88a19d3e027158e8c66d5068303532a0d56a700f718db80aa97e5e44f39bf4a4

Resubmissions

13-10-2024 23:21

241013-3cgrcsxapr 8

Analysis

max time kernel
93s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSploit.exe
Size

10.5MB
MD5

e59012474c711e0db071950d859bac42
SHA1

2a1839c61829b70874aaecd41d76a03b8c6cb5dc
SHA256

5bd65131cad50c58ae916818d54abe44c014854db770aa71a9933293939ad576
SHA512

61e94c2949d9f08d2ce37dbe5687cc8ff68b274e2ee56d530870a977773a1e04ac58bca4f550887790f0d31534d862cdc869a90621c03ebf030cf73b41fd5774
SSDEEP

98304:cmnvcwo6FMJAAqD+YJTmUmGs0ITIECta99bUHp1TdZiyAIxlh/H:xUHrdqeUGB9bU3dZH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3260	msedge.exe
3260	msedge.exe
4848	msedge.exe
4848	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2452	JJSploit.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4712	2452	JJSploit.exe	86
PID 2452 wrote to memory of 4712	2452	JJSploit.exe	86
PID 2452 wrote to memory of 1880	2452	JJSploit.exe	87
PID 2452 wrote to memory of 1880	2452	JJSploit.exe	87
PID 4712 wrote to memory of 4848	4712	cmd.exe	88
PID 4712 wrote to memory of 4848	4712	cmd.exe	88
PID 1880 wrote to memory of 4796	1880	cmd.exe	89
PID 1880 wrote to memory of 4796	1880	cmd.exe	89
PID 4848 wrote to memory of 2984	4848	msedge.exe	91
PID 4848 wrote to memory of 2984	4848	msedge.exe	91
PID 4796 wrote to memory of 624	4796	msedge.exe	92
PID 4796 wrote to memory of 624	4796	msedge.exe	92
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94
PID 4796 wrote to memory of 4556	4796	msedge.exe	93
PID 4848 wrote to memory of 768	4848	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\JJSploit.exe
"C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\cmd.exe
  "cmd" /C start https://www.youtube.com/@Omnidev_
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@Omnidev_
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe857346f8,0x7ffe85734708,0x7ffe85734718
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4056781312245297221,13578068792534650894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:4028
- C:\Windows\system32\cmd.exe
  "cmd" /C start https://www.youtube.com/@WeAreDevsExploits
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@WeAreDevsExploits
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe857346f8,0x7ffe85734708,0x7ffe85734718
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2421794647302841088,9441554533113502734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2421794647302841088,9441554533113502734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
4033eaa5110a6852f0ad32c00ae4fbcc

SHA1
3b05886780939ca48cb29269c2e898e4fe2880ba

SHA256
e29e9a1dfc114c1c0f2e33428fe60dcd9abb236798d3c7d49e6962d5579926d8

SHA512
3828353b7d88d3b6864067c221e26836a9b63ce90a5ca41154c8ecf382eec24234a787c83e2cbe9fe3079b5bf32cdac614b5b2b51f07f656ddfa769b1d4d49df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
24688ea6babb59f21efd2745a864b2da

SHA1
bc967d24c92835e380f55b8a4686a455b28737eb

SHA256
72daf7e3942198d766cdad62cddacb1ca24d1ba5be2b0252332c826e0f28a38b

SHA512
373eb8f398ef7e233c5d6c807d19966e9c19b645b17f3e9bcf45978da0afce171ff66f26591fe3e1d2d6960d83dc9c81bd8fa7721a776d74cb732227ed2d2227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2d1674bd338b6c67a9b3dca99b65eafc

SHA1
200456394d23f955e5aafede37c91c2a7d18559d

SHA256
bb25b52ca11e7cca2cf0d7b13533ff9e1f323d69de3641d2c05850954169c915

SHA512
e655c9ade940d3f40355ea9cc3ab366d22699c8017d595bda526bddec19c314930edbc54dd356c178d83de039014cb372b85d9a66bc8a42b2f65c03825295bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e399a05b4fd857f5133a13a7e136502a

SHA1
7201c65e8521ecb68f1704d1341037fbe8162114

SHA256
5d016999794ba5b1bc08caea63bb9a2c24c5b0c24a12a75e3a0104a40a5811a5

SHA512
be561c579a64807537b85bb0932f69c592febce618bb41794a890a8d2e62254abe6788abb1f870b34e01ac1cbfb1cf099d05455a6dec86b3be5f83b054b46f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c992180dfa5c1585742733fb3aae7f1c

SHA1
6f69a1484ba99ba4765e5ff56042538e17365a63

SHA256
f2b51c6bcf45d357693e86fbf959fd57ae36fcaa9a122821d18dddf4e38721e9

SHA512
fc10b0c3ecd5df1de50a4a6d1712945d733e58dfab36bbe2ba45ec09787b74d27a54e8f92b8dacab8132d85164688ff730a3355248d0446655df49a7bcc07de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6f757bd5e9d0fd4fbe869d37f2973dff

SHA1
2f4baa10a5c0ab85c8c0b6a29101711ba57db4a6

SHA256
f79f08f363328259942095b4664ad00edc962f0e41e5e82beae5223ae310e243

SHA512
09aedf2748babf1ed5af6db785aaad496c373f6ada8abfa68ba8dacda0aaa1e1d41d0469fd010a6b8953d8bc2743f5ef1cd8e7652d73c697ae9e6003c1a78660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9f1d2cc83ebe4c1480eeaa3b58d0825

SHA1
7bb5611ff350e3db3702e24df2d778c738cf619c

SHA256
b8bdc06233e6618396bdadc1838b01f48ff0b4a683e273996f7552627083f5e9

SHA512
4b0277aed1bb9966cfe88709c330e5474da25ea590950d716b0ce936e74aaa8f098c1b8b419b902c268a29d582caf2b3019e3c3736f0a2069b159099e517e016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
11a23fbb872ebcd6019a40bc94b25246

SHA1
d12f8d7487a4f493066a116d8112c616bdd55884

SHA256
5adeab62057d23327eafb82798d451495506db1a3cde64aed1d138820a4e0967

SHA512
5fd9f34a27eb34b1d2c0286f53674eb3a002bc4cd04f7ad72047099c3086a7324842827ae757c250878147eabf427d38e1523951145e8397b2530e266d61d6e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9689ceca068a5be40a70249f8fada568

SHA1
df2f20c8055fa0f2b718a1fc7338c84309e6a986

SHA256
449d9c014d48cf05fd4d70cb4eb13837a5c266c9a661912cc8fe784dee0cbca6

SHA512
83fd72c042e099b2fc95241da32fad6df4f14f46b4506fee6c3c5626c1280abd2ffdc8b1c4c860c8511a628a671e1dfbd94b4d7671196cfa562065358c8e0d28

Download Submit