hxxps://www[.]linkedin[.]com/slink?code=gZb9Ejui#c3RlcGhlbi5ob29wZXJAc2VjY2wudGVjaA==

Analysis

max time kernel
72s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.linkedin.com/slink?code=gZb9Ejui#c3RlcGhlbi5ob29wZXJAc2VjY2wudGVjaA==

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{94D99590-93DC-447B-83C1-90F8F5ED645E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
3888	msedge.exe
3888	msedge.exe
844	msedge.exe
844	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4648	3888	msedge.exe	30
PID 3888 wrote to memory of 4648	3888	msedge.exe	30
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 2492	3888	msedge.exe	86
PID 3888 wrote to memory of 4792	3888	msedge.exe	87
PID 3888 wrote to memory of 4792	3888	msedge.exe	87
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88
PID 3888 wrote to memory of 4108	3888	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/slink?code=gZb9Ejui#c3RlcGhlbi5ob29wZXJAc2VjY2wudGVjaA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc14ce46f8,0x7ffc14ce4708,0x7ffc14ce4718
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12314395800914170558,2548301846821316771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
2c1997fcfcb7b2737fc25728f3e9e6bf

SHA1
9d28fd418311c1cff0b9e03b09335227ed01d634

SHA256
ddda963e68599bcad0853cc551f03e2830fcb3bbe0e08ecea2b0bbdf3d98c3ba

SHA512
fd49c6fd7e3a14b5a62585e02c635ed651e8c9fa15d4dd1e96ec178ac7029b8724e6da5cd88ff6bdc03ae428eb39d52e7c7882bb4200acd06004cfb745c5cee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4920eaca906751b4cf89b8cd6509d5e7

SHA1
9d941b236ff85fcd0071ad2007cbdfe1e265825f

SHA256
0b2ba4cdf8dd38ef26e9fe1e8accf3c28083f67dbd26d812f1f81ec82923b100

SHA512
9f4a14c210d6ac0d75dc657e32f29c3c053066b4f5d6279f4a6a2e02a8e812b25154cdc6d82965de2c7bd5c413872cc64ca6b1c8dfc6e99bfd2b2df51fa4fa8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d0d2beb33208df1eda21a88b4057cc4

SHA1
d1aece03734d8cad38b203fcbfd9398930f9abd6

SHA256
f9a96952276b28a95f7f33732b71fe0e3cf2d866f4e1b1dcd1c8039b2b6091cd

SHA512
2988d7e2c3948cb2c25745d278f85b2332971a9eef3b9f80d33ffdbc46ef14eeb5ca155be61af93f78e64759de441dd07f64e5f228f03d331faf8688fe7f3232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c71c4e51cf3bf0a6a295684e2cc3f51c

SHA1
fed8a876175aec401d39c5f503892e6742209fb3

SHA256
d4a7ff8e83b4ee1091b96b925d8de551f2b3072b48b999d0ad3dc8eca3858553

SHA512
99b0668c40c3242ddbab1f0e1ca88826b6d35bde852501b54f16dc81579cf3dd35f577a46c9e9a66258f912f4568de1679606f339f90387e6bdc4ae2eee35e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d2398a2fa944d52bcdb72f1786f26a9

SHA1
b12e6a638855cfe762957cb862484f9c91038488

SHA256
d240e72e5809562081558131307385f84187a28b0bf3e994f3bf5270f7dd1041

SHA512
abf85caff0da1bd17f77f6967c02274b91df9e449c7bd4bed05e3a837c83609ed8850f72351e15302938c971facc2fedec17920d6bc251d1c8b3c9de011993ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
801c2d8aa114c4c55221290702eb760c

SHA1
2e92940d7c70b393062047f018eb4419ddbe854d

SHA256
9bd6c02dbc1e8c8441ee853e3ed81f2d2309282bdcbade427a396d5f4ca0874d

SHA512
a450878d8907cd4060d36e4e61b813e9c5bfb2750cc5ad4fb622a7638d092938d27e013a3899283d4c3db43f0cc71c84b8139e8c106b8da9493b0fd5b831b75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d046d28de6e35e07b2eba05c11cd2779

SHA1
21cbfae66159b4c806d13240e2504da3f1d34210

SHA256
2ca307c3b0c24bfb79c64c0225aa4f32e0de1f6eeeff8b78b529e4bfea47679f

SHA512
30ad80be8d1a1235c0c9aab316e5d419f017d728ed7d205555ea4a856f23acf8f6b634e570e4ff5c0086f27ce6ec6e0489ea3b6b005b23dac98ff3f7ca6d4a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc5f5d26b50b0178eca345de2219740c

SHA1
3725e15434352497980033f259d53f4bec453f0d

SHA256
2d159d409158819c3c76990c9be7e524a42be6093b463b5344588dd08e01dcb3

SHA512
af70d4789fe6acbc9574e040441a92072d4ccabb025c954a2b4b51335c2b127c748514df78eff57fa82731c69df60f66c0105414fb65d06a4d68b5af36ce8756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c54e30234108c090d996661a4b9aaa4f

SHA1
baa458ea155df16d2068927d876d914dd2d28e97

SHA256
f90469adb907f73bae54bf8b110f3ce288f7a9c74fe67a7f7ba194d55122758b

SHA512
0df76d04a05f752d0051912afa7cefcd3a1108a7c6bcf274d8be9c437508b5a40f5087cf9102e23edfac4357a1f55ad727f2b658775f2ccd14437b8f460b3cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d95b442d8ddbca184e476776b3c4b76b

SHA1
37861816564da8d6378f8e64fc1f429e4dc2e1d3

SHA256
fb257ce0d95bc37c23add370ebddec0ad6ac7dcfe89f1c6d313d49b0d68e9719

SHA512
8ff15e2cfa06e428c72c60012817bd79972e76be52fb8072b28ab552c4a823d65b680f7a5aa573f198d2c7dcf5c5f1c19cbb3b40ba4f280af91300623f4abbc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be1b2a914aa746dbe6a766770c019ef0

SHA1
835d18debfd43e52fb384226ce3e18a74b91c8b5

SHA256
d7fb4ae6dc2f024af869acd9215085912c356136b2f846c961bfa782ead9058c

SHA512
243f75ac46c358eee053f42e8aeb8cc6c35c45113ac456ee2c4ba16078a8f95d53fadfb4155a42e4a28c798077404bc138c89b5a9d3cea1932ed881f6f0aba4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ef1533a49cafecc5001b3b79ff94ddd6

SHA1
fe899ed1b83bbedbe22754446dd34d26befdd644

SHA256
74149d45cca742c828df03e519d035f8b145e37e694263cd53e2c1bbc956857a

SHA512
5c743e63264acc5a5c8a88393a800d7fc34b8af03f657b87d2ea3ed0153ae56fa225ba2fea56b30dec673f70c2712bc7b53eddbd50534b48600d0a0c46693354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d6d8.TMP

Filesize
705B

MD5
e3accd81b1f5bf80e7c4d68e208e6858

SHA1
f84063874d09195fb643a0c86b6d03116d4007fa

SHA256
f78e4af270946616c12218fc29898150eccbc9113e457d5932d5b9039fcc3b8b

SHA512
70e6cc6a4d08d07c49a5be9b761718c270aed0b9fce0d5159d4d0fd7e0b07013a8d5b89eaefd8b1b833663b50df0417707c9dc05c8e94701ae124fb868ea7700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
acb5bfb34208b4e308e6c5c8d9700fd5

SHA1
26a2207b6e8f927df930575979a0423c2938c04a

SHA256
28caa033358f4d2951cdfb2fa5fd058c74ab3784c73eb5c8d19608f8d3313eff

SHA512
990fced2ab075e92e1d013070f274d71178c56aeda17dd94e48793cc46fa9623cf884cc3b0831cd70a81389f956203b0dbe4435dc5c6ef9ffa40764d228d326e

Download Submit