c89dc6a8b14b3a5c2f1884c9821d6ee40f94248275ba6394c4b4cebe98290d94

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2025 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e0e896089036a71cafffbb8ea0d8c6d7.html
Size

123KB
MD5

e0e896089036a71cafffbb8ea0d8c6d7
SHA1

339e435bed611045f64d04191abfbe1b5c57f74b
SHA256

c89dc6a8b14b3a5c2f1884c9821d6ee40f94248275ba6394c4b4cebe98290d94
SHA512

2e8687c829cd260576acea456737d75d8c3d46543f5228f2b0242fa3a91a33a7261dfe3e8654d373cf1c201d5670f79d6b1b556f3572eda812ffa634d7a14523
SSDEEP

3072:JG9cUwc1oBNRwsHd6lt5V/znccYaayevYblTUQtw9Z:JGcUwc1obdU5V/znccbanwblTAZ

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
93	720	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
63	sites.google.com
67	sites.google.com
68	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
792	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
1320	msedge.exe
1320	msedge.exe
4276	identity_helper.exe
4276	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1796	1320	msedge.exe	86
PID 1320 wrote to memory of 1796	1320	msedge.exe	86
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 780	1320	msedge.exe	87
PID 1320 wrote to memory of 848	1320	msedge.exe	88
PID 1320 wrote to memory of 848	1320	msedge.exe	88
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89
PID 1320 wrote to memory of 1928	1320	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e0e896089036a71cafffbb8ea0d8c6d7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe379a46f8,0x7ffe379a4708,0x7ffe379a4718
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14254162339987451656,17885367360082451883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTA3RkUzQUQtQzhGMi00NTI2LUIwN0QtQjMxODc1NDk5MzQxfSIgdXNlcmlkPSJ7Qzg5RTFERTEtRTY1MS00Rjc3LUE4OUEtQ0ZBQzFCMUU5MDU2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzYyQ0U2RjUtNDI1MS00MzdGLUEwMEItOTEyRDZCMDA3NkZEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDkzOTc1MTM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d93f6e4c57710d309e3397e058ad78f3

SHA1
0fbea33aed97992a22327797ad102e419b37e9cc

SHA256
3439987ffec3d9feb7a8943beb481ee0259199882b66b863fe70c9f7ecbc21c3

SHA512
2449fb3826e493fec6304cf48ccab992653be05799467c85f4327feb6446c4109057d08f57fd57a3c342ace8e3c74c887ce9a21112c25a8efbff7fe0ad5c757f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75fc6fd984687a3b60604f8385d2d3ee

SHA1
47ca2cd71dfbddaf9fbdec9f9b4940d465bd40e9

SHA256
7f3c92d21167647ec0b45c9ed1163abd9a8d9199bc1d715edd58440ea1adc6ab

SHA512
cdeaa85deccb8ade6e361b47ee47a2fcf687f91e6105d2b250d6239eaefaaf40ce1f612dfcff132ade8bc497f9527429757ebf477092c8e10b16c6426971214a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
667B

MD5
ab3dc03c6c32310ac916f99c540e3a2b

SHA1
15e84e6d5f119cf3d50016e0d72e58b21640b44b

SHA256
26515060b1944b94df177b7b43f79bd6d0f542d7fd312bcc99cadad812451383

SHA512
a535fa429ad406cfb9a5cf299b854dfb0cae95ecffb0ffe8a33b83151f134581d62c9146db8e8c2b4b42c0f1414e89d1bdcee5cdf6c14d3376afb883bc05ce64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1ac15b46424fc0ae9b5ad52c1f65010

SHA1
20a730ad50022dd61fcefce4b666d1d6ccd6ede8

SHA256
67b83d58c5913baa13c070e1d3e7e164ba61d6aac3564a1cca12461e6aa72825

SHA512
c8cf3c5d02abde6dc3a8aa69dab15fb4be36e36565950d9c07ff8137294672b61ea9acbfa46c6281c432c2a5eee6892bfac888ea1e71cad8620cdd368298e829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
651607aaddabe413392e641fb210474a

SHA1
5a9bac59a0183dc1a953936090012d49a4a34c68

SHA256
5a2c70d54bc421332815c787d8cfcc4ad8228cd6aa0f625a628812a3b6c1ae6a

SHA512
4a1cb58400c950c2912842b69de80b79bae067261fdc548636107c19cf6e322c44799fc8bfd2bc73f6f3a70cb01aac3ab85458154b5d1df8580d5401ea33b7c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4001c2bec24c4eeb33b59490d20e5b71

SHA1
4e9c4bc589d939647c252fe9c52d6a2390ac996b

SHA256
a5b36e5bcaf328a3aa9f15de32f4ce8313457dd641bedee7a14dcd5671e2db03

SHA512
dc7bb6db2b30149260a703a16638125ba9b5f59d9514ac3d043e1e9823ef8f167c46cf04814cc3d768457893fc05371983f0a6692d1fab0be53556ee673fb596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcdc9a8f0e98353a15b328d9f27d194a

SHA1
98b9f8f6071497546b8fd865ba7f4993bf0b3570

SHA256
92cfe9a8166a1b5876db19cc11f2528a9b729043c90eb78da3c3d6012803bcac

SHA512
095ab74d78f6c02d54c4944f2aa60e827bf9e5d2eacf176c72914f48ca76fdd9266c66800ba9b034616b8da871bd86b368f445db528d3a9f9022053d58837dfc

Download Submit