hxxp://www[.]onenotegem[.]com

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2023 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.onenotegem.com

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3364	msedge.exe
3364	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4280	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe
4280	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3812	3364	msedge.exe	80
PID 3364 wrote to memory of 3812	3364	msedge.exe	80
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 4392	3364	msedge.exe	82
PID 3364 wrote to memory of 3468	3364	msedge.exe	81
PID 3364 wrote to memory of 3468	3364	msedge.exe	81
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84
PID 3364 wrote to memory of 2144	3364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.onenotegem.com
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9044f46f8,0x7ff9044f4708,0x7ff9044f4718
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5496124259467989726,11414595304918266659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1716
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" ms-settings:dateandtime
  2⤵
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9913c21e-4747-4881-9300-1b1d5c486cbf.tmp

Filesize
13KB

MD5
bab49dd2b109445d03fefbf964b75230

SHA1
b1d7cdc1bc4e7bc0acb90eb695f4e9c2b6ded789

SHA256
41260da297c67f4e1d3b4bfa419fc4a024c33a1803259acb5cbfd42c84325388

SHA512
d35fa4476bb192308dbacf418dd277c420f3506e2348a3e896935539d62d1ffefdf0e23d1bd631f1e7c119142344653417ba79343ce837407aa24b90248590ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9bef4685-a7c7-4efb-a606-c5eece9ecb7e.tmp

Filesize
513B

MD5
0d9a694e8c5ba76d6b590c67edbc9dde

SHA1
553f8456b568564f60a21e4d40db7d288fdb711c

SHA256
480759a4e60daa6596c718f38f5e7b552fa2baa0773c1478749e76774a299218

SHA512
419b7f73d9079d450e0bb24d078dd15e0118e9c958608bb7bb4b7efa097ef09ccd23d0fd8891e0fc4d6c0dc13d57dd665cb36301dbc3b76270388b8fe7de55e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
19KB

MD5
d28c55e3384525eb83bfabb9c0cb8571

SHA1
6562ef54649230f16af013f1f6fa91696dc8bf67

SHA256
3bfe3fc5b567e19cbc9a356e94f03f862a48e3946c0b0146fd4fd30704778c40

SHA512
3676eda4403992a44cfa1adfdb7e7f971fcea6e6c75ff3b27c38af03baed0470a4ba115886f102a74e097b563f390021fd0e1680bbb25b4eb34660216df8d8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
35KB

MD5
f63616639b4ccc5ef81fca2cec8cc3b1

SHA1
4823d57a75b266c3aed6ee208c2c49eff67156d8

SHA256
a8c7ada082622c8642587cf62cf8d6191d9f04af7363e589f61453cad8d41f51

SHA512
00ebfef50ee6c33b6968e584d4476b67df76d0a948a309b773755c5a5bf971f55cc2cb5d6ae54f91ee5e42250f480760471c2d9975d6cdbd12d420ed1fd9eee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
68ace7cb437774a2795d8e0789094584

SHA1
b718f711a4886d0e56a74974da5c04b483a1ad54

SHA256
49d79d1e1ed57b56c2385f2a0a8a5bde9e87cbe5148decab4313ecbfdec5b041

SHA512
e35fef1ca5e4c3d580efa7c4c545a6da77e9c7f076a09c09877d4029072995f9652d2d428d380237a77175e09fae975c97498716a8b96661f4dbcdb2e186a471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
d457f94957b5253775c0d8a7f7eb8edf

SHA1
024c19392a1ea0cca349b1cbe1a9a587b2de4f03

SHA256
2abe1de81e2cdaab908708d6ad836857c04493984cdacffc30e25559360b9136

SHA512
a78a34ef11758e56861aff6bfb50cada4c69e030a645eb5190c2588648da42c3161b6f381dcb232809b7b5a4fb49f995ff262d1bb009e0f0079eeb5c8684c48b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
a641d6fd7447609e0e93278a865bce3b

SHA1
3b8526e34ee43e51dd7440026105ae48c3162fb4

SHA256
e962ae1e1b0279cb65985e2b5938ff1667edc2eafad01b7f284a8efc0e814b60

SHA512
d70107c63114b41b88f7a05c1f92c41e20381d676dc8d085add32506380c2cf2f7fb3b42209e5011d797245eb7c9acfe919e62d3f06c3c36fe7a02948f788f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b48c77896f34df4a524e7127868eca3d

SHA1
f1f9f035c016adc4162536ec80fb1ee8dc9bd029

SHA256
289bbee076bd64ecc6691e1a731e5c0e08172fd34a382ead8a05f16ef608f355

SHA512
8d62ad0903f29f10b9df3ed094d5463080370a7ccb077b92daea5cbefa577b4b389ca49fdc8942fa0c3eb75cebe5c9e54260730ca8908a52405f8265ccbc9724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff6aa7f32a8b11136293d4852f31eb83

SHA1
0b1d6a548d77e5fedd38c36a77b673367bd63b2b

SHA256
5fd51b4ddab556cc91e5192fb4f4bf118c3159ac72358a7301024d8c60776cb9

SHA512
7d20f2f891e307289a4b86eb700b106b9e7e9c26b548dff3d0db04b6977489eba0ff921c2682e98c33084b62f4bec481e8a385b8173bd9048e4707618ae87268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09ecf2ace43605f929c1fd09409e4b54

SHA1
9a9cd8e5840ecfc9f8b8f80b2758c506c481be97

SHA256
749c63a3b17395ffc3f364dae68b3d972ace09126816698ecd79a1fc40fd7aa4

SHA512
eaa69470c837566034976c401eedabb6f56d4308d98c0df215ccad6eb6da051ed7fd4809cdef85707acd8df0776c11fab1a0c869284fd8e25b38ddc387696704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fcb5dbb248ee7fa926b3cf4b1f7bca49

SHA1
134aa4d65e074ee958a1428893abba9152518836

SHA256
ad079424f1e730d30637334690a57e27a1da9f9669604c762d9a7a958779ad99

SHA512
f5c762bf90c558bc745791be52be167925ffb96209bda8553c2ad22709c1b5269545c44709dde6fa16f010a0e3a436bca7bfd63a8b87c6fb95f972e58938f657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b40864e994eb206ca6d82cc6e997d40c

SHA1
2acdeeb92d19b4bb3eb4eb017eebef1235de288f

SHA256
ef30912fe20ce00ac200b32c524855b4db237036639bbf0a123c654cfa08e637

SHA512
87af26973bf07368c15cf627e8952f0684877f1929f997cb1398b1c74a865e723cb3610bbccc75c00ebf0bf510c07c99a61eb87cb59d1aa078a766dd44b5d822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18406da993c1bda849a6215b1213ac48

SHA1
fbba8c1df7f8cd93d7e0180cf282514e8d2d37b8

SHA256
aebba0066275352056b7246b296c4660ac2f0a22897934b6a56030d6c24e9717

SHA512
d29f0bf3e29fca9c727308d2dcfca5e6a8b6ec2dccd277eae92b525f9ad38461b55e56440737d5d5fdf93a44893938f09e14a6fc79a9a5a9cdc62d06b604ceb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
80e800b7280e467c5defd126bd98a587

SHA1
32dd04f8f6ac7824381b42b93cded5c2346fa1ca

SHA256
7590adda63d7e0edc2376bd4abfb53b0b05fddbf736b72d78f83712fb47aad1f

SHA512
ecfed93782aea26b7d7a58fe50e709589eda704490a84d0b6f9ced7c3fb1b7deb21558fb0fa3ce0c31a390f75c4ba720717375ec6e41e6a7e88dbe42a545bb74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
f353cb57c6bc293a37affb67330bc69e

SHA1
42ca88112122189f16c5112feeecbd73dd606de0

SHA256
d36c735bb6d7323524909fec9e20b7a29c17f72f1e1c90d32ab177f435eb66e6

SHA512
bfbd261762a64ef8b8b4f5e2e17d9fb19065b17d967119fa143b43cb7faac7ec026f33e1d1856b786546053cad0e9549ff248a31e292934a4c75302142c1786d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
1dc81452ee7086375bbbf460335ceb3b

