hxxps://notcoinlive[.]com/?ref=9bm55

Analysis

max time kernel
360s
max time network
364s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://notcoinlive.com/?ref=9bm55

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
2364	msedge.exe
2364	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3576	2364	msedge.exe	81
PID 2364 wrote to memory of 3576	2364	msedge.exe	81
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 1184	2364	msedge.exe	82
PID 2364 wrote to memory of 3536	2364	msedge.exe	83
PID 2364 wrote to memory of 3536	2364	msedge.exe	83
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84
PID 2364 wrote to memory of 1912	2364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://notcoinlive.com/?ref=9bm55
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10793326896070618962,571873807782075206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
74b94b4f646eb7a6a05ee2bd91e49192

SHA1
b8f412dc43599d89c3668ca42416e99f10a91945

SHA256
8fd739e3bccd3b58190668abedcf6086f3a84df0f1e017523d3eec3f2d2d45f9

SHA512
01e466940abbe41740a857ce01245508b6ae261f85f30e7fd5021929c9229e970e441cb2f0066e251dae91abe701dd6708af98dd54d58dc776bd203b8ed82c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
53569a1c5505f95f252690624a0d720e

SHA1
bf51820223869b0402f1ee589951ee2e9ebfe833

SHA256
b8c7df7943a31c17c44716dda108e26757a3cbcd4912dc7b5cc26484e746feaf

SHA512
e6a8fffdb23331e89250e3d22715820875c2565f02ea47ec0cb3c1c13c9535dec3e55dbd55d547d1656633e66d65925c933d0d98f1045259dfc1e4e2646748fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c8bfc3a2dd624298bc68e6edf6755e16

SHA1
2f70ae85ed1fa486b28ea5bf4fa65ebefea6a24e

SHA256
fd0461c6b56e7eee65defe52c9598aa9e14ee103e64d910dab55f22d3ebf85f7

SHA512
e71e009787d168a9e13155aec0ab33d0e6a4409105d8c12a5083e64216bddef83ec544b9855c401b2ccb6e6bee7447218723ecbd0e2d4d30afc50617e6d9c9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
503a8816340a5d3198543043b1be6c04

SHA1
383f45eddac6c502fc1d0443648eeff0d0089859

SHA256
2c96766cc117f71c1f02ea1a0f5d096f71120bc71d6363c07495cb2c686cff4c

SHA512
8c8f2a6d86d401e5d302f69d1b39cce0698287aea57240da0cebad50363d49be0d1ea25a6fd8e6717034cb35e14a4dd2aeaa06222bded47f263484a0f1b95dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b54f417d2dbc99a4d354170780fb47ac

SHA1
97913a467a54a18bb61d1de703600415b2da19cf

SHA256
e44d91125e2dee58f25b8577f32d77b4ac45c72af12b36805c7e738b2d9dbeba

SHA512
5cf49d70ca54c8d5314f5fab55f2dcc749cd107f3a4ea7df6545b040ca7499634ea7f0dba88bd2fe3bf57ea45e2c7d469be5072f51ad31b48be5a40eefa4b9dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
23e271fb0a9c223bf924a7122282143e

SHA1
5f0220dd9dbc8b9f9a2dc26ffb4c61c529088414

SHA256
6933f4a83c6beb5a379cf327558f98b93cf52c89c2146d53d2f2b7f00e339a09

SHA512
b34a2df1753587a423e461c61c521058af2372ea82b24e264aab3692535c7c990a74e4e4d2d162e3565c5a3054dda49be882709d68d4c0fc2bb2a42223e53bde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
489b2db4d65ed84e04dc325a2ef601dc

SHA1
8471e8eb98a2be235e0939d8a30c5481be0b8142

SHA256
908b50d565eebc58a61b8347ffa7a84144571fd68689ce3d668740565904bcff

SHA512
94bb1c29548788b0f2bac014865d0a110401f36b68fcd92b5b73b27bb392128f93f5fd0ac76bd78d9f421b4ec6495c1c0448d0296f3db421dfa3c8a4a5e2d437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0f20222cc3df4c995affc1feff4bfe7

SHA1
54cf19fda4f00a73d6b520f460ca3a54a32d00b5

SHA256
08310537fda8a9218650970b703bce9b57c6e21a1ea98fe5dcb730315a1baf48

SHA512
fe5f3f9440b7d5f1c2df5caecb4235dd69595bacd14162541969d8b7d8c826b86f8d743a57af52ebf010ebf8f154840c1055ac52bb7f6fc6117c692340234846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3a9b65f12e0247954018ee503e6366a

SHA1
c1ab7732ea682bad86d056d33fb6948562f3ee12

SHA256
7683203b9c93053765b37ba312534e69a48099412e75dc74d41e987f143241dc

SHA512
e1de823479e1708511cb152deec22b5636081dbe9e124faff87dbdf3faa4f6226d07d188bb584d94722da2e905c1b9e7ce7f38c4c82e221440716530793fb333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2acb25808841c12b7521e376e6048a81

SHA1
6047e9d8cc347351d085be5f0ce0caed609c814d

SHA256
14aa53fe239564ef1c22444b159e7578310f0ae6e4bd99b4867f86487c001f3c

SHA512
b105d0c44896b889b6e6995347b642521b414f77ea4ca35985b99fb150ea70ca760b0115c6c00fbfa9cb88b0f3ed364be6f89720fcdbae7adf60bac8293f4084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c24c6.TMP

Filesize
203B

MD5
54903fd28def1b93be56d199046dba37

SHA1
0d6a189317c9f5c007aa900847029cfc0b0b9d72

SHA256
def4066fda5b801d6ac9d0cdd5af6d7e53aaaa0cee516d8a9bd54640c7830aca

SHA512
d0177b68a587fa587caaa10f988ceebfed9b1e063382525da5f74bb040323d235d38dc05168e018e1724ece38c2896a0130196cb9b0987b4a3b14b3b8d0da380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d7b432d73dbfe9129989dbd30b249c8a

SHA1
6270456b7e40ef52a841f23bf7a6c966143d50bd

SHA256
9aab5c75325cbc802db972862322ea7f71688844e6ed9d859c0ea16d87a906ce

SHA512
d1b2165dd50a9c383abfc7c4680de38cd29e5d81a849add8cdbe4e43b8145c5509409a07017145b3bb9f0dd909f8fefd3648bd4c3b3b3d70e521add1072e53d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit