3c806eec38fc8565c942fe0a79331bf3215989d494bb3d5fa8d8057dcef58e03

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
icyHell.net.url
Size 49B
Sample241108-22f1pasajc
SHA256 e105e65a7ab24c0bd44d0150518e82ebea690c5dc1e8df5a5571ec93f7d257ca
MD5 511c6acc2e680e74ce2ca281ee3b8d3a
SHA1 9e000557a6207f54be35e4f9a3be8016b9e2cb55
SHA512 f15fafc3dd4eb2ae9864a98ab3c6e59348e3dbc28162940d1bf94207cf1fef337323da01c94508decebe13c726c0969526c8fec084d0f63b9cb78c079f679424
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4844	msedge.exe
4844	msedge.exe
4932	identity_helper.exe
4932	identity_helper.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4844	4932	rundll32.exe	83
PID 4932 wrote to memory of 4844	4932	rundll32.exe	83
PID 4844 wrote to memory of 2820	4844	msedge.exe	85
PID 4844 wrote to memory of 2820	4844	msedge.exe	85
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 3220	4844	msedge.exe	86
PID 4844 wrote to memory of 4128	4844	msedge.exe	87
PID 4844 wrote to memory of 4128	4844	msedge.exe	87
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88
PID 4844 wrote to memory of 3200	4844	msedge.exe	88

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\icyHell.net.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.icyhell.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc023b46f8,0x7ffc023b4708,0x7ffc023b4718
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1138241014185048316,7031922815466169529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

7043cd53-429d-4cf0-be7f-967a502183a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7043cd53-429d-4cf0-be7f-967a502183a8.tmp
Size 5KB
SHA256 83c12931c96bb5790c97e5e01adc34ddd5f357317e80fa196fdf0369411691b5
MD5 07328e2888f6e7ce5051c42c86a09c36
SHA1 db72d95b115568f5dd0e8a3bb5ca51f16a0cedc8
SHA512 230cf326024902877d2764585106ad63fc91a74a9159ce86f8084a90967d015e394c577a3d23b17fbdbd022e35beabdbf607a6fbd1341691a1bcc91882879d1c
SSDEEP 96:nWksUm1d31wpvWMoiVmdeH5eTXUWQyV+VDCziEwb:nWk9mP1GWMX0Xro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 8f3c3b2440425378dc1348964a5e23a953a38cfaeaa3d2dca8521982b312b347
MD5 7451428ca98e26d5366b3d608c9bfac1
SHA1 80975861c2b47d33a910c3c9d07c8d439d81ad65
SHA512 c46ec800eda0a7cca8032ce29f172a61f7e68e5ba4193186eb8da55a33503e5a3ad0fcccdac4f2f69dba03a4d356dfaa7ba1d3f2cbb11f5595ac1408dcbc1a16
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 e0026d215f037b50393c5938a09b42822956fdef3415f7227352561bb385f166
MD5 a5ae5c4338c12110fa34d436b87db39d
SHA1 7b01aa26edc8ba2f7ed7a3c9240c0061e8886093
SHA512 83157a690391a0c01470b7285c1a73cd755ec6599565f442bccd7f456e497bb644a96050662170b8b5580cf15c52ea86286c73b0c73ebaff8cb8cf8949c11d2b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 7268e6f3e095b9f7ebc6639118f90e5e218b3dfd103896c5c74e39a9a0f32a8a
MD5 cf81663efb712a7484d16dd94610f424
SHA1 767e9b6343f4cbb03df6106c2c188bfb94bb509b
SHA512 6ac105fd38f500a75a0ed68ce636e9e666ef0a32763cff17365b0860efeee694a6d11d80a4411d0ee0dfaf4f283e23b0d206fe64435aafedef63a2eef50634ba
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 53b5f224039b01eea6ea12ad96e8a43b3f4750084c3cea2c03bac87fdb71cef8
MD5 8e24d189b7774a674b2a955503600e53
SHA1 ee6d06846be32c8c476b58910fc5185dedc3992f
SHA512 c738ad27598fef400ca3deb09580ad00a6f80066e3a1c1049e02dbbfa869594428141796cf2cf03d93280d8da24f92d0e7c95654e6bfbc368b9ca2710b0ee39c
SSDEEP 192:nWkqmPlGWMDurc9biaYQLY9otEre3Xh52aXrg:nWyP4WrcBQBnrqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 11d2e0aebfc504873521f5dbc306ec988c98f9d77c101f97e5971c6c78b339e4
MD5 9a6c2b4b5a317d798c8af5ff60d1cadf
SHA1 710be9c75547c838b77f7c0930d269e9956626f7
SHA512 709fdfc9e1c4aad8b3981db3ae9f014f37fa04edd1988211e4899b35552f6f87ebc32c57ef166ac990d8152b2d14ea0b896f7ffae7960b77e44cd3c4d922d7a3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZe2RUDLkyovHqRUx3GPOxU:A9iIxuERzA83h09RZxYNI6CSFGmx8oBu
MD5 SHA1 SHA512 SSDEEP

Submit Download