hxxps://zws[.]im/%F3%A0%81%A1%F3%A0%81%B4%F3%A0%81%B5%F3%A0%81%B1%F3%A0%81%A3%F3%A0%81%B9%F3%A0%81%AA

Analysis

max time kernel
148s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23/02/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zws.im/%F3%A0%81%A1%F3%A0%81%B4%F3%A0%81%B5%F3%A0%81%B1%F3%A0%81%A3%F3%A0%81%B9%F3%A0%81%AA

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	discord.com
30	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3852399462-405385529-394778097-1000\{5EF66419-F67E-4177-83A2-CD3FFC8B1842}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
104	msedge.exe
104	msedge.exe
4576	msedge.exe
4576	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
4960	msedge.exe
4960	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2392	4576	msedge.exe	81
PID 4576 wrote to memory of 2392	4576	msedge.exe	81
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 232	4576	msedge.exe	83
PID 4576 wrote to memory of 104	4576	msedge.exe	82
PID 4576 wrote to memory of 104	4576	msedge.exe	82
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84
PID 4576 wrote to memory of 4688	4576	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zws.im/%F3%A0%81%A1%F3%A0%81%B4%F3%A0%81%B5%F3%A0%81%B1%F3%A0%81%A3%F3%A0%81%B9%F3%A0%81%AA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeebf73cb8,0x7ffeebf73cc8,0x7ffeebf73cd8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4759952969722843937,10132270801862528029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8fafaa31d2c163af6fb4132a54634aef

SHA1
864452ecafb7d3a61424af2349b6f6ae50d20a22

SHA256
873f79283b81b6304f90fcbc453f0f454661ede7d4e3907f5d4bb28e30a34614

SHA512
71f3d7ba9c03ddf71a3b9a13f6e66a007948a855206179d1fa91deed468b57f5c4c5b1089b1b3a7273249a2737519d2241f1b9dd7992fb24f81bdf13052ad431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
244B

MD5
d1d0dbe73a7653809a59862c0d977a22

SHA1
88587aa52be3d0a0fb13ce3e1212256f6b540280

SHA256
7a1426f21788b5c2e0318ba9aa5dda5638b026dacc37b3b491a48b5b6e4760eb

SHA512
18b65898b9c1bb6f57838975d99c3bfaf4d9ca48962040eb4b9d24f40cae588fcc2f2af4b20a4105f0dc19b9976d70dffe8595176c25aa26dad502b43c752957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
457B

MD5
30e26058ee66d9f1d11dee2a9ba705d1

SHA1
81870b7dd9db835d4f3b3cc977daa579a3629189

SHA256
7e3cb69456e97b8f2374fed95c372a3db14f25198e59dc9d1d9bc65e9d68c946

SHA512
7694a957b7dd45761360390c877b793e0da2b65be2f7c8b984046de126a02f7e7417a2295655be1339489e10d6bcf8e9403684b7fdf345ce5c65df23839d8c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f8a58c39d2cfb8d801d2b8e0fc7c523

SHA1
d8fb5f1c4d9482559e51cadcff18afa56f2ca3ce

SHA256
423e8073c07995e47d631b7ce615842b16dfe99993a4abd07ba2f692dd2e3221

SHA512
a49376222e211d0ddc7b8897a0521d8ca484c23609b88d3e45c83d577ae2f714af0fcb16030fde861359c79cf5917285e0d308299529cc22d28054b1f844f09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a063f53ee8143cebddf2b9f1af4a18f

SHA1
c7aa820fb5f3cc2b3e71ac276c7a80c75f01deb8

SHA256
b07bf540deeba3c2ae76b8668581430e0f291448db28e589bd9bb71f87ccf3a5

SHA512
93d408d020fe5390d1098b43b1df646441b456c6ba65dbac2b72a8dc3c5b33de9f4f8a46a9b692f4d69ff9a12dbc568cca21b56558c8bd98e0c32b18f6f99427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05c5c807f075caa3393aa249143b45d4

SHA1
ba21018d1f6e9cf1a1286ba817fe485cf2db80ed

SHA256
27a19c7a7f78644b7229aed952783c7e1e73798acdcb908a3f8dd36ffed44895

SHA512
f7e43bffb75fb1d766af93c90a9805fffedbfadf4bdb837fd341b8c121f72f8fe9f8ccd0e0c3eb4a824ee9adfb0c789426da2bc622b6efe2b2a3f8cd317b4a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ba9e78beafbd41561a058911d95e505

SHA1
6ae29891efde3e060c585f00d93653cf3e721732

SHA256
fbfab785ebb750cc3cedb96d639922fc420efd2751cfc35501a02eb54c28ed9c

SHA512
279fc4648fc89891088323363c86265b9a9a8ab6757c65f88a1ffd4f2f170b6a8241b646eadd3eaa8885edd76243e49276e37bc272bcd090b5b472f9193228e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
452c1cae2e2662c09fb9d1ddccf1b961

SHA1
79e5bbcc728b3c3fc59588c3811acad8368aaa91

SHA256
d74f3b695a944f0710fa6caa2b86e50ac8b75411f7c2ffe4e4b57024081e14b7

SHA512
414f44bb68ce851ab57402cce7fa321422b80c65d5aedaac4964c72bf9175804cf17def65513db882c47fd08a9951207137a2f8cce8d8e620b24b5060e09042f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d164.TMP

Filesize
204B

MD5
caf3da909b507ccec6c9e4f84ccc7286

SHA1
85704c68e74b705c6d5d89dec257014832e4fadd

SHA256
bdfe35c7efdbc3eb74c5b00dc66c0f6e289a91d742fb7289f9aa7120f0b86c76

SHA512
0af084aadee52ae45dc5d55617b8a87bec698f21019f2f797c1ac15c0fac9860990cdbbffb1d054d150c4c0097361fcbf9dc34887055a4df9ab6a99ec55b0fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83361b8fe215ac8ff27c5cd33436578d

SHA1
5d2cedd62eeadca852e6a2cd680700127fffadd4

SHA256
2bf08be0902b9db0237caef56af76615e4d35d722411100c5ddd34d215fb6399

SHA512
6dfd9f5ff18bc0174c84291b8925e40dc1ee2b6b5c36130176dc1643cff02ba0b7d06cdd29dcd3841ff302de547d7bd5ff9dff5ec9c0440168b39704b71124b0

Download Submit