b895b126be3ed0ead7a9511af69dbbc3a016184d7652ce983247a94538d4d7c6

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe
Size

311KB
MD5

0b55d5f90b2d8aa9737e062269adb350
SHA1

6c79310a1b527a41b14e79713a7f3b197d2b3f3b
SHA256

b895b126be3ed0ead7a9511af69dbbc3a016184d7652ce983247a94538d4d7c6
SHA512

dda7a868681a6248cfe0ece92ac7673b92156edb68cebee03a37bcbf977b1e10f0b3c6376b4eb740ebc1a900ce7635f75ca48ec67e691b8a008f42b5022b3763
SSDEEP

6144:IAeIifU8j6GOHYkHa32njke1WlxEmeXcBbSCzpHfhH0sfpzLe8p/fhAsYbwJw/fD:IRFj6jHYku2njUUmWomCh5UCv3/ZC2hM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
3124	msedge.exe
3124	msedge.exe
4508	identity_helper.exe
4508	identity_helper.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3124	1628	0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe	80
PID 1628 wrote to memory of 3124	1628	0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe	80
PID 3124 wrote to memory of 3324	3124	msedge.exe	81
PID 3124 wrote to memory of 3324	3124	msedge.exe	81
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 1848	3124	msedge.exe	82
PID 3124 wrote to memory of 2104	3124	msedge.exe	83
PID 3124 wrote to memory of 2104	3124	msedge.exe	83
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84
PID 3124 wrote to memory of 4364	3124	msedge.exe	84

C:\Users\Admin\AppData\Local\Temp\0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb268e46f8,0x7ffb268e4708,0x7ffb268e4718
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,5528749060678052465,7790310315070521309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0b55d5f90b2d8aa9737e062269adb350_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffb268e46f8,0x7ffb268e4708,0x7ffb268e4718
    3⤵
    PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fca0b4b8b9aa52f1448ff7abb4f0d069

SHA1
aa8ce41268a919955c33535edb9b55135baeb169

SHA256
eb10674108a4362b85d2aa481da9d2ee58343650d4a619426b24ad59c2b15eff

SHA512
0b5f7054e857f69d07b396fa9804d5f935cfc0bfe7418718d9756a8231ae47be08a5c60315c6b9652c39208f713f6012d61e274539d6635cd7d43b4ffe3819e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1967d1b4796500c3f5b71ebb138b7f3

SHA1
b5ef9a993638eee4369eac7f9fc0f782d72f69c4

SHA256
6560a802ae42eafb87550c5aa1689deedbcc0e7617cb7c1d8b4a4060c2de8ede

SHA512
d7639b857076282a30dc6ad7d7905cc15658462537b4b0a4442c934cd01bb0e9dcf5d772999bbc49608c85716f00f62ee5888a16e4fefaa76e64fccb0edca596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9ffebb2aea509c1d852a45c57deb1f15

SHA1
ab6a8ab94fedc6d97a2d143649f7cb3132b55280

SHA256
4a84aa69da174d7d0b8e5fb4ae366b94879c2528ff88e62ef91a780e7cc90b03

SHA512
8b35f517f937a3644f715ad866a23de1948ac2716f0fd0f9c03f0e06c5e26496016ceb5a5fd8125ee1815f56f2114a773f215672eeecaf636f082bb26e6accd2

Download Submit
memory/1628-4-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/1628-5-0x0000000077462000-0x0000000077463000-memory.dmp

Filesize
4KB

Download
memory/1628-9-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download
memory/1628-10-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download
memory/1628-3-0x0000000000740000-0x0000000000750000-memory.dmp

Filesize
64KB

Download
memory/1628-1-0x00000000006F0000-0x000000000072D000-memory.dmp

Filesize
244KB

Download
memory/1628-6-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/1628-7-0x0000000076060000-0x0000000076061000-memory.dmp

Filesize
4KB

Download
memory/1628-35-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1628-8-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download
memory/1628-50-0x00000000006F0000-0x000000000072D000-memory.dmp

Filesize
244KB

Download
memory/1628-51-0x0000000000740000-0x0000000000750000-memory.dmp

Filesize
64KB

Download
memory/1628-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1628-0-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1628-66-0x00000000021F0000-0x0000000002200000-memory.dmp

Filesize
64KB

Download
memory/1628-67-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/1628-68-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download
memory/1628-70-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download