hxxp://ucessdi[.]lgcns[.]com

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://ucessdi.lgcns.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3048	msedge.exe
3048	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3532	3048	msedge.exe	82
PID 3048 wrote to memory of 3532	3048	msedge.exe	82
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3864	3048	msedge.exe	83
PID 3048 wrote to memory of 3424	3048	msedge.exe	84
PID 3048 wrote to memory of 3424	3048	msedge.exe	84
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85
PID 3048 wrote to memory of 1868	3048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ucessdi.lgcns.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff925146f8,0x7fff92514708,0x7fff92514718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10664021877484560526,1622706291529180799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
56KB

MD5
1b3c316279d795c7ae4b39191bd3e178

SHA1
a6164e379fac39bbd7e277e304c83a733ed12a6a

SHA256
b94814983c1c5398c1edcbec7117909b6bdc45474daec30fd3cc161f044a237a

SHA512
2981bb0061274e0be8abc6800f2f26339b70d28e4a7bc5b1f0b4137f9137ad776df62df1d8a03487d10ca873568012cb4b19e52b641785356470bb42e6a4383f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a2018f5673a2e93e4ef2f9f1a834d35f

SHA1
78a7b62332847df406b2bd7b3c7245f46aa17f7a

SHA256
053bafd6fc81246dc854e64e450d592b767738bd86874a6f7372b68cad06dc54

SHA512
72541ca55bb10e9f044671c37a69f42fcccf387ca85402e2b4aa83b3b793280b82981dbaef623818ddcca4f976f37a571608ca5cf38ff8b63d988c890c57fc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
3d85c14845f8b79cea2a30932f73bccf

SHA1
a31d696442f63288dc6f2dd0288f14ea56f3b17f

SHA256
63a0cda8c2e76f049b8164e4c007850265c13cbb355ef4ae2330579bbf7d43e4

SHA512
8857ae28978086ecbcfc712c098a39310d401b3de62765dafbdc35e24acf75735ae73c2da210ff640d45bf2023c8bb995ac557700c363bb508bda16ff49da682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25ed23a6d45edfe6a15e78c56d59be45

SHA1
59d1e985020da4b5d68c2aec84df2a7621997f59

SHA256
19657efab1937ffcd2b604069bed908ea25292a822805f733ee3c1a9707fe574

SHA512
853826e0ac98d18ec1d71e3565d097b8b136b71791609a08cc6f1b784aeee1505aca29ed2a06743a4c158a230560f4b7136e88f9c7e4ea68ef1b705b25f554fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f8e81289bba1d74f42a3a1aad2dbc713

SHA1
9e9af2706c3dad957ebee20a714c8eca1dac0663

SHA256
e5a65c58e98fc697c38213cc5ee9c734649c70bae2c0ab3d7fefcb41eda6b077

SHA512
f4a6cf149cc5cee226151859b990d92b51b89aff473a12b2afe0db8579c6b26185f17bc87ee24e26560590fa1807d12ab8fc70a0529e83ef04d0d0c4a9476c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e53f453b15ae47fb2f38b0835f4ea3e

SHA1
77f48487a958137387df10e747df30e7346deb00

SHA256
0fbefb84960a652c0c2fb48b12542546b8dc57da900c8e90cca023b85bbbab56

SHA512
4a7ddd5ea4307c7e68e9ee6ee41801054bb18e15f6d24e7e4107a241a9c651aa694fbe5637ca4d9631031ea908407787a4b8f6137b9a5354a28fb0bc6877ef31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
136fda1b1094524ba9e968b19a0b4e2c

SHA1
f31728b5990c261a00d1a3a60ed28e2e79757b20

SHA256
94823d04484135b20a319eb1a291f08676673a4b376dd868959f5f100923f470

SHA512
4a5796862d17e94a5d340c4330ef8475fd583746bfca94f48da0ff7b35f6917068ef0958d7d03bf11bbac18d5f022cfeb802f201b4963dccad49c295bf82c3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4ffb2abc9963fad74862f5ac4fce98b

SHA1
f5f700a3cd4d52870a550aad48fa5c84e00e50e5

SHA256
e399a6f515cb478948b22b2032e07afec5f4a7d9735fe658b4c3cd21880d1e77

SHA512
502df0fa6b404a32e6b760703711fc2c3eacfabe17d57ddd69a9197484e475f95ff97a036a1214b7070611a8772c87241ee121536a7e226f0618d6750e6e3d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee383e341861faab653f4b470aae5b3e

SHA1
246adc99473c591a3fd78721eb38135cd160c224

SHA256
3dbabd8c7067d06e9679b1764f4bf393f2675d4abecc032b3ca4f641de83a11e

SHA512
e050ad3d25d8482832d7559f394f1c2956efd59939941c345686cf078a7b6e675662d20e11b3588da5bdcb5b52c3fd281f3e44826d4bb5abb92c03c3befc0846

Download Submit