hxxp://medal[.]com

Analysis

max time kernel
1860s
max time network
1849s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/09/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://medal.com

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-242286936-336880687-2152680090-1000\{59FC35DF-C40D-4217-AC07-20C132EB8D4F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
3372	msedge.exe
3372	msedge.exe
2280	msedge.exe
2280	msedge.exe
3904	msedge.exe
3904	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4712	3372	msedge.exe	79
PID 3372 wrote to memory of 4712	3372	msedge.exe	79
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 3712	3372	msedge.exe	80
PID 3372 wrote to memory of 4864	3372	msedge.exe	81
PID 3372 wrote to memory of 4864	3372	msedge.exe	81
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82
PID 3372 wrote to memory of 2620	3372	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://medal.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff0db83cb8,0x7fff0db83cc8,0x7fff0db83cd8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3824 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4871458711044475633,433704054107329646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
ed25d88a4dca6bc4176cfd91a496dd08

SHA1
ebe45e4131784903bd21c2d2f8c3fa2897da578e

SHA256
360e178053fe19f5891f3fde02a0878683ea9e9d5ed590287109e89711103668

SHA512
077938a80b19f948692946592b222ce5e9fc7f35058de1a411da1667893dccc9930b9afecb7ee833b39bf8e3c02e1c7a504319d4af57fced28377b30f9883f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
86c89c2aa3b7d41172e8c95e563bca67

SHA1
49c26ea50a16bd89ed68ccba3eb3a2ea0828de0a

SHA256
c47c4ea8a2a71db009d6fd8056d890ac8abdeb2935bd7d342ad3c74ce1479ff6

SHA512
ab9818bbfe94b4f581824650b7885449c6c2da251a0b8448d6b945b92aa395ab399744ed5b2e93f224865bbad1cd9ea4e852c106d05fc5db3ceca4d51cc34786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
ca62a56ae3f5c00c17b37620aafd10f2

SHA1
8332840560385cecdd109fec71ec5f8ac53f8775

SHA256
f26fc17a9e4419c7566281a078d4d0fb8f7429792b2a313719e908243cf4d5bb

SHA512
3e3d21a925f636a029668028218a9e2d258dbd00f7d3d3d3e3d6e9d65d2b01feff94d1e1d704cc00ed16958cd702510e7bc0ab97df07f5117c55d2b218fc127c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1ed4ee2c0f582b7cabd342fe4c1cea2

SHA1
59951c519ed53b484bccbdc6ab839025e1dc9bbd

SHA256
782df6681e0ef233cf612af3397f52e9320bd5d09d907d4f495e5befd3347d46

SHA512
cca48748bb09b0dcb7c453ce391e3fd274a43dc7f65ec360620b324114334f1dbec21049d2272c73a423b4f806aef2e1881c0fd884548de6bb65a59b6bade5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
364cb5f9c4ecad1bf138e84fce21a614

SHA1
60a0f8ffc192e54491232bf2d01c882dcf102add

SHA256
e6fb6cac538b25a3e89eff89735f08ffcfd4b6633dc5db2bad397a04fd846338

SHA512
149d134f9d121fcdc67094164b0279703cf3e83b9d40eaf56552fb114588f9343861cd02219b5e68530cf91a26471975b9eb5fa5a9c4df0c2dd8d5bb4037b1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c2d53e599b8f5d983a698b26db05133

SHA1
e81c6ceafee5e24303ab8c07b2ca66be198abe5a

SHA256
a7f8e01d8ebb5c34d88d1df089deb65930b6f5e9b272a5bda68f589c87a817e0

SHA512
122d0b0e4bb7ac2ebdd65f991b4ee92687f436c719810490b2259c730b2f94ac8f01d8b117fba84e906b06d6c4cbf8afe9a6468e6fbb2efa443287a69ce926bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1c3d1ba86d6af6ed65542c84c8a70c80

SHA1
40798423894249aa7d0906361cf8cebfee245331

SHA256
14c8c55838e72c63ecb8cab7b49ca19ff1051ee98b725657f83d9bb3e995e4fe

SHA512
1920d0abd012d9b7d6e676b0ece9cd5db5cb8a071c9dcb7486fd8e41bb332ff22459f6702aaf6294686242842e14143628a541d179265463861af7f6960a94af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f90c0fe50301aa2a7344870c87e93a3e

SHA1
793413dcad2ccb820506ac522697f05c4371ab81

SHA256
692e8de6c8ef628d7352e80145d4248efbfc42bcd54e31f683718001a60426c4

SHA512
000cc740e94953af0f1aa8d72eb0a1520c8741efddd859932cce0701b588fd95f7881c49197f0661cc78dfff2f0613d83942c89796f256515b03dc2a5dfa4a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f56585d6ce690f617db03eeb581b4a63

