hxxps://www[.]paypal[.]com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=WP4WVLMAKLVC4

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=WP4WVLMAKLVC4

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{200B8D19-CC1C-4352-87BF-A18332ADA6A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
4024	msedge.exe
4024	msedge.exe
3260	identity_helper.exe
3260	identity_helper.exe
2876	msedge.exe
2876	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3556	4024	msedge.exe	83
PID 4024 wrote to memory of 3556	4024	msedge.exe	83
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 4972	4024	msedge.exe	84
PID 4024 wrote to memory of 576	4024	msedge.exe	85
PID 4024 wrote to memory of 576	4024	msedge.exe	85
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86
PID 4024 wrote to memory of 1308	4024	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=WP4WVLMAKLVC4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba1446f8,0x7ffeba144708,0x7ffeba144718
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1929992638642382440,11526380209985733300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
31KB

MD5
4209a6187bc58debe1c391bacb754c18

SHA1
58953c4296930f1239e951a3dd5d32c1d2e28a8a

SHA256
836dfea35428547d9a521c25236f3ed853650ccf483e2932960da000e5287ef6

SHA512
4826d76a95df92b26c348e9efb4b3bc070c91c5c70db598b9a50168dbcc6a429dfd273d5a41338571de18ffacc54346913ae659279dce4b5a5909c4c4d79b05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
47KB

MD5
71a948874fb937a672574a29ef18ee90

SHA1
adfad9db35d9707917286b38086a97f538f6bd76

SHA256
b50de42a5947b63f7bb048adcbc894d50928bedc7072bb6e35d9e41d22f5032c

SHA512
fee0165035dbeb56367a2f6dc0c1850879206f48ac3fd86038da73c87ebd3b0140f0f281bdb5b6ec55bae7de8162ca8e27a367fe47512fc85a5242d2f53fea66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ac551c2049598f1cc940960c3da9f1a1

SHA1
f20c8a501ec72c4bdba1d08abd024fad219e418c

SHA256
2a0701ee8c18854896c1a5e6f33b5b3495a7a679077742a90bd8ccadc7453df4

SHA512
2c8bf7117e68857379a99433036424af5ab4fc85d9bbd157000f1cf9c8b64e90594eb5718ea378000c0c386a93e82ffb41c970ceb4c8c9ec1f22f5e94e3e4470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e736238e38160511fd14517508018424

SHA1
499a7c27ee5e2a6b21e383981938266068b7ee81

SHA256
793d08b1ec4ceb30a8f015e23370fbd6905f3549609cbf22a046472d5c3b3444

SHA512
53a5de8d6841a11994b34f91a0add66a4108e093bb9c9ad1636f1efffbcbcf080fc4ce34541e98aab4a8cadef2e0b339ff0a6b6e08223e4fbae0ca5999374be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6c15614868ac65f38e288c5c1f8c6b8

SHA1
a4edf135591f7a6918d6fd1ffdfb162be60ffc90

SHA256
d1070400887a1387a4b6bf8ac47e40ea569cab1d340ff2c34eaf566ccaa9c2b9

SHA512
6f2c9c2dd225308a23f898a4dd00052f88662efc9f6a4fe9f9f8add0a2656f7a512db99a5794b2932c002983b9d707409bbec081fe6b2deabc5915e854733748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ab345e69f7e751dfbc39d6153032b6e

SHA1
41638b2eda141f7c961fbd5da3c92b9b93cd3b26

SHA256
c9a3da5c6ff60f986f6e4058f76a570a3b26510458136558e4208b023de5d76e

SHA512
1e2d93b08d4cb722215aa16d7ed3891ccea9657b80b897159a628c7a4ec70ee8ffcb977c46845d0a59d87583fb0208ac84ea02a1a7656cb91a56c196ae64522c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20279cde1162bbd6c143b93d5f1b931c

SHA1
4f263def719cc17c152ba2c918461ab4fb4d6f82

SHA256
dfce433c36671a252b784dd45c961be94d154d840426652de3b6b91396b12b05

SHA512
27e3200ac73a6e4708e0d58e053d6aac39b1c5b68dc84954e2fc05704f50e642aa861380fdc67ab4272d5cce231c175d1c39e3ef0b9544f75b90ed15e7cd8b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be0af090bf19e9241766fa4aa0116f60

SHA1
7f0d39fdd65d89d3d08bd0b2b896c187652a890e

SHA256
dbb34797f2573743259d9db5f7e1783d055a9ffff891dd7ee0e7f7cfff983fc7

SHA512
a0b52444e4b2a3365bed68067d0bd20a8c6f5d3b1ddc0b8d4135fed1b1316b025f715eb73a61d5b523ad4b402ff2ad8fa41a4f2d4830c9e4856d41ce0b2fb1e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dce3.TMP

Filesize
871B

MD5
0f9bcb5f508dcd6efbc05038a0b479c9

SHA1
f49905a6fa005e5f32b0d52b747fcf95e63322ed

SHA256
2426e43e17ff1cd01934ddfcc565fc8d1e7dd0bdda6fcba3cb8d8e8a633e153c

SHA512
bcb0999faff9e3ef8ceb2d31bf51812a39776ba58a4be0dc3ea27c6c34da666d1fd84046067505462a2e8023a67e866053ce81a3b9b65b5b04d1611fd6300024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01498c5f5c5aab78d359eeb9113882b7

SHA1
f2fe460885642d02490c7fdbfc05538229933bfd

SHA256
0a90576920b35431daf7ef9045b197228a22501b61c88045fe2080d793bfb9aa

SHA512
ddceb657caf65295cb0742c8b9ec89c89365ded455f0b1cfad218fdac5ed6434d7e89a0d1db22ff85609f093d10774ba4918201c973f716b444ca8f785db30f1

Download Submit