Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    188s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 09:21

General

  • Target

    https://www.linkedin.com/groups/12441324/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/groups/12441324/
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b46446f8,0x7ff9b4644708,0x7ff9b4644718
      2⤵
        PID:4248
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:616
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
          2⤵
            PID:4232
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:4476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
              2⤵
                PID:1952
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                2⤵
                  PID:1772
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1528
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
                  2⤵
                    PID:1600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                    2⤵
                      PID:4560
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                      2⤵
                        PID:4504
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                        2⤵
                          PID:624
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5432 /prefetch:8
                          2⤵
                            PID:3188
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5440 /prefetch:8
                            2⤵
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3800
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                            2⤵
                              PID:1396
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5924343377164157785,7780299267099983193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2320
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1904
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:5072

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                f95638730ec51abd55794c140ca826c9

                                SHA1

                                77c415e2599fbdfe16530c2ab533fd6b193e82ef

                                SHA256

                                106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

                                SHA512

                                0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                240B

                                MD5

                                0b6e9c99835f148cbd150286e7858319

                                SHA1

                                fea790b5a8cd77ba10da4baacc0bef9b721e3e21

                                SHA256

                                78a0289379d8b4ef4400ea03577dd567573a0d0546aa839b2a36c35843362baf

                                SHA512

                                bf949a0169104d33cfc07e2e2636705ac159d67174847077eb3ba8eecd010486714b7587bdf6ce49262aedd086699aab59a5b354fa9b52e40d2e3bbe478551f1

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                111B

                                MD5

                                285252a2f6327d41eab203dc2f402c67

                                SHA1

                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                SHA256

                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                SHA512

                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                1015B

                                MD5

                                8d555eaa6941b2e112dadac6c48d6b42

                                SHA1

                                ffba65f6031df1a33c33776da44e6978977b01b6

                                SHA256

                                c197837efbf50a1160cf40a2ba8f8700d9f82855faab1c61085d4d438d6c26e0

                                SHA512

                                ee454ae53ced1cbe226b19cb4f616d83ce845ec2e10883e20b5eef80b92f86c903942bcbe58070d3b1987d2eae40b98390836d87280350f3c122b0e4465e1c6b

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                833763b28a166d765a3e1c646fa2451d

                                SHA1

                                ce441de18870dcb8c3c2196cf1448f5f37a24e5d

                                SHA256

                                aba33c11fae1e441c12171d59fab79d3d5531851017e00fc728258b7b0006b6d

                                SHA512

                                3497040d9f9af633552f273e14b6b16e10a630da84b9e93ebed5a0455063c277f27a5b77a51f1602379825e108c7f30ef17df1fb94b56a9213f5749621f18184

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                365b8de819d3fb33ba7d747882a824f6

                                SHA1

                                592f140b34406ea22d1fef045ecb54ba43eb73fc

                                SHA256

                                b1b257e26480bfaea280adf0aa464926a708d1b74cdccf6b3c320c75c8296d94

                                SHA512

                                4c917ae88a45e4011746c605335f08f04b3be916cdf48b8419c4208a7147d5e7b4127b898e60bb4261b1b22d169df87a4b1ab098c1dc1b0e9cd9167086f89e7f

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                39228160ccb23b0c95d7f2371d7f85b3

                                SHA1

                                7331eedb578f5ff98377c4622819f7a5dd17bd8f

                                SHA256

                                44d2fc8f2d01db22d219b9598a66cfb1f7910776476c27fa562a3ba0a93b1f8a

                                SHA512

                                c7d95fc6174b087c71256876fc2261f394c48b8bccd6a4b74acbddb3e39e618f506b04d0a878570e31b99f81aa75b7478d97d5cfc2536b363f2b9a90971c4545

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                Filesize

                                24KB

                                MD5

                                4a078fb8a7c67594a6c2aa724e2ac684

                                SHA1

                                92bc5b49985c8588c60f6f85c50a516fae0332f4

                                SHA256

                                c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

                                SHA512

                                188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                9edf39dda8a538a11d28fc3e2ab5f15c

                                SHA1

                                cc9e283287eae2b70d5659d3adcad0430440a8ba

                                SHA256

                                3e6dfbf3c3ac7ffac333b62344e66f25cd3247a05c74aa8044828868bfd7afca

                                SHA512

                                0bd4d5ec3f5c5a369d785e4c06404c62874fe746ae8999ba8c03374d75a51b3a54e3c7d44a988ce1d1d06f0f6eb9931c2b3e4cfb8acedf84f73ea1ead6338a1e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                758f5ee59a0b56028dd1a36efc9a5ed6

                                SHA1

                                cb5c987fec78555868f2ef50b0ff18f5c24c8e93

                                SHA256

                                bd57f72da40b0d3311582e83f1f5135a5446e0cd650e559a265ef4c6d337f94a

                                SHA512

                                89101763c259b86221148fe3c0699c50a9342155b474783b9caa12c0a25c245e35058368be86d2ee58a0bf797b308f16a46352b12714a1f0534c2610a2f09412

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                21b5580b010fc15ec0bd2cb909bea510

