hxxp://zn4[.]gnezdo[.]ru[.]

Resubmissions

29/08/2024, 07:46

240829-jmgdsssenl 5

29/08/2024, 07:43

240829-jkga1ssdrn 3

29/08/2024, 07:37

240829-jfshgsscpk 3

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zn4.gnezdo.ru.

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{2FE57A0B-56B9-4D79-8B88-C5CFFE2463FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
2208	msedge.exe
2208	msedge.exe
3260	identity_helper.exe
3260	identity_helper.exe
5516	msedge.exe
5516	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	368	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4840	2208	msedge.exe	84
PID 2208 wrote to memory of 4840	2208	msedge.exe	84
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 3420	2208	msedge.exe	85
PID 2208 wrote to memory of 5088	2208	msedge.exe	86
PID 2208 wrote to memory of 5088	2208	msedge.exe	86
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87
PID 2208 wrote to memory of 1952	2208	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://zn4.gnezdo.ru.
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe832046f8,0x7ffe83204708,0x7ffe83204718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,2973167151364751387,14475667704297900594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
b44ac6e4b6eebcdcd8a26b65f8e8eee3

SHA1
e12ba6b6da7261de97b74e20d372d56641e90334

SHA256
610d37761622090f23ca0354857cceaeff978d3e18b457358cfee4676d9b6f6a

SHA512
7c71071b23673b6645934142cdb2e9ea1aad4c1c6a8aec7fd567d924993014124f9bfd68d054ef60df6d538f1ee63eeba10b20b54a7a32cc5f6cb59b73ed3581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
72eaa030a9acbcacfc8bfa357400fa9d

SHA1
d88cea87865088b7e5d4cdea83562250eea58fef

SHA256
4c44092f27354bb1d531728586dbf4c543ecc3b55c23910bffc9196bc96f786a

SHA512
f4149f1955c2af13add9578fa54fb27eb32dcb0dd341e12b29749df363b5639a1cf713ba3e559e2d0c38eacc61e3f86f0f7d8ce1b1a35bfa5c86baa61f72c270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8142177729258ae6d87465c60123b3de

SHA1
d4687acb0294134aa5c0fffea0385d2dd3d8e14a

SHA256
0dd2017119f92f7818c0cc6a6f5e046746ac319923e3596d27c67d76ce9a9b8f

SHA512
57b5993a2a53a0f5dedbd91ecab19e55f662c0686bbee75e5d077b219a1ece00966a64f4e1ac7e4947e09d2efc8dc4b96193c7cbc693ac6f2326e15dd380b73a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8f183f4fe61fbaa9fa6737c4be9d220

SHA1
79a855ef4046979f8f9c81e537ce5cfb718a69ab

SHA256
513e107145e7994a176b555aab1ce42295f3df6da92d0fa5b7349129882b612f

SHA512
b1af0cee621d5f248934c52c77cba9e33ae4477cfbf9c022d0510845c137af37491d92dcaf6d54cec1c8827a777186cc180b11cf3a8be8c2ad004f3127fe771d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad327d2aeb24e0d8fc119cb777eadf6e

SHA1
aa78587fe6ccefe99ed643d03a59286319e7f99b

SHA256
2d03bfc2cebac4b08e2fedbe6e4569a91dfd286488aec71589e4100461d34b12

SHA512
680fa129c2394d83be84b052409b3fdf7219a001618165b4b5eecac7c9edba1b15d0bb30d1aed7fc86a7b0956cc32d4c8e170cc452b735339e7680cbe5023a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcddc5c0585a0fea71d0087a54c0a4b1

SHA1
8b5d3125bbd675c791510e0a51ae8358fcd84ef2

SHA256
570bf566c55e42cdf96035a1f86d2a56d6d83fd18c014f3e7f7350d3e74d00e3

SHA512
d0a61e80be35646769210b9b48cb06ded45e23ef96d0a98fd00532fd23633aa86c67ad08caa0e36ece8e2f2e8f62389e6a1869bcdee16fa46ff0a937ae8aa588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a848cf0e1ea0f3e77586789568c2133a

SHA1
af704710e15fa5918371c62e313a0841d8efdeef

SHA256
1531af8bdd37dd0bb9ed1e9bb50802845c93ff8140b52cdf926701c933b280fd

SHA512
2db643eaa1f4d9f0bb9d6d312fea88317f91b9962363f888c2f88443023bcab12fbd67cd1514107d73e8327330654d0c4c532a09753a080732938ff87f5039bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e95afd64a1aeccb546383010db64be96

SHA1
0ea4f0d11db4f32b3325031c88de345faf6bed8d

SHA256
6af4d2ee70af4fe0f5bcb95f76961632fe69c195dc197ee76b052fb21ec58cde

SHA512
b6eba07af186186866fbcdaff4c319c97b5f0fd96e508cc36a77bc2fddeca6415acc3913ea745985de211c588e422f52ba24ebfe0c8a64dca506e5c756490df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b68e89127acd68398021bfc7a073effb

SHA1
8cd7daa7762cf06c76cef76007729619f50af53a

SHA256
1547c44ef0e7f91a3fe69aaa93cb1340267bf576d040a8893a9095de44693514

SHA512
cab9089a7ab30e0270292925e77328bc102ba31e4245b5d8023b286db527d372d574dd6e4d8b917e4d3d835496fb5f7207205ed6ea4de8e4386397b7b8cc0d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fe5a78d2a34b61165cf6e98a328fa57d

SHA1
0f1c6cfb6bb45e210596226af089a3df6e629f30

SHA256
1a3f809fa77a1a30803b9b16549fc89635c64a6eaa3d13239a68aca84cf6b6f1

SHA512
2cf0feb495bd2df10512a00682bb1bbd3ac3ef3c14e6afa0a4c66ac06a02f59818dee63a9260ffe51ef8e6ff53f423e0c253c001c371477d57a90570d4343bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
470c15f5aa0eb5aa3cc1888ad09474f2

SHA1
be0c2e5de2ff5b11f0faf9e4653ef273eecd578f

SHA256
bc79c1c230caa9d6e1f8cd1ad7a48c68b9fabfe3ae475059a02710fc4e1654e3

SHA512
1dc9baf01428e17c9047c6c6bf96c35ab63c9b2b63bf6251add62848eeeae0fa9446b791475fe7fb68617f93890491d7d2b8292ab5ec5155a974968619c1a169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0c2007f224ed8b9f6e828e64bfa643c

SHA1
0eb973fa64780acb4fa4cea9280f4666a46369fb

SHA256
e66166599f0ea398053f082fdf89ea93d1bb6f986cf7d0fbefb8c2d935c204c4

SHA512
daa4687ebaf94f6ce3f86a618004f4b74c107879df81ba3a42670e1c10793bfb0bac8070e1a53c2cd853b655cc085ed021edc0e45dc8cd30e0ea1dbbf6053c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e27b98650df3ae1fd890dd65091dc4e4

SHA1
7845f5b2c78aad477d17606c300c5311a0e105c1

SHA256
f6108e27c8288049803965d5bad41747427f6e28a4f31a9c154a25cbf19c1ab2

SHA512
8e0b265116211240a12d41d8a7172ba260671eff5e7c1c653b5a7e85dc41bbc678deef1a76bc3c77778920792a858305e5a881caf0143504e1241d35c243fd81

Download Submit