hxxps://www[.]paypal[.]com/myaccount/transfer/claim-money?context_data=Xtd5Xx5V-mwGBLwPPaF6dI_Rpz1xgt2PwM10Vq5GJycqmUd1PptE3Tx8gEd6O8K0-oVY3l4zJUVXZLZjtcUwl30yOUUBxDLsF0m6B57YABA4SAuWVtG3xCDwazoGx4TG28B_5N6_yHx5HvL47eIa2Pu1xO3dO7K402cjPJZfJnWMMuZBQ0J52Pl464t0slQrrFOvKdL8p-uDoLqKYuzziRP2MsMw75tQVlkVIa78EueHfAKZZr0CpSwz2qi

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.paypal.com/myaccount/transfer/claim-money?context_data=Xtd5Xx5V-mwGBLwPPaF6dI_Rpz1xgt2PwM10Vq5GJycqmUd1PptE3Tx8gEd6O8K0-oVY3l4zJUVXZLZjtcUwl30yOUUBxDLsF0m6B57YABA4SAuWVtG3xCDwazoGx4TG28B_5N6_yHx5HvL47eIa2Pu1xO3dO7K402cjPJZfJnWMMuZBQ0J52Pl464t0slQrrFOvKdL8p-uDoLqKYuzziRP2MsMw75tQVlkVIa78EueHfAKZZr0CpSwz2qi

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{61724598-E778-49F7-85A8-4B792C86F3A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
5084	msedge.exe
5084	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
1776	msedge.exe
1776	msedge.exe
3244	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4192	5084	msedge.exe	83
PID 5084 wrote to memory of 4192	5084	msedge.exe	83
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 4740	5084	msedge.exe	84
PID 5084 wrote to memory of 3800	5084	msedge.exe	85
PID 5084 wrote to memory of 3800	5084	msedge.exe	85
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86
PID 5084 wrote to memory of 1812	5084	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/myaccount/transfer/claim-money?context_data=Xtd5Xx5V-mwGBLwPPaF6dI_Rpz1xgt2PwM10Vq5GJycqmUd1PptE3Tx8gEd6O8K0-oVY3l4zJUVXZLZjtcUwl30yOUUBxDLsF0m6B57YABA4SAuWVtG3xCDwazoGx4TG28B_5N6_yHx5HvL47eIa2Pu1xO3dO7K402cjPJZfJnWMMuZBQ0J52Pl464t0slQrrFOvKdL8p-uDoLqKYuzziRP2MsMw75tQVlkVIa78EueHfAKZZr0CpSwz2qi
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd1c046f8,0x7fffd1c04708,0x7fffd1c04718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11256232426810782014,8182693258412213710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
31KB

MD5
4209a6187bc58debe1c391bacb754c18

SHA1
58953c4296930f1239e951a3dd5d32c1d2e28a8a

SHA256
836dfea35428547d9a521c25236f3ed853650ccf483e2932960da000e5287ef6

SHA512
4826d76a95df92b26c348e9efb4b3bc070c91c5c70db598b9a50168dbcc6a429dfd273d5a41338571de18ffacc54346913ae659279dce4b5a5909c4c4d79b05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
47KB

MD5
71a948874fb937a672574a29ef18ee90

SHA1
adfad9db35d9707917286b38086a97f538f6bd76

SHA256
b50de42a5947b63f7bb048adcbc894d50928bedc7072bb6e35d9e41d22f5032c

SHA512
fee0165035dbeb56367a2f6dc0c1850879206f48ac3fd86038da73c87ebd3b0140f0f281bdb5b6ec55bae7de8162ca8e27a367fe47512fc85a5242d2f53fea66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
771e2d4ba61c894d301d93ad07d1b0f1

SHA1
0b70ab411ca755c6077f5b8d4efa1d7dc684ef2e

SHA256
0bf584b8a898a468bf7fb6dea902e22ad912112074c2ab19bb62aa8b83ddea73

SHA512
89b953872aeeacf761f57d090a1b1c6175b2a347a7e30febd91a2212e7dad403f58697faa849cf128aad7a4e5a5f4e078f1238df90f4462cd094ebb0f3f2e242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3ca3dc7016611567433338ad5ab8c0d8

SHA1
09b92523d975270d811f2f1f6c57db723d4eb7cc

SHA256
b0f96b1e73814adf41bfc25618494a8b8b9c6b8cf5ce2faf42e4a7aa27bc45bc

SHA512
e2040e4b050165bdab1dfe7654cae3b10612995a279ffe54cfd50116aa295e4ef221bbc39467560a6a560f6242930a8031070a45e58736cb3ea940a85dfc4a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1be697c19c63cc781c0a5e7fee204540

SHA1
2690de80bf6a218329a72c8add7cef6a8e3627b7

SHA256
2e6c3ded346cf5ee6fda853d777e2baebf7b690b31d5792fe8f32089a84704e7

SHA512
9e78c7ec99ffe02679f355e962debfda7a8696fb371949a98ceb38a7fb2ae0372401f38b09e32a104ee73b2afc501cf4e0548f0c004a8ae70adc2b0cec74d6e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7479b3c39a740366b6ec9e46ed297a4b

