hxxps://zws[.]im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Resubmissions

18-04-2024 17:34

240418-v5f2jabf7x 6

18-04-2024 17:28

240418-v15jbsad94 7

Analysis

max time kernel
481s
max time network
595s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3777591257-2471171023-3629228286-1000\{D066ECD1-C82F-4A87-B2C6-E9278D5D0549}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2140	msedge.exe
2140	msedge.exe
2028	msedge.exe
2028	msedge.exe
716	msedge.exe
716	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
460	msedge.exe
460	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2028 msedge.exe
2028 msedge.exe
2028 msedge.exe
2028 msedge.exe
2028 msedge.exe
2028 msedge.exe
2028 msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2028 wrote to memory of 3924	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3924	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4352	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 2140	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 2140	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 908	2028	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zws.im/%F3%A0%81%AF%F3%A0%81%A7%F3%A0%81%AB%F3%A0%81%B4%F3%A0%81%B6%F3%A0%81%AD%F3%A0%81%A3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc0ca3cb8,0x7ffdc0ca3cc8,0x7ffdc0ca3cd8
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
2⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
2⤵
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
2⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2784 /prefetch:8
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5064 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,10010005656400387120,4445124159653422932,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4268 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f1a9c7fa806c60a3c2ed8a7829b1461f

SHA1
376cafc1b1b6b2a70cd56455124554c21b25c683

SHA256
1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b

SHA512
e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f3f6e86c8b7bdc605f5559df800bfd34

SHA1
862d05bfba760ae8adcbb509216dc18ead59a6b2

SHA256
5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78

SHA512
de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
de810d1bc9ae93b0ad3baa8ddac73807

SHA1
d7f6cba26b6439034b6e3609cfd4e2f4cf83dfff

SHA256
056272aa1fc45b03cf3fa18b3a44af82a9581e4ea01daa000c40de7828ab5122

SHA512
9af361d3b0de881c155715fca31663e5771dfcdafab0c320b0e06f84144150a3ba93de82ba1c60f3ee0996d7b4b94ce13e90addaf3fe0b3649b49f6c3a2c08f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
970B

MD5
0b2d2015351229af240a717dfba933b9

SHA1
0f98a0184401c8e706ea80e99946fef3eb48a6f6

SHA256
2b4d51d0aece3ffa4622206c86fcc9d748f9e583e96779ac7f849ec615237bd7

SHA512
f24d3cc7bbb4e0c322788d5547e065162541341bb41b290376aa45e7046bc6e65aad1124203892973def5a27e27bf15f7a8228cab80a7e8f55b601891844b3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
939B

MD5
e746c0a32e5da41bd97a308bea9154f3

SHA1
3c91654749e031706ea6ad56b0563617230008c2

SHA256
bb710d6470f776275ea17df8a263a21f5b340ef4b6acd04bde9b8174e4bf71a5

SHA512
fe9d597b4c8616de266a9c384f1aa0cdf959ead2aedfb4bdf76064b5ebcbe0f4408841483da3a0b7a05710a2cf3c82084671f6be8157b0d035ba251160d75dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
970B

MD5
05816a83a111e681419b70312d2a485e

SHA1
93cd19485150201cc6709270207a196238d5bb73

SHA256
129c242a1af18d70c3bfaa2b3454f5a7ef741d0c78a61339d8d49c597bcb86a0

SHA512
33265b3c1e16a9cc9cc1f9596d756105dcdee59f72b4d7a291c84109838c81870ed36d0903e3f53c24a8546d414c5dc844cd759574e4ecd8c83c77a069400332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
da7981fe4fa19a6be4ffe72f9af60d64

SHA1
b61018f0294f61f0155f74b435a22b1383b45ef1

SHA256
78defe0e130dae1f4bce1d5e7586f4e6f37f9431014865733b8b279d23fc43d7

SHA512
4911ef6f66506af3b22cf4a073230da2af78a38b629367c9830fd085a14a54b5dcfeae9b82213e5b327436590ccf945618e7f0dec4e45c617ab311c02454b7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
34e3911f3ac62f2b6ac91f061550a2e7

SHA1
29bf4f0941ebcac04f599fa1ef1e6cc190460d73

SHA256
1c195e7882061bb567d5fd34360c54681541590ba2ee7c7df81f1135d46af091

SHA512
38c1d176f9ed1b85e1e881c18e1408d1de625078a2efa7d63257886fbb24a8331f181746e1036e09d7c8e94efd094c9bf7a4f9bce191a55c2f955d9897d9d07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
353fe2183e3ee02a83cee30ba0947697

SHA1
1bc1e6159d90548c25651c51165bad9bbe2cc23f

SHA256
878858fbbfa0e4d57f45052d36b4ec11db2c0d34dac9a2146febdcadb261541f

SHA512
12873476f85792f9cf4ec296b0d3967defb7b20f056dd8d708e6410b51706c1569196c6d6f4a323058e00914b1c325df17e387e5193919fdd30414965672168f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
538B

MD5
b45284b564f747d273582b74b903ce53

SHA1
631fefa769327aa81cf616daa94bd14665111eb5

SHA256
0920954bd8a2438e1fc42b14e915d03e11ef48aff6d4bfcf7987bc71da011969

SHA512
47fa47dc34a7c79f574b1428606a45370619881523f09417f63a26f8efae51cb2f5c41259e5f0bbcf04ebb26b3e0051a25b7d617315b0ee8f9a452aaa17824ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585e77.TMP
Filesize
371B

MD5
9593247caeefe3740a165930e7f43149

SHA1
149b1d055c151db2e75173ca6ec9d1f26f533690

SHA256
63646e8288f5bea0079cb431369fa4829e178ba8b5a13fca6b0f2ed057acb646

SHA512
4fe5edbea8d498dd321bf1dab3d4b583799fec195088dc0affae7691bcfbbcc1e4a1cccc11790de1198a637e856c54a9ed63b1a9ce903689e4010e4fe9e3aeff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3d7e05b87cca36778d308d33e77d4053

SHA1
7a65d651edd1a54690d114fb7505e642aea72591

SHA256
a577dcf6af007c6700134df36eba136935fd493d82d5e707e6f0af59172cc8b9

SHA512
d18fc3ddd29e7d1446d3a08faeb4abce052014c029957675eff7cd77f70197b03f4f362fee8653fae89e326ea706714a547fe86680cc3225570cbcb0753dbc8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1bde44716a4f92022ab7dcfb0b2b9e10

SHA1
12ba792490f744ec9d0c9a61017945bd2166f43f

SHA256
48938bb8780a660d2a49b6c47823eda872e4825abab2a68dde7f9f7da8414038

SHA512
5e0680afb8e243fcc9f5f926358b21af6f94762769ed292cdaa5761218ec698b30b6328f3d3c2a3d02406fabe39ff886f62578362977ad9cfb997735c60455e7

Download Submit
\??\pipe\LOCAL\crashpad_2028_TXPXHRCBULDWNWEB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit