hxxp://carefreeflippantbrackets[.]a74leal[.]repl[.]co/

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://carefreeflippantbrackets.a74leal.repl.co/

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ipapi.co
20	ipapi.co

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
3632	msedge.exe
3632	msedge.exe
4500	identity_helper.exe
4500	identity_helper.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4456	3632	msedge.exe	53
PID 3632 wrote to memory of 4456	3632	msedge.exe	53
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 5096	3632	msedge.exe	86
PID 3632 wrote to memory of 4528	3632	msedge.exe	85
PID 3632 wrote to memory of 4528	3632	msedge.exe	85
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87
PID 3632 wrote to memory of 1136	3632	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://carefreeflippantbrackets.a74leal.repl.co/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8099e46f8,0x7ff8099e4708,0x7ff8099e4718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,8571627142777323535,7571269098394650006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9dbef3f8b1f616429f605c1ebca2f0

SHA1
ffba76f0836c024828d4ff1982cc4240c41a8f16

SHA256
3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1

SHA512
4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19d91cda-71d6-45ec-8548-359024fac417.tmp

Filesize
24KB

MD5
6dcb90ba1ba8e06c1d4f27ec78f6911a

SHA1
71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9

SHA256
30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416

SHA512
dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51791c7e-34db-4ca3-99ec-baeae00989ea.tmp

Filesize
1KB

MD5
c9fec429185de00f6b8a3eae09c8d31d

SHA1
cb0320410ec48546387dcb006f03ceb083a38226

SHA256
f2c7904ba00f3380f10d1a76dfa38a9b0859f2e04c495305532a98ea3dad6f62

SHA512
6d237f16fd7c6756842084a9f06e4efddb8553f843fc380b305fe6ac9dbd1629b721570e1f1501cb6664df7a7a42b2784f27f4c9208bb74c2cb50a13c1fe763a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
22KB

MD5
8854469b44f0b3f83532f9eb214aa597

SHA1
b30999d76a1ce418fb2737387dd17da13408eaaf

SHA256
d64e747b11e3619dc603eeeaa91b35945cff891a5df413e3f8188e81f46624ed

SHA512
47e7d1708760fa634fd298fafd337ae91623aeacd2957df1dc6e01e80e171b294c536f4a67f744c862d22a479abea10bf4f944dcf274f60d645c17052367ac0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
32e5313e98f48a283aa2c7f9014c3f33

SHA1
61d65e2f659281f1962b96a4ba1cfebc28113e3e

SHA256
772e6e90f994e59263ec0026a9d2075a2b5f1ad4496d2f22f8f87279a2229a80

SHA512
9f72b1471cc9d0665218f308c0e9cd99acc5e748afbac2a17281ca0ccad5362f6869a2d1de3ca6ddee3bddc0691fa104c6841ff79015dfa46281cce2aafa552c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9994a5c7857b3b3e7e7ff8edc7aca8b5

SHA1
899cd4c23f4298043fb57a4c6e6c657d5d63d4e3

SHA256
42ce7fb72e929af1c5f297de59b5c846cd142524d199962897f00eb9807535b6

SHA512
c537f9b96fc3828954cd4257d63984a2d0d9a1d0e4882b0ec1a0f090f70436810f4cbaca3762a14825f7a1d8bd8ec0f7a8e5030f45073683911858f5bf1f4f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
29a46b3957c12bb8e03fa15cdeeb7a86

SHA1
cba249e98b09dfb4f0b988eee61e017190e3196c

SHA256
e32c6ddad2931ba738049e78932143c0263f8f247ed03aae50bc4feea7bcb354

SHA512
93bfb8acb8f895e3569ac2e8489ead7a52020ddc4f52253b3bf852e1d5c1822cef03bc36a88247d5a44574bb17b83e0e767c48f66e7306b5dbaa7fc8faa0ec42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
923b2051897ec5319452d028b5031554

SHA1
246e0de4a8d307b3c58d008317f0aa42a6ac59e8

SHA256
8384f0a8efe32fef85bd13f176e430a3d5b801c4f84893e3b0ec44c942509d8f

SHA512
00ac017e853c55dba8c3cc209427cd9a7bf60b350b34ca21405b2018a92c4f66ff375603c6e099d7b773725117042b5302a4694023f6cc509e92e62467a8346f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
81c709e7e1aa3fe4345bccc129730912

SHA1
3a42c4d80622285e9b6852b1abfe0214ce37def1

SHA256
ce6e92cc5daae410bc76810776c810eead8ec4d2ba91111335bdb760394cc832

SHA512
b35780095fd43845e4922a9e8314bcab6a59662dced66da4be4b038a973fc9484d543f16b43e5dc8a875b17a32c3263da42b37638c667ca7120d5355aa8c7300

Download Submit