hxxps://cloud[.]letsignit[.]com/collect/bc/5fd69a840b5c6b0008d67ae4?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy72nipARgmK73eRH6-wXsLrBXpzfTXHJVaI_su71Cu6vZ29CKwqlEHgVz8h56utGoH4XZieq7lwOzphGvQ1qbRsxFBuNc5XzFUmWzgdOTLSX02zt7FJb3AZlYGc-1ywk85lrmgKPvVBsQa170Hgd9iaQ=

Analysis

max time kernel
194s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloud.letsignit.com/collect/bc/5fd69a840b5c6b0008d67ae4?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy72nipARgmK73eRH6-wXsLrBXpzfTXHJVaI_su71Cu6vZ29CKwqlEHgVz8h56utGoH4XZieq7lwOzphGvQ1qbRsxFBuNc5XzFUmWzgdOTLSX02zt7FJb3AZlYGc-1ywk85lrmgKPvVBsQa170Hgd9iaQ=

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2204	msedge.exe
2204	msedge.exe
3112	msedge.exe
3112	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3112 wrote to memory of 940	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 940	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 3472	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 2204	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 2204	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe
PID 3112 wrote to memory of 960	3112	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.letsignit.com/collect/bc/5fd69a840b5c6b0008d67ae4?p=OjfPT7lREiUDLQp6d36aSXQolbQ31LL303XXq73c0LgCPRp2orT9jnqhLprOLL90LfaIzvzkFLCd3-2924eBGaNnzzdb2z0VcZL3eza6pD7Lvwp-E0If3Kq_h3YGcTVhXX2GI1pL-hkiu7mMH-yy72nipARgmK73eRH6-wXsLrBXpzfTXHJVaI_su71Cu6vZ29CKwqlEHgVz8h56utGoH4XZieq7lwOzphGvQ1qbRsxFBuNc5XzFUmWzgdOTLSX02zt7FJb3AZlYGc-1ywk85lrmgKPvVBsQa170Hgd9iaQ=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40aa46f8,0x7ffe40aa4708,0x7ffe40aa4718
2⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
2⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
2⤵
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
2⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2137318213108501989,15129048278018826810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
5fbe81ece187460a15f0cf7bbf02ae2b

SHA1
f1f943b8d55768715a4c7b0cf6e5f1af93f0b117

SHA256
36b2ff92675f5fc7e4231e24960fc8aec1ff4e2c5ccab9ad2684a068eab449cb

SHA512
ae69fb12d7671a6589cb2e4e5c92be15444dff30099ee7ab6648b029c3dbd18c6387774261a16eb879bfebb5af695da2c3b0bc1b0ecc4c9bf82056958b7d02be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
1d65031224ff97e02ef7aec36079464f

SHA1
c97a26eb5ef90f4c73e8197e2ff07be9d26cb7df

SHA256
ce191bf708e2ec6fb08cb59d767083adb9d00b05abeb4b827045c5c9db80c3ab

SHA512
eb1b173d05bf8929af56a887a4f4c9eb773dcc2ebc307670cdfc3a8c152fb7a324aaa2fbc5e609f45f21289d1b114d33bd975299a8dd5bf0a4b7ff595c9dc80b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
022be8d26b742c2e579aa3e66f3e7484

SHA1
fa8b3f55e14c0471e1ebb4e5260005e44f90afb7

SHA256
5f007b81a1619b39e76be3b10dbe3233ee5a40aa655868cea131122a411e5dd5

SHA512
2b089abd1b4d2b613b5e9bafacaf2a53d60ebb8a2a6762d36b09e39b7790fa7438435117d1bf08484a23e23f86ff2298a492d337a90d272990c7d61809019320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
7ecccc66dbabff55e90ccd64e701f380

SHA1
af369d86f8a0ff1cd61ba4afd0ae7422a5d191ac

SHA256
eaaccc58fb83fee334ab4daa472618ed0b976ddf808054c77ae0b1ff3254bb2e

SHA512
4f537d17d0a3208838f630b2f532436bdd89c9f293d9894f52207da065c970ffe574f87c953f75c5b91cc61ae8f47358339b4d33ecffa0414c5c225a643e3c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a1019ba5e56150ae754ec8e8bfaf9d4a

SHA1
80add614d1cd9d2f0bde75145c62b4f16346514f

SHA256
349b694800224ae39e8c1d6cfcf0da5a3956b28b4ec4644cfe6aec5d1d123d89

SHA512
24fbd6b4a8f916e6ff8bbb96de3caef6983d4477a91d63dc5db73b8ad8c6c340eb863ef8fa193df33a54f2812cc1fa11c8c6941cf1e82cd4324099b85034e2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
58678b0f372a330d31ba42fb3934b902

SHA1
51ff02600f6dca4c24d2f805f621d428e76beec3

SHA256
8502458b5d4aa27524e2b0724b43d64ba385f75ec29cbec319cf8478938cc343

SHA512
cb235d839ea65b1d311f9be2335ff1f22444ba63e981bfab77b507eb9961b48793482f249282c859403f57ce3160983a853ad35adb73d6905882f2ec6bda2952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f6b6e0210f7ef3f80bc9231ab3cdd45b

SHA1
bbe6da715bb6c67ca31286b144b6c735f313fec8

SHA256
262684163e7f170185ae0e959f66ddf905684801d2f9aa6e7ec0f5c6f35d22c3

SHA512
9573cc4787787c1f567a77ec32d9d0e46722dd67408b9e557b362223dd4fa1e20b0cc683352a1ca47edd3e4e233dad9a82686690201a74ad2072c0ce36adf41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
47e7128a90a57a3a46a7e7f0c9ae158b

SHA1
1bada01d07fbd14778f351b22a4f3a2dae66f623

SHA256
97b3a036ea5c0524acb5c18406856ed19df18dd287a613686625a11be5dc0500

SHA512
0a8284e6758ee5e3365b59de91db6c06497891b728d26523df3d507f90fe4699028acbb0f15dc00495227fde2dae0009c027999e2bd866186d8020767e9201e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5988be.TMP
Filesize
873B

MD5
80702b5b6cf8f8d37404dd6a9928dbd3

SHA1
786337254fd6eed792e317b2806f2b415311f4b4

SHA256
d5a8ab5456ef71a2a14dfc58b47ffe434bd47bbc907ecab5188cb6ce53a1d2b0

SHA512
d3f5a29da6e336264005e1ce6b5bcf3f61da3c17bc5d7dfb1802cbaef03e243aca6940c92300d74144f669693f3c5cc77b533a580106ea4a0a909a4bd36f4e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3167c20d57d36c2c30a4fb6c222033ec

SHA1
579bd431e8832762cfb4c550f3be4431f70487df

SHA256
37b1d2ee7e9153f8b0aa4e97b22e010b75be8cf937e36f3079b2f672b4d1f90a

SHA512
b6e90cba53b33384d60d2f230e2262fa7d8d00ede0bbd7a9f02cf548d3480ad2f940a2582995ec4f106f290ce9991e214ddb42f5f1d1a77b9238c5085e7ed1b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_3112_BIJIYMCARHCPUPYT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit