root.js
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 405.htm
- Size 1KB
- Sample240602-n83alscb4w
- SHA256 f42aa8b08eac61b29a5cddc51819a28a692b69480948f7d003485c0dbddedd8b
- MD5 1c7d2b2fddd34b82883053f74613a7f1
- SHA1 5ded4a3340c5baa2f7875a09234200662a5fb6c5
- SHA512 2d54662a2a3f852d88e27232a93e5807bfa84be55460f4d9c9d2082d22e7818a337d75edb3fcdbf2fd5e6e34721722df16ada243576ace9598701a51797f50db
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 4236 msedge.exe 4236 msedge.exe 3112 identity_helper.exe 3112 identity_helper.exe 920 msedge.exe 920 msedge.exe 920 msedge.exe 920 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 4268 4236 msedge.exe 83 PID 4236 wrote to memory of 4268 4236 msedge.exe 83 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1376 4236 msedge.exe 84 PID 4236 wrote to memory of 1412 4236 msedge.exe 85 PID 4236 wrote to memory of 1412 4236 msedge.exe 85 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86 PID 4236 wrote to memory of 4220 4236 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\405.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12189731065046860110,4739911939449359050,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:920
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3100
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 0528a52791cf864eb2f523b22bd5b8b504062114b956fe7f82a5f949e96e4b2c
- MD5 7f99f37510a11d71ec38820410e890c7
- SHA1 121947e01dcb973dc065a7b8280672f315b2bcf8
- SHA512 0205b8371620084ac642a508855612c5c1f2e71cc4606a5f6ee76a63a9378fa25a58e9f3128ac9af5b911d09df124e4a4e5b1418b926d1db7bef4d15e820813b
- SSDEEP 96:nHkfQ1+n2wpvWMoiVmdeHk4gUWQyV+VDCziEwb:nHkown2GWMX2ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 6f1042c1142a396f35d948c0ff0a43a3aca880202b55755a5b97584fdb0d9f15
- MD5 bf456c9cd0971b609adf61f2eb494cb0
- SHA1 de64071b1f11acd2cc9249d2c85ed8851247c7b0
- SHA512 801e35921111c8144a3712a0eb1062bb9e2ab6330b3a9f9cc220a72a4935b79f87ab40c7f696347c2a19cc3a2068c9a9453d7cf0f2bbcc94bb25286ff14b2e8b
- SSDEEP 96:nHkWQ1+X2wpvWMoiVmdeHk4gUWQyV+VD7AiEwb:nHkTwX2GWMX2rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 188f88e8d0db5a25a41e7a1cb8c38313f79ddf4cd078340724a2f83f41394e14
- MD5 f698f77bfb980ac3e886f1ffa6734434
- SHA1 fee48cd3c4f71ff8bcf7ebdf1036aabfda7e2278
- SHA512 ead3579c0c6520da941bef2e00af0c8e9d1ef4643806d0a4252bb724c3ac91e164e5f90f16177456c2750443b97d044e49589ad62eeaf063b05f95ed07b5c30b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXAe2RUCy4VX3z2OMDCRHqO:A9iIxuERzA83h09RZxYONXaOMWRHqlWj
- MD5 SHA1 SHA512 SSDEEP