3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
icyHell.net.url
Size 49B
Sample241108-22f1pasajc
SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
MD5 511c6acc2e680e74ce2ca281ee3b8d3a
SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2880	msedge.exe
2880	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2880	4868	rundll32.exe	83
PID 4868 wrote to memory of 2880	4868	rundll32.exe	83
PID 2880 wrote to memory of 4228	2880	msedge.exe	85
PID 2880 wrote to memory of 4228	2880	msedge.exe	85
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 1064	2880	msedge.exe	86
PID 2880 wrote to memory of 2328	2880	msedge.exe	87
PID 2880 wrote to memory of 2328	2880	msedge.exe	87
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88
PID 2880 wrote to memory of 2584	2880	msedge.exe	88

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\icyHell.net.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.icyhell.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe4,0x100,0x104,0xd8,0x108,0x7ff9eebe46f8,0x7ff9eebe4708,0x7ff9eebe4718
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1967027112320363534,17064970870332902098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 6a28881fa385cc3c468d20ae70331ec8d2c69e5d53630cef7979de0d1619d666
MD5 f2927010bcc034571384819e36a59016
SHA1 cf7336ed7677fa155956caec54ed114333a182e5
SHA512 115fa875874e6f342373dfa141220043e44c10a26d0e71df8f5b56f8c7db33a513d0dd0e889bef87a399d1f543dbd1011465b29e12ed8a626fb6222dee2b6a01
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3bd9c24a0f76675145b9ffcd05f1d423ea8c6dd59485f61fb9e4be4a98728964
MD5 686010bf32b1677fd8a1a82d9d8058a8
SHA1 6a0d35d971745236ca42fe2cb682be1bed293266
SHA512 2f6508c1f17f9f4518767629f4b60863ffbf748dc2f5372be5e625c00d52961cbcae4154eadc44a162f8fcc02f78abf1fc45dc346511fe384877bc3805428279
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 38e28617c57101304b2fcfdcc77c7021e512ab30a5252896cdec011637f924b5
MD5 533fee7380106c6f3645a0121019170b
SHA1 096a3a22864a0686f49faac05ac5efba29e6b68c
SHA512 f4371da35307502109c10572dbca63f76882dad5db34aecdce8257323c4917dc59e2a57f6556ecabee7e18665b21fb2e837cf097fc1dab41facb40f0d4dd5c38
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 13b6c3342f9e4a14728e2aefe3059295841c32ce5e693fb483bd262f740fd15e
MD5 44b9517bfaaa1bb8091c5bd4341e286f
SHA1 e0c3956db692eb8f9039bb6cef7dddf40cb215a0
SHA512 3b76220a15976f86f794cd1268ff117f4126a986d38067866af10914c3ad771c2555843d8fbb2cd0653b470ee6b6649d689a941edb63c696b49e888a900ce6b9
SSDEEP 96:nTksd1QxWI/wpvWMoiVmdeHtuEmUWQyV+VDCziEwb:nTk4CxT/GWMXgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 72a61f800e6ec36674a6fc11c7a7309866cb04df470e66dea4b8c032a78c7a09
MD5 26a5378a94a8a02811dd22fce0d65b6a
SHA1 592c1e5bb3cc54800461152764e40b8b53d78e28
SHA512 75fe238d86a1d78e4c5d84240511734c9c822f97547cc70d2df9626735a67aab62f235d5a4d0e3194496c1cd9d06a66376f59ec5cca15ba07cc645853a9add70
SSDEEP 192:nTkXChT/GWMfKu1cubI/Y93YxIxEr4Kg/Q2aTgrg:nTaCIWylcsZazrrTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7b530f7e4103f277f60a403bd05d936dfc5911436f4c9b099e4e4614110556f1
MD5 985c8d10cce1e06f753b178fe3acb600
SHA1 c466e33e92879da3956aa66d7ce13450bca783ab
SHA512 3d9a186f1c6b829b47da3ecd9809a1ddd5e392d4d4074f2437ba9d73a20a0d2db22fc11998314f66610a75cd3a0237a3b01fbcd8567ac04d612fa345969875e8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup37/Ge2RUWd/JbTHqRUx3Gw:A9iIxuERzA83h09RZxYr/IpdF+SFGmxl
MD5 SHA1 SHA512 SSDEEP

Submit Download