hxxps://linkvertise[.]com/608384/126[.]62010553157232/dynamic?r=aHR0cHM6Ly9rZXlyYmx4LmNvbS9nZXRrZXkvWmFwSHViP3RrPUt4NGpBTGpxdmtXNTF0SDI%3D&o=sharing

Analysis

max time kernel
1680s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://linkvertise.com/608384/126.62010553157232/dynamic?r=aHR0cHM6Ly9rZXlyYmx4LmNvbS9nZXRrZXkvWmFwSHViP3RrPUt4NGpBTGpxdmtXNTF0SDI%3D&o=sharing

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
86	api.ipify.org
87	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
720	msedge.exe
720	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3336	720	msedge.exe	83
PID 720 wrote to memory of 3336	720	msedge.exe	83
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 1996	720	msedge.exe	84
PID 720 wrote to memory of 3212	720	msedge.exe	85
PID 720 wrote to memory of 3212	720	msedge.exe	85
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86
PID 720 wrote to memory of 2620	720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://linkvertise.com/608384/126.62010553157232/dynamic?r=aHR0cHM6Ly9rZXlyYmx4LmNvbS9nZXRrZXkvWmFwSHViP3RrPUt4NGpBTGpxdmtXNTF0SDI%3D&o=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3103229842244420261,17405677643338196074,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
bcc4b91575004b43a8d8784b3ce12385

SHA1
d3248f3bdaea64ee97ba0196051000c31abffa38

SHA256
ccaebf2f7e94b54ccd54438896cc4c3867be5dc986527cc71f57a9404d07af41

SHA512
a1c3dc049ca0252a442cd9fcd7ca4786c43b9d0086b6a1273c224c476e613c53f4966c88b6c5350e026da1e27ec977e3ee6a9b53d33eea9995480d4b41e7e98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
ae7a9c404088fae3b9c4ea49913c7d18

SHA1
402a27d49c4b445db556e7aae1b342a8ea661634

SHA256
efbaf07827769bf9e94df642e46afc38abaa130c01e027873df633cc7504a526

SHA512
35f985ff824bd03e77896afe770f9481f21ef2cff90d49febb6a9561026188d0db55ecc38efb32465f8a1c8846e30752998a6172b22c0842693d4da55f1500c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4a628c9332fd85cf2b309b011a64f537

SHA1
b8bcd19784621417bdb1221a04258991df8dddd5

SHA256
f9b03128dd224d3e91a7443b2da6aae2436e6e4a0b990d6eb98f847287e646d7

SHA512
d9291c579ceb38af48bd8a1623199fef16d35028a5e82d8742240adcffb011782fa240d633fa5fa92346c7fbfad0aa976001379cd1be83fd135bf257bd289c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4554e5f36c01ffa18ff2a28f74694718

SHA1
d044d85b2617d14b25f849633d650090d7e9a5e2

SHA256
86f11995c80a1972aec7e14e4ae905a29d981796609a1c9b430b35b4e4254dfb

SHA512
037f85bc77bd3dd697c7b4d2fa226c20ef1a00294687c246842b8bcb48f12177498c147887f59626bb281c4c2037c1608cbd27218356148c57b524053b74addc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
561233e2e4db233d1b2579cede546c67

SHA1
495e3149efb71a62b141bac8fe185ee2afb5533d

SHA256
51d69d1d7b20f5a01770a32e9259fabb606fe33b9e3c5f1c25ef96b334e33a6e

SHA512
96e2bf69f86234292866ed02405b244ca3dd5d34c3c03fef13209723ab710c2815a6975c196b20245ffb858e052f76dcd3ae9212363581e9122b30c95d4bca0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4317fb2d48f8b61f6091ca3c00f7a731

SHA1
9a8a00b8fbd812bfe9955ce30193aa2400550d2a

SHA256
6cde3982caddf2f915a07e6aa2fd5eff59e28c2238ec0488317df1f77f125952

SHA512
dad83ce297867504bbb58a685f757fc3d67db0adee24bcf33a8c5bbe2866ad0a79d716f189520c21b17bc13bf5a77d3b99fe7bf43c236d2463c82ccd48b8ab17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3a22b1576cfe6766f23c098726e2f99c

SHA1
a0b5a81f192405532984b91612f620ce901d2794

SHA256
1d9a79e61ef0f5232f88cbb8738c8320e91ec92cb382740003a42cd9c14d94b5

SHA512
739d264216cca5f78fec9a27367e882f00eccb20fec6f25f612e529978cb4be24045fcde04e62c2271be92f8bf586c6b76382dbe09ae3332f995ec6f0f122588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0baf1614f0749ce152a7d78a5290b850

SHA1
c469e2635ff43e4da8719bd8b1c7035b8ce0b669

SHA256
718a3cdf81d15dcb3ac3101a447a89be826cf3633f6398272d4bd1be85872b12

SHA512
dc78a1171392d7ba1beea85e50f32ebc723e3547fd0969eaf38270ccca47a679a6056a4416c92f935efd7e91bf50d406151e2a88d6840b0f8bfe39acdd3d9dab

Download Submit