hxxps://line[.]fourcoordinate[.]info/index[.]php/campaigns/zs527y823wf81/track-url/nb542xr2nw26c/c4c14980de38c85168c6f5eaa8470e0ec83be3dc

Analysis

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://line.fourcoordinate.info/index.php/campaigns/zs527y823wf81/track-url/nb542xr2nw26c/c4c14980de38c85168c6f5eaa8470e0ec83be3dc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4840	msedge.exe
4840	msedge.exe
1800	identity_helper.exe
1800	identity_helper.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5016	4840	msedge.exe	56
PID 4840 wrote to memory of 5016	4840	msedge.exe	56
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4132	4840	msedge.exe	87
PID 4840 wrote to memory of 4624	4840	msedge.exe	88
PID 4840 wrote to memory of 4624	4840	msedge.exe	88
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89
PID 4840 wrote to memory of 1908	4840	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://line.fourcoordinate.info/index.php/campaigns/zs527y823wf81/track-url/nb542xr2nw26c/c4c14980de38c85168c6f5eaa8470e0ec83be3dc
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9449a46f8,0x7ff9449a4708,0x7ff9449a4718
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11539977813390847067,12807322332647431058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\909b3e22-5d2b-4b9f-8a1f-9a381803f6dd.tmp

Filesize
10KB

MD5
84aa0c3fa20c661d32011c042e367de3

SHA1
9602845f3df1dae4cfb21a00a08d5504a2e14b95

SHA256
95bd2856eb728a54b7a67dc5397a0f129dec291bd365bc696ea101626a6256b2

SHA512
8d7b6513afa7c3104903be1780183a474aca61c9f83d15b361791cd86c451c7de84460b06a439fe44b5d6ef83f30e54248a42155ab6acb59447659acbb53a41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c89e9212e22e92acc3d335fe9a44fe6

SHA1
c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f

SHA256
18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44

SHA512
c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c9048a1-2146-4bd2-bf1a-959ae4ce66ea.tmp

Filesize
5KB

MD5
e3ec3ebca2b15e782d3b7db414c64a54

SHA1
77dfef0029d4081a1ae4cde4912aadd0bd7ed3e6

SHA256
c85dee609d9c8710e0d655874601740c2bd353e0eb088ed4ea5cb3c6e6fd427a

SHA512
4bfe22998ed812176c37f381058eaded543defc034e71d6780f6bc5105476e2dd7b00c37c1d0bafd0a0deac373b4fae7c3784792f32bf77270a5ee53ad11da95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
200KB

MD5
b3ba9decc3bb52ed5cca8158e05928a9

SHA1
19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

SHA256
8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

SHA512
86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7355b1b9f7002f69277601224e5aa99e

SHA1
b229776cddbf4a0975bc9274046f2297c311f94d

SHA256
aeb650d78a593ee5868c25ca0d70b05e896c658508f364bee8c3da031e12c920

SHA512
d867b66981a6b5c0611bda4242be9b5db0a0dec6fafd90322c20b2cdb3701621dbf0626bcc5f8d7cce5af021f73234aa6578ce819b761a059d2c8716985f20dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1004B

MD5
5ad665514186e17afef7740c6d4878a9

SHA1
81108c86a3eeb407dd4a40939a9e0d34af1f592b

SHA256
a6e9cc194e6c65d0057ae70089834d0e8d018370626b66463e1325d5748b7fef

SHA512
d2a61c558064e66cb51ee99dc9ac2850136c96a7eba2e3f6c14c4b892cb943f0b41eac6b3d66f71f0dff39b48fa48bd8cbf7802bd4b3afca6442d3cc4f3462fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c58425e0607d92b2fdba413c847e4b37

SHA1
42820769d066e685198a7d4ef2b1aa4e5fca59e5

SHA256
7a7d366a6fd22b9ed4044697df4268b0c5b4550002ddc73903afe7b8b96e10ba

SHA512
69c989689eee273eb6bffa422964579a7e33795d0d0f291fe802cc877dd3c5ab7806d24ee940ae992021e4a3bf3e3514fb91ad46366f625f693afce277424086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9671fe04dc25cb0ca891b685ae7f21c

SHA1
4b5b03035d49c13bed34b3c71edc0d981741fa92

SHA256
a8def7c15a4466f19f19d47810e8e76a2c7ed970fd4e10d379a67b480eca5d66

SHA512
9213530d6404bbf07c0a41872fef6ad4efb57d6e6983b2c3a4190e99a2612188340c02b8b5757205e6d0e1638a58bd86229cab264b86558fb1932ccb86c3e755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d7b2b29ef1d9a33e61e1167984c8ca3e

SHA1
9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34

SHA256
7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2

SHA512
3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit