hxxps://www[.]blacksuitdevil[.]com/media

Analysis

max time kernel
162s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.blacksuitdevil.com/media

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
456	msedge.exe
456	msedge.exe
5260	identity_helper.exe
5260	identity_helper.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1976	456	msedge.exe	23
PID 456 wrote to memory of 1976	456	msedge.exe	23
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 4808	456	msedge.exe	86
PID 456 wrote to memory of 3676	456	msedge.exe	87
PID 456 wrote to memory of 3676	456	msedge.exe	87
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89
PID 456 wrote to memory of 616	456	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.blacksuitdevil.com/media
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffedab46f8,0x7fffedab4708,0x7fffedab4718
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8819414801629127998,18145346487337343124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
17KB

MD5
49f711f9f4972a7f7bc400648bbb1b58

SHA1
cbefef3e9605a141773233dde26090bc34618381

SHA256
052794c05f1404c51c9d7c56eda847f705498e37eb8010b51fcba1e6171fc460

SHA512
0d8ce76c62d2cd85afc6c56ed8e42c0dd928d26afbac418aac7db59817c9ee9d51dd22588eba4b7ed1440e3c9129753aea07f79a3022e0a533412fbdf8d378ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
96KB

MD5
2e76538596186a200259df6ab0d9bc9d

SHA1
903ebbe6ff118038a23755712dd2d45091374a5b

SHA256
e7112b99464b9832d5675df7c9876193be42ae1041f8b6d7690f1d7cf88ee717

SHA512
b458066d41455eb0553cf39b108f70b88317fd6a0abc63b28ec7426760142c9ca28d59925b7800846542317ac70caeaca98fd9c2b4b49fc29489aec88e1e17b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
47KB

MD5
dca7fe3680d6e99aa1e1fdf878649184

SHA1
6a8fc8a35aaf7866c8c5a20d9d276bdf0f91d836

SHA256
12f3caf9aee3dafa4e5a1adcd23b5abd00dbb0eeafb26484f3132fe7eea27245

SHA512
cdfef2e801519ed09a84944cb1cdd379936735a128ec4062d86f9dabcd04b17b5130afe67698ce209a9236d76c4045ff91928ca4caa40f66159b716ca1e62510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
32KB

MD5
a626a52b1c337ebdfcf808fdaf576997

SHA1
b2dbb855d572e61f4d00bf1c89365f33eafbb06b

SHA256
3abbf04350e220e13cb87c81644c3a46e1ef0a393fd55276466f42c1e2b8db0d

SHA512
a47d217b0f5d9385e311a7547a8974dc07dad3c7b29d097fdd0aefba559cc2e8f36620809dc124f9cc7d879a41aad5dc4c1e4403fde8d2e739014b26d6933d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
efd81f2fc0309d3acb0ae1e32d13e0ec

SHA1
fb8959e46ddc42be88882349f734c9cbeb57ef2a

SHA256
c1ac2ceb2e340c7e5c6183d327db823877cd5dc4a87aa63e6b2b8e1240ccb212

SHA512
34bb3cfe41bdbc8c63eb5ad397396af30f22e039a5b70766da13ce4ecc0d93cd9ea669b586c63edbb3174947ba72a92b2d22e1dd806d4e13b65cb9bfc2775c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3ff90c6a76f8c791315b5ea81f662e76

SHA1
3f35be84e872fc98682ef57118633cfb9c464f57

SHA256
82ecd9202dc200f70903c0d5d4ac582d7d35f3add6ae2c5a27f3acccc6482ec4

SHA512
90684bd15e669bea703ad2da1f154e434f426c388ca276c1d5ed58149519b0b3c4cfa3eacd15c4f2a1026d92e31afb349dc198f9f60fb54a0250d83498a8ab74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a01866863058a7ef727bcfd318265aad

SHA1
7c9cf7130e95c7025b47fde312cf056b1d111dea

SHA256
3ee5f9a278ffca8ca49323a605b34bd7ef57fa55c57bc0c5975c21159cba4758

SHA512
ea8cae2b212ec28631cd669712b22b709d22b7317806dddf3ba06ec88f2379b7a082cc2c98567c6af1a49bb89b8d9b59810ad40338f471dc3268df210f453d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6e350e71b21913ab0fc15b2b4e54685