                                SHA1

                                b4bc7a8b12f8d45a33f79ea74f7ba066baf898d3

                                SHA256

                                3575a4825f410fae2095e660178a8e341c6281b21d275fd0c0541a8281253166

                                SHA512

                                fd4a52056b5359ad8e120352ae5e3d7f56e03a6839bd4b1076bd7baabf5337c21e9bdb1ef4dff9b8a0f6b6750843006fb2e3727da18722d570189287d7959ce6

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                8e3bd332f23717cd3fe7d3b8cb76da26

                                SHA1

                                2142d6a00dbf16a09fcd837b3bf1642861858bb8

                                SHA256

                                bfbffaaadbf652c5d19e0aa31bcbb2b60d8fa4ae8476b90960b070bf6ed460e0

                                SHA512

                                6a7f57d4819df1dad7bf7dab2388d328f4264cbb29a883beb31f94d2e8c13fe4e011347ae713b9bd86f9eef6044bb9778a68e98b5ed79b13e8c9b00e6b0917bd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                77e7abee11b793f6c98cbf66ca9c74db

                                SHA1

                                c48b00291218dc59f10ab9273e034206d6ddbb8b

                                SHA256

                                a87ddb58f52f4843782dffde36d42f4ab1fb9bd67caf69b83a13ca31d89850e3

                                SHA512

                                a40bf77d5823106f6a4839eda1cea91a6a1bd972735889fdeb2407565ce591d261fd3bdd8bcc0e7130c4dabcb623c5497f23b85bdf11c8d52592fc8279f1699b

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                d8ccd76694e9b99fe586572376e6a900

                                SHA1

                                1e2e96f95a7881d1407c185a1545328149e4d4bf

                                SHA256

                                d5c9035e019e19d860eb25890d45cc2f61080de44ef441e56dc3c704c6738ef9

                                SHA512

                                55c7e761400d86ba8e00d389ae8325bda66e09651fc7040d4402230668b587a4a84225ffb0bdb004e30fe17d19390ddee9434bf40bb62180b7e587f71c3fa9ac

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                d0fee92940aafa27b0a3a5041b856348

                                SHA1

                                78d2be1086bb3a5638c3cb22989597fce2735c18

                                SHA256

                                2748a7660b7b49a96172c67248d8d8dce124086afe52e6d1c9a7b60e016a16bc

                                SHA512

                                f3cd8934d6c69f285f7297cd57e26444bb1cd211a7929282b453e4a46bf94febd209fc1b3b7c201fa6276854371033839533c5da81ec016360232020548d22a4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                a1e0ea00c8aa9b27f6a6563f2e99e63f

                                SHA1

                                0f7dd8f8f1eb65a7c800cbc55584878c573df3d4

                                SHA256

                                b0bda98bd73833a51379290c1e090a41e4cacbd97558c7e150d373694e88e2ea

                                SHA512

                                3b3f0623e0db4b4245b746e4c7240cc818b3e9cb93cd8c7e8ee8fcc0637b09742fa55343a5d5338a2a0a86ac5588ed4cc4fd3a969b2c2637255c00a9fc520425

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                204B

                                MD5

                                788803d3a4e9aa3c5991f162a513b1c0

                                SHA1

                                d36151d4e65106576aed2acf0e1dbf946b8766a4

                                SHA256

                                6ad82d09576f07878a5212b7c3596e3684f51964a3c4fecf6bbacf5586665306

                                SHA512

                                bb22acea836d4de7968cb629e96f38eab33e81d7534179fe3b1de455b331aeac106d0387c4ab6a96e38670a4ae7e947146f28e5a94f7e0c390ed902aa959a402

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5913dc.TMP

                                Filesize

                                204B

                                MD5

                                508a5c270a54c7e418da200270aca675

                                SHA1

                                ddd4b65020660c2d330602c423d228c51b05e49c

                                SHA256

                                812ebce96515f7c5761142eafdff740bafe657f5e41f672d65077b4d1362cf88

                                SHA512

                                29c9a8681512c430ada89dda580a52ec18be6d949370c74e4c35c7842dcac10f08e86b2cafc145ed0eefa69eba58509b21d423d01638be664e044ce8195e0552

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                4KB

                                MD5

                                3af084ba6056c1725bed77498922248e

                                SHA1

                                c0c4ef0a103e083441e222b1fa6e412bfeed8471

                                SHA256

                                93917205eafb6d0b06e41627ec7923b86546f6122a65d9b26a3a1ffffc49d3a8

                                SHA512

                                ab1ce1acc14ede979751c8fe9d48ddfcb714284528f1241034ffc4f58be3777283a6edcfb4ad5b3660ffadc8c6c7b4ebfd9f4f69bb53c7c22f693ea9342bd1a2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                6883ccd8902772264ed97150fa9734c7

                                SHA1

                                45fd3525d3d0029a94392c5d4472a4a49b1e41e1

                                SHA256

                                94ff2c9c569a606aa0853411eb673f3bc2f47c7e31dfedbbc33085b8d0d5df06

                                SHA512

                                1beb2d64035e2c772457bb4bde5e62bf39dfdaf46b202ad7f83f43bb2f0fbba2756b5eb9ef7a244dc5dbeb260f24596a46caeed43d84b142175601276633f0fb