3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
icyHell.net.url
Size 49B
Sample241108-22f1pasajc
SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
MD5 511c6acc2e680e74ce2ca281ee3b8d3a
SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
3632	msedge.exe
3632	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3632	4552	rundll32.exe	83
PID 4552 wrote to memory of 3632	4552	rundll32.exe	83
PID 3632 wrote to memory of 1160	3632	msedge.exe	85
PID 3632 wrote to memory of 1160	3632	msedge.exe	85
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 3532	3632	msedge.exe	86
PID 3632 wrote to memory of 2932	3632	msedge.exe	87
PID 3632 wrote to memory of 2932	3632	msedge.exe	87
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88
PID 3632 wrote to memory of 1472	3632	msedge.exe	88

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\icyHell.net.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.icyhell.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff552446f8,0x7fff55244708,0x7fff55244718
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7910154802214634751,5074466543761019968,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 020790795d748086957e185f63e1fb9d91b4aeccc8f6f42451d6a00cfaebebd2
MD5 05d184e3899cf2a3086a89ab49d0a20b
SHA1 5ce534be2ebdadeb1232d4534cd04d972777829d
SHA512 314612dfc1ae7454d73ec0c3d50e824c5188aab525127dbdf41a5a03971e1f47435d1a727b634b32694065db64be591603b74b6af7f62296b8d174dff4fcf2a4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 4b18f4284c828d86273b438b5681e2214963d5694d648658738c108dd10b4089
MD5 13624b9d726b1e309e72a34b3b048d0b
SHA1 7a157a21311bc78a5a09051101f851bc5ce39036
SHA512 192143f6800b5f18970a1cbf859682cbd29e393080339483f704e4ccd222ef63e03882a6cbf0a38cc51c93feabea05d1e9538402959cd21aba696a9ed9d5356a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 1312da3bce6aef037024e5bfe17fc3ec96bb93362f5cd09d2cd2f377e2ac5595
MD5 852718ca40486041a8a206a68272c142
SHA1 f99afd217e49de81a28d0b31ab2f2cd9cb7c5d06
SHA512 502081aa22abc354a1190dac92331c6da4b10642edde5d5b994a909e928ae886d7d64208bf56934e47deabe31cc0f44e7669dd539d2ee334b6a9191cfbc3fc24
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ab2ae17c309032d351e367c7636e62e4e27f43fc741507946e3bd7caf95695cc
MD5 1c77df25a0ec12af06f06bb5a1cee0c1
SHA1 883b238892d20f9de10fac017c87292cd6f4edc8
SHA512 7be0a0ebd570bf001b8832def04286faedcd1e0a38acbf083b97bd2b91a4733bbfce3bbfb7d528c7edb25bf038b8abd63bed113cb648de18428129b63eb622c6
SSDEEP 96:nZkslB1khwpvWMoiVmdeHqZTpxQUWQyV+VDCziEwb:nZkyyhGWMXOpxQro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8e5986a7645484f2bce15acc32aa9eac93438a49047cfd233fae0b8d34faa2e6
MD5 7042c1206d68f0dec414a0e55e84500d
SHA1 8a2bef3611bc3f696c230f4f162ee59ce5cead3e
SHA512 de6886a87316042347ede65c4bfb69d4f137dfb3610af49b8e0d96eaf9f4155902907234d502a00efbcece56c97b3316b7dc3a4e8300390d5db783dd2597850d
SSDEEP 192:nZkxyxGWMMuTcgNbFCYJFYCdrDErKxHVD2vpxQrg:nZQyUWkcgxlYCqr3pxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f5ee68a162b633a84563954fc73588bd0a3ea8fd70c7383489f1c098e762f1a5
MD5 5b8a078ac7834a32c75792e343960020
SHA1 fea3de94af15a70d06574fa124e505b00d60e0e1
SHA512 c6bd6ebfb79c93dc940f06c4450080a1c74faf9c0be27c3802b50306d8862c39911c52cd31ce0c179b10336182307cb9ba9f6a21828920118c5e7654ee527f56
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzWWVe2RUAemSHNHqRUx3GU:A9iIxuERzA83h09RZxYzWYgpHoSFGmxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download