SHA1
a128e59fe908f02041414c7e059b57584e9df184

SHA256
cc22c775ed01d85c49f9c02a13e36e5253be58be67496f4a45d28ad64b7d7783

SHA512
e17190617e1d97be50aeecab653208fb33c5f7cf25c0badaf8717e410ab087c3165f8da0fa4de86adab9f3e105e77f5a57c60a7050fce4eae351d21f96bb0aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a95271ed0acb9763bdeece077321ad79

SHA1
e9be0b9c35f798e6fb1bf081971b090ef3db47b1

SHA256
01c17b22c61d536a07fa33fb532173cef0db14fb076dc160549f386934f7772b

SHA512
96763176ef7f0e51efe147abbd2ad7387bfe9ade602b70443c61faca7195f2ec1b192b5bf441638588c5f263d11c351478854d515802bfa3efabba10fe4b55ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db7d814820155e6ae758f59234124e85

SHA1
9715e4d2abc95d2be2ff6fc701505f6448c75724

SHA256
f247063eb2154ccb34c52ba32e41eb0bd717aeaf425ceb70884401abfd0a6d63

SHA512
6f45ae007bb23c42ac0b62a972e1d98fbb2b28ab0afd92f4dfa3f184b40f3ec2ed392d2df45cbbda743c37346585deaa8c28673f0c4b10148fc2e8f1acdb39d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8de01ca357baf0dde138ae116173b2c

SHA1
a390630a8b7defd7a97e3b98946a69ae56d4fc8b

SHA256
a72d35848f16680e3e88a87f629a604691d51b28705789d5059bc594408fa965

SHA512
586d62526a5835a8cd6667499396ad7215d8fa80b0578fd3649ed57572b178b2053e53d56918e6004a3ddb09278c80db0fd5d777ce3cbf75a7973c8cbc50cd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b533cd438c5558737f980c64387ee36

SHA1
341647c009165409cb95cc0da8de14eba7a44ec6

SHA256
be966543508d1958958e6cd4cdb0b1bc53605bf308b725cb3d982e410fef1b68

SHA512
453e9a4d499aba043e5df7abcc4b2e0e7657ec3638975a4fdcaac68d1e340f4b57f559a8d1c99d72c56d581193880be47256522e4350de3c9ded2f02958dbd61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d31246b279684b1d98df706ff38e502

SHA1
558f84f041280ff95bea9dbcdc9149d42af320c4

SHA256
3fc474becb60029d5e204ea958c0d07da1e60ab698b72aabbb43a7290f45a479

SHA512
7f6eae2d86df545b27b7629847686d81956f8da291ee127132acb03ecf4094677f29c45c66e01295785cc20bd3109df76b8a3025426adae8158f68cd57f7d9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b63.TMP

Filesize
1KB

MD5
7e79c2f3418d9373aba45accab7244ab

SHA1
e450d3760502a68e5a4194271334c7509de81b21

SHA256
beba6aef019126d9e1b1c1cc80d195c0cd84ddab96fbf4a47e124d1af7913748

SHA512
ca08a3270188ffbf49c5c6a79c1eac6f03c518c54af011377713dc3cbda61626475a04a8e253eeffddc0eeaa5c4bd4b07d77d3d37f6fb2dafc8362945d79911f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6db087af859cd7c77abdbff7a11bbc08

SHA1
64b18acf2dbe880113b00d033ab18129cfccdeda

SHA256
e80ed977e86e12f88317bdae30113cbe63e6c47fb0612393456990a416214051

SHA512
5960f419b813cbb9d118d8098a2c44a90b18b734e316761649006d8aab2b5974a7b0c9182542680f23f47e928dfad80adeb7877aaae0d1cefe0f04222fe795f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b93336fd58a4c78e296f935ae2ac499d

SHA1
73438304aa09f6e1feba4d3925663ffaabf4a52f

SHA256
58833ca4b0e1162a3c988168b8d11ff5089300108a4162c3dc15d4c17e9efeaf

SHA512
e15a7c3b2ae7eb882ac3c6d740e9069ca0b7416b7532a871d63c3ea7241b88fef8345bd6f090e956c9d09f1e3b2ee17dd5f139b7ae6a2de176abd1251e6c4020

Download Submit