hxxps://github[.]com/appdownloads/software/blob/main/auction-sniper-mac[.]zip

Analysis

max time kernel
447s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/appdownloads/software/blob/main/auction-sniper-mac.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
2052	msedge.exe
2052	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
1700	msedge.exe
1700	msedge.exe
1788	msedge.exe
1788	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1916	2052	msedge.exe	84
PID 2052 wrote to memory of 1916	2052	msedge.exe	84
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 2912	2052	msedge.exe	85
PID 2052 wrote to memory of 4968	2052	msedge.exe	86
PID 2052 wrote to memory of 4968	2052	msedge.exe	86
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87
PID 2052 wrote to memory of 1472	2052	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/appdownloads/software/blob/main/auction-sniper-mac.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90c9646f8,0x7ff90c964708,0x7ff90c964718
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,9617745533199674403,13617097428120744753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97b7b5b5-323d-40ff-b98c-d5568290d895.tmp

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0692023725c3a0b8fb5b89f9655c1101

SHA1
e84a25d0cad1f5fd9cb0ad56e24bf396f124acca

SHA256
c2e48ee08af00865d5e52ea0f51898572afd9903e38bd1ebedc9bc58993bce0f

SHA512
6b6aeae8502a1f8325375d37675fc9fe3e24c1509f4f812eef1a9133b560d552d7b612dfcde8b5a13164ad6068cd8fbf7d08b402f90818154d1c445860c262e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
5022b10efc3c6d669ded7960cc594a19

SHA1
a79ad985b345f09f5f4f265ba1867800ab4d3be1

SHA256
a6c395932ed70d3a45247d91c6593b48d6d389a52aa806ad484aef62b63c8e53

SHA512
a496101a7c30b7205f91698eec23c53b52d80a24a2208f3184733b905fd34066163df9688e00856278fc536fd955bcb0d2c62f3561f28718e378a08754c53c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1b5090b3b58be5e1d5307afcf6f54ec

SHA1
67d9863f72f788ce8ee1a68c8569ccacba547494

SHA256
eafe0d0b5d026b23cad6bad10450f38d1cdfaf435c1df6f33b781bf14a96169b

SHA512
95b53326605e3bfc81c6ab2084cdc1511e60b60c11cf6a629a9333a8e763d6ca316097096d2e3477f56991b480d997d365004bdd4dd5941a04388f660d5c6fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f2c834e23addc4d619bb098982d189b

SHA1
04cea6874ca722c70c913ac151f242f7b285757e

SHA256
d4d9b951a3d4c028f1079b74de8d289aa0be8f0bd5dadf168e973d9ec25d6641

SHA512
c852a33fbcf75d5d508376b0207a25f4372e2e3faf1fbcd2d399bbdbfb01ff3bd823d6c3d7586e2661647bdd34800e06f4184b30b77b474c5173f1324684e979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5c89f8306a8c7ee742aad0c327abdb1

SHA1
8382a807e724ec9b90bc3748b60125be6c149e64

SHA256
06777815017bcae2ac85a8be29c87f1cc949bb22b93c94c59f0e3b2a57f892bf

SHA512
bd82c0ef568a0092d375323e9e22fc56c62efc41242379a481f16b345d9d4b0470c9e84a81d6b0737d2c7b4bc81baa9924ed44f2eaf6370908af12dff28af193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0074a160dab297207c3b698c51dd954

SHA1
29e017df57e07862ee78ee619015c77d234b2b1a

SHA256
1a54c9365a04bba279df976f1a5165bebfb8acd8a1461533a1f3660ad221988d

SHA512
d59dd0287e682436cfb0321743cc41f43ad10c2d6972bdc45f37d7963e06e384371834385555e8247407742f97c06cfdd93f709027e95888d0de36eb27281d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fc24d1ee30d9307ea9f03a7157d8b51

SHA1
f5f5a8233ae8d4210011248bbe19ae1566de58cd

SHA256
65c18de77b98024f63648e048c59bbcd0167b68fafe14cebc596e9897a1014df

SHA512
637808acaef951880de3f70e91e8dbdcf0b34ba1c456aa433c576d10870e769c97615517d8fdf623647993524218499763deecde039b5e90c086f6d97359c24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
220bd5b5640118ce232a574e41ab3282

SHA1
9b3aa42d9b7e02ebf1dd309e6f8d8ef83d7e6308

SHA256
911eab2862408890dbf0edbb522a30ddb1de18aa963cb73c1dd9e8a38536cd2c

SHA512
430a408dd6700fad37609f7a792224a20e8a241fb4399aa5f5691f96eddb6188ef28fe7debf09ba0180289d413f09c3bb6a54ef7e19406f00f25337908c2aea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58343a.TMP

Filesize
874B

MD5
15e2a1ed0ddeeb22f795807c3d3dbb72

SHA1
1f5f08305eb6400bd00684c881215b36bbfbcc52

SHA256
837bc25dca84594caaaaaf12b8482f69141a99b264e36c88d5e96dc8bed5d49e

SHA512
ea7f342caf6d63f202878d33e124a3a31b3db5e3b8405809c6660fd01bdbe317265d321469ccfc38e357947586cfb6401dd0707973639ab750792c647676d2e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41c7333d0520885f2d26b8a0d188e811

SHA1
084e1e2131556e3aa1c30837e50b0943abd2206e

SHA256
9b5310be5c9ddedbebd6be7e5e6727cd12b057dc36dff1e48f1c7957affd2bfc

SHA512
3c23f7bab69d263490d341f89e35415f2d8f0a688d9a6e0d4ee1b28cf3cb7fd4dae3f6b7edea4f1f8ac90cce3fb6aa34b2c2c528f839f82018eca6c36f7994c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c11d55b314416632303c2ced2075b89

SHA1
0d643ed5361621a2f05fa3f735f9e429950d9125

SHA256
307642ca0e2d36cff04badf46e9c154bcfc557d38e21ab3d111bfeb6e057d8b3

SHA512
dcaae764504a5a951cd1885e9493cab088e7d7a5330e201992584a54c06360f016c69e67db756c3598fd673b2f7e1699ae856de0b99b980455cde2c881c4edf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2356495904f2685d409236337596b123

SHA1
61522a1b40d4e2cc2eaeb10575d0b8a633c5739c

SHA256
7424c03b91894ebd16c406e3bd56a9504ace67ad38ff9d6328943e9959d66c08

SHA512
7fb3a346a3ad9cf0740b48c47ba9f030202b686d1b0077f71e5bf98f190ae67c6a5bb0aa6f6f3e2eb109476edb01aeb5ad22736649b0a8df3c33a2742851f8a9

Download Submit
C:\Users\Admin\Downloads\4a01c7b7-da63-4a00-8693-42c1bfb03930.tmp

Filesize
4.8MB

MD5
b6f3c3d18505a4630f1fa1431656c4df

SHA1
d6d3be1f415279a77cd4ae316eb2c6b9aaa2b049

SHA256
103b6b088199f411a8540e0c5af4278f21bd8f540a4a64d1c0aae4c6f636fbca

SHA512
d24f677940965f93dfe99e5f6378ba6e88d5adc2219059ee43d907f8795d1e727793eaaec58c273b8121198d1620faf20bfce7c532757a78892516ee8d4de67b

Download Submit