3056c537c58c3a88fd83012c4b4b48b91737e7f7de4c578d422e614251e95840

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_8b33c53eb41448dd27e8e74c156b0f91.html
Size 175KB
Sample250108-e3fpzswnhl
SHA256 3056c537c58c3a88fd83012c4b4b48b91737e7f7de4c578d422e614251e95840
MD5 8b33c53eb41448dd27e8e74c156b0f91
SHA1 0d418340241fc77cfc1e50e0479b968a6c2f4a35
SHA512 ed90941cfb645fb33125fab2c42a29e63a4d6dd1477e8ccba501eddc9c8cdce72c6793aaca954ee5856511bd96cda6f91c0bb4a58004601824d45856b722de4d
SSDEEP 3072:P0xjt0G8qxAGXmNJUzi64WvP4yvRJ2TVZG8lDCv5C+zMhY07FR:PCHXmNJxxT
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
64	drive.google.com
56	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
3872	msedge.exe
3872	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4204	3872	msedge.exe	83
PID 3872 wrote to memory of 4204	3872	msedge.exe	83
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4084	3872	msedge.exe	85
PID 3872 wrote to memory of 4084	3872	msedge.exe	85
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8b33c53eb41448dd27e8e74c156b0f91.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabf6646f8,0x7ffabf664708,0x7ffabf664718
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

0a3fd8cf-341d-4c67-87c2-9302d6cda2b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a3fd8cf-341d-4c67-87c2-9302d6cda2b1.tmp
Size 6KB
SHA256 74bc6ed155a9b55695c1beb5853daceb1c6c48b2fe0ffae45d3de6e05f9f54bb
MD5 6984281c11d54c0ec6434b7b05c3c35a
SHA1 849e134425ada005adc2027af30cc9fe2bb3b44e
SHA512 34a57bfdabd2a9eb27e0498a8e5af223ce9f794d085bb609fc61ebf69be57bd1ab329d4d155cc82fd78e9917e1662ed2ea7d5fb85b7de4ea0a53b8e69eb48b91
SSDEEP 96:nUkZS1OVwwpvWMoiVmdefIx27CkGvpUWQyV+VDCAiEwb:nUkYUVwGWMvIx2SprV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 cc91f85cf0410fd218bf4e2c330d46bbbf8333696bd3bffd779c1d36ec7f0765
MD5 b8d6ce598d5cf96959ec51727a2e68fc
SHA1 ed787561b63bd521745f4cfad12cf66a093ea1c8
SHA512 a19d71f330c46c07867f98ac53d5c31cc4b796ad241a0d6d1e7bac962cdb361b646292aa2228ef8cb013ddfd00452833baea69c0e575779c959dc48bac911c8b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4544e96bd9077742acd1fa7950e305aaaeb489e60342d466719c9592be3295f5
MD5 bb829bb4d4cd89cd262707e8a160b21c
SHA1 fa15febf622a334e08464cf7057733b9107ca821
SHA512 95299498d238b01a52f2fa5c942155f37f346228c77d1c65ac4f89db919c17d33653fda099e6ecaa02fa39d4f30426c33b30a43796bc5563d289cfbeb9340c92
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8098ce66b202c4230e8dcb6d9d8ef792dc1678e7021cb1b5d5ced85f8425dbc7
MD5 689e48463fb59c7a590239c4e39d0faf
SHA1 8f5c3e7c6a320f083f485c504cf0e52d29ba92ec
SHA512 065c118ec8067a5a37f9be6b6592f4a25754f08d492344e5b1cc8c9467e354a2bb67477fff33ff61712ede6eb3ba50e12900843b5a9c8a15ae138152f542caca
SSDEEP 96:nUkZS1OrBwwpvWMoiVmdefAIx27CkGvpUWQyV+VDCAiEwb:nUkYUrBwGWMvAIx2SprV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a72b25fa9ce66e69d70b9017ff94963d34ae45d5dc264b6f32a1903146248aff
MD5 51c61a018c46e6e33ca3bf113fe060ef
SHA1 c42e1b488f094144e4de02fba96ba4768634c578
SHA512 851e65604d2b0dfd9586dee5b735c7379b7ae97cfd646d9c5b010eedfea254b5e6c7a62208db001609c91164d81839a9a675ab94d68d2236efc39c7ebb075e31
SSDEEP 96:nUkxS1OrBwwpvWMoiVmdefAIx27CkGvpUWQyV+VD7AiEwb:nUkAUrBwGWMvAIx2Sprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ebef20390c575be0fa3ee4767873f72a2c7fc45b606fd7b6ad4cf7e7daa9db7a
MD5 4a203902945082c40b71b055ec53e198
SHA1 59acf0633ff0d2d7328968a44cdd5015110e872a
SHA512 49d0c481c21053e4bcec89e09ad6e623c88269031cf82dbfc3fb82136feda153f953d460bdd08db715dc2c54db29de7b61223d58519516ec55073854107bcca6
SSDEEP 96:nUkBS1OVwwpvWMoiVmdeH7CkGvpUWQyV+VDCziEwb:nUkwUVwGWMXSpro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 121fb6ddd6772357ae32f5354712a56338041d09c1ce800bf763b7e89e98fb84
MD5 508202a0b0e81056e440315c9cf845d7
SHA1 9c3808bae49fa8ba14785c7b43e185a3759cd812
SHA512 feef76f4b876a7bacd25d6a0c182a7d71dc69b25dfad775177b821d62e2c3b43cae3509a05470e613e7896d99916f7f8cef0ac49f1a892906c4cb624300e8bae
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZ+O5We2RUW4ODHAi8wU8eb:A9iIxuERzA83h09RZxYZ+O54VgiPU8ru
MD5 SHA1 SHA512 SSDEEP

Submit Download