SHA1
477e71a006cc70eeb1f169b7f71cb5e17e1b0408

SHA256
f649f068a3907b9f53407a5693848c213eba9728eb9954748c79e6cdb9e76eec

SHA512
12d7e1a69a8add95f4588e2acb207df8b1b6519c5a6e71cba44d71c041965705caf0ee5e07f15a1c9b96c181438c4a3c2d49ad9f1de3adfc3ca72c69c10537d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e08743739246bb07380ec8ca8ce7504

SHA1
5602482d519f2844d1735b9d6539619fec44fb35

SHA256
c020271a4c9fd31dc45246e1ae871c1673f8655f4817068dd0c3354e13945b2a

SHA512
97ec5dd5d1b00f69178bb4d90d7ddcdbaaaaf57d8ac098bdc2728f10613301eeeebc3a0f69ac11159053ea29bf0b84fc1115d1cf52dff1dedfd4e14c21d1254c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5275ad7b5f063074c181dab488b79b6f

SHA1
b0e24884ef87cf6c4a85ea3a5bdc60c2bb65dbcb

SHA256
97553218a5783fe861ec9343e58e7d04c7629ddb404cda8351644b15c76dd910

SHA512
435434bdaf8362666c02bd4a1f027dcdc2dda03012ffe606a01e792878641a7349dfd17cb9b9543e4c0993a28fcb88c0c3f79a92d71acc5f91fa40ef4773df11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aef8ff1f4d3518dc4cd4bf6817d7011e

SHA1
8584b8f04e2f2c32d724b63318763a90930ee6a3

SHA256
b9398b2a147ec9862b22bfdb1da1ee27916d44e570a243b9ad125cd30f757b7e

SHA512
b8e25e5d346dd4accc7fc086433c26aa306f3744f1cdd7351a5663bc3637945e6106a5bd00ddb3eb29c876c006d89e9f174a490066084e48735d35780d1d56d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2478dceae97352a3a1cfd7f25994a606

SHA1
e6231114d7573b835dabc8d0a12267f7b56f3e22

SHA256
a232dacf782e982496e3a5854c21538828c01affaa9bec34a4800219dcff6063

SHA512
411affb9d2bd9b0bd3ac1bdcb8c21f0eca7b4ee8c2a13fc3d92a06680704a68719461cd80ae94dfcfe1e9d0f0db466c2b19c18bb2690fd9484405960952ca52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
81143551a6a5ed3fe20241e77a770ab4

SHA1
54baa18d22556c16fe021a81fa70454f7ea8a8bc

SHA256
e25813bfc5b1d8e2a4653b0e489f277ee7c4adf7e5fc951bd7a39b86515ed547

SHA512
18037888cfcb65149e21872605224b4edc0d9d5a2d5b7efad29a369d8732084dad2c563ce67b9febeed09fb8d2a8eb129e39e116e74bcfd5a85452cf24066e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5828ff.TMP

Filesize
539B

MD5
eda14597833e3d8a2d47273cd69cce01

SHA1
661f7d4087edad4ec96cedb0b6051d55e273192a

SHA256
47f237ad0da49929c40a00cdf87dbc80f1d29fded71895fd9d2e94dcb8fa5c4e

SHA512
af273d32b05a513853bc2584fc7b232c7b1a78e6b330bf8b5f8e5ca6e3bbc9ad952c6b65cb3fe229c0d525da0bc2af1995ea24aa04d3979a9ba36a4124adc88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b63f94a6e4ecf953282200d7d765bfed

SHA1
400dac7d566b1e43d39fa64d94711464037daf42

SHA256
14386d6e637af8ddadffe3ee4aa0e6f40e685da966c60b651f72a6e39cf3c57b

SHA512
88dae80698c7c0d50dadce78e92432c7b6b1e0da4e9ffc6490d8316566134c7dd193886bc78ecee3b7a2844ee1e7217fd280796420c7b06bb23c93e38c41e9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e1a8806fd38b5aa8a278856e8430ecc

SHA1
b89d7ab48017649964347551f4a1cb812f16e5ab

SHA256
95dc7d5c3161d7e5af512d1e7057629a5c75ec5706602d6fb126893f823a1a53

SHA512
f1c0a51116c8316a5c617f4f2f8e6eacee093d3962684d6a177f9e6b9ee152f928afd5cab8d726d0050bf8e6b316bb34c126d36c07fabe7780ed7f9e371c486f

Download Submit