hxxp://lego[.]com

Resubmissions

30/12/2023, 14:33

231230-rw6ztacce9 1

30/12/2023, 14:32

231230-rwrj5ahgcl 1

Analysis

max time kernel
162s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://lego.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
2080	msedge.exe
2080	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2288	2080	msedge.exe	90
PID 2080 wrote to memory of 2288	2080	msedge.exe	90
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3536	2080	msedge.exe	91
PID 2080 wrote to memory of 3408	2080	msedge.exe	92
PID 2080 wrote to memory of 3408	2080	msedge.exe	92
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93
PID 2080 wrote to memory of 1412	2080	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lego.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ea46f8,0x7ffcb7ea4708,0x7ffcb7ea4718
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6848756088263405457,15087542519314131601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
e4b41c86e6069909d037526d314d3713

SHA1
c110eb0c0a9b9c82584e8aac497197189889c8ee

SHA256
eb226663425ddf26bb9db3b5f8c550748dd49fc66502b77562fd25d371d3eb0b

SHA512
e6f6fc04d0ed913c87b76b1a1d245579606769dee0b910213d1d271395c9521bd57f85325a77670fde77f77e1e132749588ad358b5e53bd470227b193a54089b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
1499d41f4f1df9abc9e3dd8b3a8f19b9

SHA1
57aa79a44c1539a95f1e197405e9b3c9468b681a

SHA256
125b0b9e42e446d63d6c93f8bc762bd680a06d6f59fdfa93f7edf570625c3dbe

SHA512
b5346a7713a7f3f84ce0cf17649b1ee8e5b62a347f0994ec5d09c521302e274798912f39f9ea938f193a9b40b391f5260531716f2883ae2c8277d384faf8a3c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
664B

MD5
10673549398cf01f2587b6e9657184a4

SHA1
95e217e13f16d2880933dc1e9f18cedcfb840cf7

SHA256
a363bda69b1f9a4ed7f302b72a6e372b452a5e65a560c6ff1b8c44b01ecc4f6f

SHA512
361b56cc69c4d7a5543af647c7ee112b56d32db807bbedc49ae63cc83f6dc56602d2dbefdba5e2b5495349681c51c1f24ec8b5f690a9184505d02a4572baa302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab0fd60b47d71b05a79ce09091961ca1

SHA1
d8bd67ee33dded32a3e980f0017084118894feb3

SHA256
f3db93710ae9d53e4f94b10008beb3012456409150b28a183741264459139100

SHA512
f7552e7c9500a4518e9322b836f9386dc204e0bd5b56b2ba98d72dedf10dd25a0fdaec0bdb151f99d2cd4868fee12adf0b4492114fc56ecaee16f059512b7430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6dffe5c617c24e8ed6924b53a59821c

SHA1
2b6b399c5cdcd4386201b9eb218159d0fec213d7

SHA256
80b5d60d8fbfc0202853cef3dee5468d205411bc7bc9143e432d21df3b41a290

SHA512
ade60a3f9c6307e17326d551264da92d93a8a3f0b750dfa6cf137097bb1eaab8c88f26b88f43cf383f9648cb23d60e67422144b2af7f73fbeeba935c515150b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97927112772df72f652a3e79f4ad97ab

SHA1
93127c09bd54211817e0c20f55d9616a380d151f

SHA256
d934c8cca510cf3991fd18d87329b7c1a84045bf4da6b944cb2f563b44fe6f73

SHA512
a8172d14b13eb882a7480844332276677fc809c4fec64b8a81f94592d83b0cc17dcb33f7ec0136bc6640c9d83afb0b2d2e36114b6060286c528ce1a5a793ba4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
8be2ed426f80143c873b9edfd974989d

SHA1
c6a5b2bdb7b00c1666295cf9e3dce68774bff570

SHA256
b4e2a0c8267fd095e6245af91a471b792ee4c4b150f97d96e6837a4e93682a24

SHA512
4955c471fcf3183b8cff13d6225237a471bba89e5e3626ff6e6c4f343055046547436489a8c54e148ebfa11d8f7934dc9969f850fcb3583be26c4f7d3d7df1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ec23dc6f2609d201c0a7a5f5d18b423a

SHA1
d17699efb032afbf48009b249404237d3a31df13

SHA256
9c2263ba32e3f79686950540b6e488d57ba7677e98568084ace44a1c53c2add7

SHA512
a9be2dbf25a072b8976f76e7d09984e60edcfc8ec2d2ea4978a36f7edfd463a5a8390ca33c39a5bf6f0924cba85ccee6c9784ad0e4a07e895a635350f15512aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f24a.TMP

Filesize
371B

MD5
d049d613d89b7d7060263c98eb16c624

SHA1
37fa23794f30ef992b609e8e41c81e4714c2d87d

SHA256
1f40d10b66549120d7217497196ad3ad0293a4aae11fb7ac219b4b1934b247f3

SHA512
db14b4205271a2f17f02356006dcc4f44de28a9102ca4a04132b22e3721f47171d3c74244897e2670c84b3183077f04e779107a1165ef524e8a6f635ecb8d86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77f5773454ff5470e8c45356061c3e8e

SHA1
c93978b0421b6106f414667cb1e41e412e8a380e

SHA256
2ca3d5554fb3def413c258613a8954695c28991d529982e98187590895fc004c

SHA512
da49ac3a407d9f8bc99c2e413a6956a16542a33808c25d0189eca5154dcd3bc8799a0196d9e289abf408f554195858dea0ead3abd68025f3c1c03406bb09dbd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32c62ce37a748aa55cb169ea2386aff0

SHA1
67b25d3462454c3f8eff1e898bf8c988e4d485b3

SHA256
f9c2e3f288ad66f7b76d29edcbc9ccfbf66f56d8f7906ea64198683e8550632d

SHA512
7d9c733cf8dfb0a7ba00e84510b5fe4cca1bc58ec5c031cb2d1a8332ea35e24a211ee7e30351e04e1edbcba693d7431f0fc7d202b340140175e5b4174bfd7651

Download Submit