SHA1
c105424b64928565a8e3e45e9640efec562d9562

SHA256
0f985980d9f9c0db49dbbdb97cf0ebc4d57fe519ca17c5fb0f3dbd6231dcd512

SHA512
0163fcef8a3c360c978ef6c0f32c667df8c15c2756f153ebb3dc63336093d9fe139280a0f28af3dc3962fd1dda21a143109f8a2f5f97c90be6fa4e109751a5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
0e6df72720407198f2b7f7d3447a6c1a

SHA1
5cfc337668d2939164262e788cc0f6f043b93992

SHA256
9b756495c1b4d9b950782df472989e9a6d3de5c0def3f8ff4e66cfe466b03cd7

SHA512
27cb237e359b42bbbeac128ba36281f018d352cc882cb9d980507161c3d3c9d1c7db4c266821be6ffbb0b1d037774f793a1b88b75d229f58a2b4d18ab4d1425f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
fce9fd9630d4932ceed37e4357470429

SHA1
aa26b471961786647d0da8d70636609f8c8675bd

SHA256
7893490a16320096527e991d31b3c95bd9d049a9a0eeb9078eba0603b7cd3db0

SHA512
8a67a2f18712e23d5ee5c18ec2a740fa9e2517f409e047d08eaff8c191259c71233670c6f161b4f372dae22ec026ce3ec84d38fad521203f964a72259ba4f09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e327.TMP

Filesize
537B

MD5
79b30e0a79027fea07f33d3eecbf9bb5

SHA1
f1f102a68b4f66d2cb86611c491f602d1ed81f52

SHA256
360b58cf951a86df6e54906e1de9f6f429f4608045f13973e4932612df8eaace

SHA512
1ce6812551dc6da68730537c43b767eeddb0cdbe3b6f214d475bed87ebed8f6c0007d23dd9ea5ec3c5a823507a81984656829be48df5a4eaff7b0ff39b8f1d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
162471d319031317bdcaf2f33365731a

SHA1
61e144704ef275409bf7b9708d309ffde4ab06f9

SHA256
bce36edfa5ee95e943dd8e683f7fc6a667742c17f6d92a677adc1d41ebf3193e

SHA512
7e7fa1c21b5d4a1b589be224aaeeb99b5dacecd6276e6bb77447a1f96c17f635ee688ba06616be3dca6bc328971e0068fff295fbfe5aa747225bc3622a0bda42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d9dbb688fb400f4c95beff1b5fa57aec

SHA1
3ee95defd2102764e3c815c32d92cd4176c2d38a

SHA256
a5ae4c69fabfe9c63c7af3c28f2f287d0c0db1e3a3c9408b740b00f9bed6e090

SHA512
db4d8018ae4829a973316245184c0a520e404e663b59639544da23a2448024e9f4c145231f0e5889e3e934de566e11fa937917f47d7a74d157f7eb8c9282ca93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
b4a9d6371c513e35392f006e78d5ef54

SHA1
c581f7bc81e9aea6b131e241c04ef6e0e93ccca1

SHA256
feb4e67c4b5cc55ae0b731d9a3bd81f38ef0ea020e6e9b46558445e8b462861c

SHA512
65ac45fe7f04f58d3d488927e49fbacbbb08b09a1269ae7263d1c9aacb323516aaca6fef8d56555a9e66b8d0db76458f2ceb08e17344d5ce76bef236585ad91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
11a144ea4b1e619221a623b057d65946

SHA1
b4a7218f1e6691f71417ba8b4b409bfb3fe1f4d2

SHA256
02f8b570382daad50f53b51c94f1c29584028b8b3ef844caa6adb71b9937ed2b

SHA512
b1463dbaf6549f648313ecb88c63d85b629cbd383c5305437f6821986d7bc4021d38b06e760f6d97bb44543b5ace1fe829318027ec581adab7ad04c1662ca5f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit