1bf62962424817df5cb01035a867dd482435ad75714802bec96fd140a129985a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit.exe
Size

11.3MB
MD5

08da60d926eaa0252af9b166761611c8
SHA1

d5fcdb424d36b10de9ca7bcb30d8b677970bc3b5
SHA256

8ce041b5fbb64fb950ac85d68b9edaead06689de305a8584c149632a0283294b
SHA512

ceddfe1f15a99a6d63e27b3c0ace15ce366b0cc55aa63568c95a771f0c269f17809620fc67a6fd3a34b783d0db438bcdf52dd3e1117ec0f45854b547c0460301
SSDEEP

98304:p/LEFfkor/JfIooWvsLMjw4SqOYhisDbAuFa99bUHptmGs0ITIECz/YQ5/otG0Ec:GFfkcfUMjw4BhiMbE9bULGQf5Jap

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
3620	msedge.exe
3620	msedge.exe
4788	msedge.exe
4788	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1296	JJSploit.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1224	1296	JJSploit.exe	86
PID 1296 wrote to memory of 1224	1296	JJSploit.exe	86
PID 1296 wrote to memory of 5016	1296	JJSploit.exe	87
PID 1296 wrote to memory of 5016	1296	JJSploit.exe	87
PID 5016 wrote to memory of 4788	5016	cmd.exe	88
PID 5016 wrote to memory of 4788	5016	cmd.exe	88
PID 1224 wrote to memory of 2908	1224	cmd.exe	90
PID 1224 wrote to memory of 2908	1224	cmd.exe	90
PID 2908 wrote to memory of 2280	2908	msedge.exe	91
PID 2908 wrote to memory of 2280	2908	msedge.exe	91
PID 4788 wrote to memory of 1560	4788	msedge.exe	92
PID 4788 wrote to memory of 1560	4788	msedge.exe	92
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 432	4788	msedge.exe	93
PID 4788 wrote to memory of 1500	4788	msedge.exe	94
PID 4788 wrote to memory of 1500	4788	msedge.exe	94
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95
PID 4788 wrote to memory of 1512	4788	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\JJSploit.exe
"C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /C start https://www.youtube.com/@Omnidev_
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9721746f8,0x7ff972174708,0x7ff972174718
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2902233728984226433,17941676272699781370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2902233728984226433,17941676272699781370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0xd8,0x7ff9721746f8,0x7ff972174708,0x7ff972174718
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,267261887764869444,6982226188055899025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
71505859fabe5e7f440ff73189ac1e13

SHA1
fd7e7d0bd2155b085195de09f53d14947ae2e8f3

SHA256
bd1f971715ff8a549d6d62b5dce2dc5e729ba119691a56a9d7f336b5a9e2b22d

SHA512
2e568db122ceb50d5be8a1bc4b443912df5cf0d758db4d910c63db12b944fc612b320bebc02017416c7419a87b8cc9a98e033e35f2eb911d0a213fb7b56414f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
de9299df72a73d7c5e9269704012ecb6

SHA1
8176dd36346797d36738e62eec777f7c7dd3ee3b

SHA256
804245e3580fdbb0729ef825b54580f63af4b8b1a2178cc632a00a8021fb3129

SHA512
728f52698f2ffd0896b52910a0dd79c06cb1dee1044f776eb32dd825226e2a25d6372ecd51ca73f50c1d2a5e84dd0fd7458fdd2f2415eab06f6eb41c816b400b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad07408e72712e1d9c3e1eb7a9cbcd6f

SHA1
c407f45d30c276766b2e961021b23d1015bfe96b

SHA256
aceb63ba0f01614229dac69b05fcc12ed2719a693c15dc7cb1ad255d7cdd482e

SHA512
81959e622c5d405d7adb1f12a6d10eea0d44d81addf241e570f16f5f818d1ea6cf614dc041b2b6270533e7fec48fc9972fb94e4e886287c10ba20d197fa1d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a87517697ebb2d28868ac61044e4785

SHA1
7d93a398436719ae250db075cfc94c3a244e1870

SHA256
4d256c2541285f5008a4c3f307810a0efded5c25209e2323e18e63b07c2b2e9d

SHA512
e96b26d295c38912f3541c88c9f8bc6e488652a0dc18e8ab6d8496f92df1329575a082a751e4a20e4cd74733407d8748b6de7fcef863b1fb352e6bbbaf506735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b74c6d956f0101370a2aa74c788a0ac

SHA1
086258b25fe147aeeb089ef955e655ff9fa2fe14

SHA256
d641e6c16b66d922949a08f497dc594702bb3555df776d48b03e2438bd342e43

SHA512
5a4682b600d794f2fedad2066dbbb4903ae4da8588f723accd84975f223c19a6b42fbf86bdf6678c1785f10c0bca430f4e58a73227836aea1f6e076ccc857dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47b520675cc83e14d12187355ea422b9

SHA1
3f0406fa2c7a35bd90fe2b308c6918da4f8481bf

SHA256
f2a2a25c8908d4fcf2c3a365002c5f582bf8b4378e6ac20908100f49d80b80d2

SHA512
2955e31765a88712b46bfd0faaa1e11efbfa721748c60e438501ac72af6728d02520d53e84298acaca4dc59d66ab82c398cea658bcfaf6c2466b4c0333042d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c70ffbe19617b0667911ea874fd94345

SHA1
18e53c03643f75f2e4bf28e32395dea861748262

SHA256
07af3e3fd273434b11512276ed55f3fe9d4ed8ee579daab0fe3fe93c251e27da

SHA512
a2ccb8cd85cf7f814a7470ee56e21669323ae2a00ae6236fd97f331172fdc88d6b8383fba9c2bba3e22dcd3b865ab38bc056180f152600fb30729372e3242eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbd6c57565d4d137dd8bcc697f1c3cff

SHA1
d27ecfe4ad6967d884a79c70c8e0b50d200cb455

SHA256
857077aee4cd77e9cb1900fd281a372904263b868259afe1e85194f659cfc1f7

SHA512
b4b9a3fa1095dce13573c83e1267a218c1192b15a29912267131dfd5392c1a55a53a6a2adb81c7d78e1ed46853c4a7c99575b84a26525ffc3764973813c0eb8e

Download Submit