hxxps://archive[.]org/details/youareanidiot_202011

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://archive.org/details/youareanidiot_202011

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4296	msedge.exe
4296	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3172	4296	msedge.exe	90
PID 4296 wrote to memory of 3172	4296	msedge.exe	90
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 4316	4296	msedge.exe	91
PID 4296 wrote to memory of 3968	4296	msedge.exe	92
PID 4296 wrote to memory of 3968	4296	msedge.exe	92
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93
PID 4296 wrote to memory of 2132	4296	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/youareanidiot_202011
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabf9146f8,0x7ffabf914708,0x7ffabf914718
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7155107380699323813,1388764124178090202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc 0x458
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
300b941c41acf5ab8ce06c90c7ed3d2a

SHA1
c6b9455c54c9caeba59dc93d28db9e81d77c3de7

SHA256
8ff8653472e2f6038812b80b40df8d309213fcb99a10702790e46b4af4c5b8d2

SHA512
317555520ae5f5428d2d77808d527779cc04b6d3128006eed1112e1511b139f112912fcddb7c2a4be59e9244d669670da9da94da7b7bead19fce708d0f67e9c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
807B

MD5
025eef371203fb4b9abbd1f1df60064c

SHA1
926574a911b7e4cb27477843fcfd9764df1d0106

SHA256
4417f20368161ee62048df37e993172c3bdf015dbe8a2c1ee99d8bb3fe03bfda

SHA512
5586e7e772ccd70afd7655acabfd0c51cf0f9ddc813faf35aea0bb21368dd16e307a983ba4e2fef12b6d0369377682cce58c51baf72c7adb4c2f82b03bfee107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1ca118a895a0d01e4ef4ed8bbe588a2

SHA1
c49415a623dc1bd65d4bab0593ccc6676eaa108b

SHA256
aaf672e8dee1831fa807a4dfb22c1443219d5d57641d176a376bfbf753a3c40f

SHA512
952bb706cb5daddee81cc12c4809483100a321ae5465345ed2783c2e55a91bed3cc0bd332a78b54f17081b0e02195dade1bc9a4badb64af1bc3c44dd92028792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f12946309bc0cf3a55e61f63767a9c13

SHA1
a875056938d1900017272eaa39efdee4083e70b3

SHA256
2b641dd9e3cf22c419e19e9a761d93e924ba3c4fca6a8a849bbdec0b4ebe0139

SHA512
53d27ef85012f932ca599a942b48a28c53a618f3b84c0e35435bf46c5ca02d61fe27940698cb07dd18098a99b44c88fff41ee32301dee1dc9fd3e6f919d08dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1673e2e45d1511babfe6dc1fae963306

SHA1
e864df90ab782c62badc6d8cc26d7b165e77d93a

SHA256
b2e159ad50d1c0bd76664e8a91a5ef7e91b46eec0c5b11a2f7a3af58133fe316

SHA512
3e60bd1c9b8962d07eca34f4a3a03386fd8cd8576f40acb0ae6a028617a691bf110d64d44168d5757c86429bf24eea638b6b672a79343c466dad90c447b8dc00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8b45321c85610c97e32ce5f87bbfa2d

SHA1
1a288765b6bde9269908b7251fef2d2a99ff595e

SHA256
eaa79cf5635f12a4ebb6a5f01406ba3c5696e47cf0cf67053d9d09bec4414216

SHA512
25ae6a34e4d61dbbfe14aecb53467f37f50ec61605234892ea04a497531b24b5fe195583a220b34ea048ecc8f7ea53505bfae8a5314ea23becc600f5045ad121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ce46cc48bfa345ea98e7a58c93a8359

SHA1
c4e0ed69a172f407448efc3024adb15fc34f60d5

SHA256
0170e6158b3732035dd95c2207dde854999cd79e6adf233c8aeb339dd54b522f

SHA512
c6190d71a3d74d998aab1eb99ff664c3d9ed16fc9d6357d19d848c22d88ba9df83b6ebeda0c8fb38424f808574df437ffc37ecb7cde8bdb1ff2f39d5bc4cdb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04357b2b02ab8179418a0fc3f6a8bd20

SHA1
69bd82a8b797c1303a54b158dbb5b2776b814d59

SHA256
9d6b0ba93a715d8988822555ca03791bb9d8301c11df27eeea8a807a0224b326

SHA512
ae50d72bf666c5a0190060e4262bf4ef581895b139929c1d0e1f54e172988a8b370dd2831711e9692d6b0f80d1eb6449417aabb66c9e9bc6817f32636dfaab33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c7a5.TMP

Filesize
540B

MD5
717898f0f753cf690934c46ce472e80d

SHA1
f678bc833498af5f42e4c166a4562c1875d143ed

SHA256
dd07f56493520dc9f76c8ba56bba1932fc4fdc1bdac04793656725f8b409e1de

SHA512
e479749fe685b3228529deae271a40cf98bea459800175b4cac652e9acdd3a610a99785d157d42710ce9614264b8711ebe05ef74d5d0c107d2733c0589c3e04b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40e48f4d2edca31cc4ccd1a909aecfcd

SHA1
556b39c226a47d32e9391a5b9261d4cda104de3e

SHA256
8bbccce07781ee5d8a1783c51fb161152a5f6965aff6bc390bdf55c47b75724f

SHA512
91e96973954141308b5bd63d28fda80c83ef75f1eba4d58e6dcfa4e74b45ee22c5779962a050da37a872aa03b5921a8c33a997f7b740d1949ff44b069e988267

Download Submit