hxxps://gghacks[.]com/apeirophobia/

Analysis

max time kernel
72s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gghacks.com/apeirophobia/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3500	msedge.exe
3500	msedge.exe
1656	identity_helper.exe
1656	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4820	3500	msedge.exe	83
PID 3500 wrote to memory of 4820	3500	msedge.exe	83
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 1056	3500	msedge.exe	84
PID 3500 wrote to memory of 3032	3500	msedge.exe	85
PID 3500 wrote to memory of 3032	3500	msedge.exe	85
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86
PID 3500 wrote to memory of 4272	3500	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gghacks.com/apeirophobia/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa50b46f8,0x7fffa50b4708,0x7fffa50b4718
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7917693212933910887,16041137448917547239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
68206acb9d97e270d56e0d10c45d0db2

SHA1
dfb84b26982251904a10757f90ad3cca666a76aa

SHA256
4cb1d8e981cd56577c4379aa02ae151f30f823dc26a5c29865f4756aa2b0fae3

SHA512
732a64d02823ff9a235daf619f7f0283b393b292cf46f3eeb2bdefea7a613e3dc6c65bfd53dfdffb41ea23b54a5a6500c3edd23a7bf576c4bd07adfe42f65ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
12c352391314042ae8eab4f7a0701c76

SHA1
c67c77b52f7087280ae2630b25cc10c847708a4b

SHA256
0350ac7a5d9907ff95db852e80d03c4258e67dd36f4337b0164ae3cb72d94c4b

SHA512
d095d5f81cd69f80eba5537ad301ef9321cc5cc381f5110646f3c25c7dd5c3d36c5a32f620dad98947d9a3ed5e77f81e08655678f0cfd7c5d2eb8b4ebdf96957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ce142c2a82241ac90c1311bebd2fcda2

SHA1
2472477c9692f75bc9d96daad6f5ecaefbcd9cc4

SHA256
11aa148804608386ac39e457ccce883353034be88b9a225e0719a383ec71ab21

SHA512
5b5e278dbacd300861ea50a9550bbfdce799c2c964f57572e7bc05d5e56faf1cd1b96e2a200c65e6c3e9b203fe604bb1afbee790add8e187ec908b848eb69361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9dfdd6ea2205fc0483ce77e22f6eafdc

SHA1
207e76d6c72568e040013334717cb19871534327

SHA256
8bc210811b56f2444c0d2221c177c9aa8497f2f86e86e88a33aaf27ab49a4ec6

SHA512
308de72fa2dbec521d27ffae0f29f2891e733ab5d98faf60dfe554072a8fbc12014a8a5696c5d4ef8f7f4898492ae0dc9485e5273d8bc507f0ef2870f1c6bfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1afea7deed21ecb138e1f704e0ce565d

SHA1
454e4c222b530c678c56ddd9c9e2aafa0609d959

SHA256
fb8d98642d6023951cc830b8e7fb21614c7452871d9fc5621da2195030c3276f

SHA512
0ec730756b372a2ec471f7ea0c1f7310f15ae00e368c44db2dce444e89e25fd71816b46aee9b8d8a83cb12b5ac0e3e2d450d523b635d17f5e8f88759cb494da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e71c52fb5124fd85765696726c17a48a

SHA1
496e0bd25e5a01e64ad9cc6780c247227b077bf8

SHA256
625b51414667a7e0ca8a0616bf409a0d0e5629838ec1136ec6a6579e0e4a92a7

SHA512
9876ecebad5834ab2beb75de6578cca80f2d85bbce119cd8f13a2c58e8c2c7a4f79cc574500000cb9c6387e994a61c07d7c7ebb0b41316e0d2486d546d1fbff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0595e86d08a220c7bbf31960c8b45e54

SHA1
151a6531b159de4d0d4340c7969a949c14ad63a8

SHA256
f25ae31443b18df762b69c8c1b4cb86c9fc6774ad5e39c22e82c103d09ea6bb9

SHA512
87d72279c9ffad083578db25cb674bca99da5b56953318fa59b16fe0995061670ccc377bf8bdf60382e8dca3e8e05cc3d81f6891661cb64337e337420a4a3dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fbe8ffe041d9c80703a85a146680c808

SHA1
0e65411faefd65862bfca354af01463e7d3fbaf3

SHA256
4cf487c0a930f98691716710b436e77b1022f90b0cbe2bd7d6c4491ed8d7ea76

SHA512
ba356b9b98ddefe0e15e34bacba2b4f1f622b7e45a0105fdf767394dbbfbc5f52c80d4d5c2760fb346272bc217201fd0f19ef1cdd46ac65800839c5d3730468d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e92b85b28dcdd20c888778d41eec942b

SHA1
a600c2ecf61b3e315fa38f4a912b43983d9e5b09

SHA256
374b6cc8785cbffe7a1112fae436928308ff7c7d68a1fbb77f306bff7e09d279

SHA512
08f54f3688169391290ce8fe694fbdf15d9bc7c66978474e2a11c91b313ff08f34eac012e24458541bd81714daa49f0f8e8072c00edda709bc15a8da254329a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e8e9.TMP

Filesize
539B

MD5
793df7eaaac6a6a2939516ab2ae4b616

SHA1
5eda694abaa742dae707917ec9d03520f4ec5244

SHA256
f25db7b53e13c179accb03a53dc4a4684975f46ffd7f9935f8b65937d8034dcd

SHA512
948782e4c34e5743f7850d7f46644899a8240072da6600c19e84949f9ecf47cf359de454fdc6ae6066a0f0ff7b1ac7ae85195ccc69acbbdc5a656f5d7d6babd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f044dcf6d4131fcf3249af5bf8f846fe

SHA1
0cea5e7cc99b4067b3636f6d5a565546221d1171

SHA256
d9e992f0cdfc0a6dea33549ab4adc892280d0afead4fe67a5c9a09fe5162b5bd

SHA512
481577c42e23b72a4b313f86fe31f6f5605c9a65a92f8043ba756f7aa5eb8af104ff27ac43a1a7964e399984142577ba7a664365ba1193f0a5edbcf698777b57

Download Submit