SHA1
1729a75fd4c6e0cf918d43021826e7db72218617

SHA256
a9903b21b34b91601eb5342f8b9931126ff36a1313be640c902f4fceae617104

SHA512
932d1d5c5876c1b6a049c3b555346323a7e62e8e7060e21f2ff300d1a4070a98753013bb00cd31ad2a9f31172cc124ddbffbf17b2f7c57678c86d8e5c0729d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1992a2cb0d717454abbb917fc530efdf

SHA1
60e68d4863a6c062437b55b31e3112386d924d73

SHA256
ae6a9ef7e1176bf524ff8a55c92f2314e392176949eadadeba8b591a71472ebb

SHA512
3f8db4ca49b811f510f9bb68c8c01c3d4e6b4db61bf99c2e25c1dc242b31e1b09f07e08bea27cb08115a68a8c394a07ac9c423440b6c1695e26eae50953aa1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
793dbffc37c570202bdf07013d27e787

SHA1
8a25e152e4c2f229ee2ea88d661a6b9b03bf12c9

SHA256
e25cb4a553267b76de6796e978931207c5524b329286c8031ea26750adca6b5d

SHA512
d68ddb4b4e185653d3ef2e9e38a5d66b9379cee53d1037e52abdb43a8f3d126965399a859adc8bac214d6ca6b12d42c739a35889869cdee2e65416307601cff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d08e7a1353c85665cdab0e83d519b85e

SHA1
b2bb4f522cf79aa3ee801f117487c3b08e3e509b

SHA256
f2fc8ce9d4250f58fc458590f104ea5f80140041f8ec16e0ea79c65dac21d1ae

SHA512
7c25755e95602c5bb3b6214654c42aad5cc8ba044cc07554a291655ca99669f1aa6f388a72408cc17c0c71bb99ce2190a83b0a6df15d990c5da4478c659a4e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41f23cd23340a723c1308c1d7821214a

SHA1
771249733bb95fe12091b40e3d9a494ad500b0b0

SHA256
600b1bc64dd41633d6a0f45ba5124c7d3745ddca784a60ff5d1198bf4ad58907

SHA512
d5c1fdae54a0e6b02fba56cf3dd8ad6d2c81450064de659e5d693c30efa58ed74f874fc76bbf9a3e7bcbfbea71b97ac3e06e2b5b027b78bbeb391db7205b7db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
96fefc529f509567b503f4cff54af2f1

SHA1
b4f7dc590202deeb518bc59fdb9e71355d7f557e

SHA256
4940539bd9796cf4d3e6289cdc066c07360135c94c165aa3f702e35178d70cc7

SHA512
a769842aea1d7d62723c81d949dbd7077fee0ad6940c05b9b41bdc6879c1094a5748d7aaddc3710113a48bbd016542d644ca5c80bc26246ac463dc142b37f371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e82e9c2cda97dd0c4a606e07da0927c

SHA1
89581d67352e3f60c4562c31d1c9c2a83f31adfd

SHA256
b496386e5fc82d536ec28e5748db1516470c89a4937b0bf73485021abc3f8455

SHA512
e9e24541c1c4890c3805d8fa1e7d204424237d5c90a18b215d61577202ed42bd7fdb050854ee3754379fa8dfb15ba2120288cf0611df15903e200f061029458b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
aa350eccec304f81fb3ba99b40e25c1a

SHA1
b181e1a786fd18e3aa813744a3b2b87a9acb9c20

SHA256
9ff5b413189ccd05483195f53028936d5f53e3911d2730de1ab0446069c62c9a

SHA512
7a8d400910b7a0e19a4581254b9adc758d5acf6706af54c3b912bfdc2ee325419cbb79892e8a53d6f6f39c6a809f5f777541388125c9436d9728cff37899c5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582016.TMP

Filesize
537B

MD5
7b72d9d3d0583aabe333529db873e13e

SHA1
f94843176b68c9ba0ccaf93d0422ffe37b1d0801

SHA256
f0a79ff3b5cf4060ae42bcfc7a6737b7924328552ac14e6cac787593bd724f6a

SHA512
086b98af22448ae981c3b579cf44d507ead5614468d86c236335782e76375c37d628bd9e7cbc6b5655ce48a409c555ad766fd09a4968d1c75a5523f20b2d382f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84e5679f2d35bf1df2c49d58a7d2cc8a

SHA1
11e80325211235e2ca07c3304efb5706af10f99e

SHA256
941a6df0692ee29223e40d4b17e981f75e9a4a3aa171721e28664f90a20c5359

SHA512
3aa5f17a08bc23d9daac52c7bfeab77186e16ef9f4baaa86ef98b0dc1604aeb31c3e62b7ee56ef3fd88efb7369afd83db48ab41f868d56426dd55442eb53a177

Download Submit