hxxps://www[.]paypal[.]com/us/webapps/mpp/security/suspicious-activity?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000274&utm_unptid=f1ccff08-9de5-11ef-9662-c31af0772137&ppid=RT000274&cnac=US&rsta=en_US%28en-US%29&unptid=f1ccff08-9de5-11ef-9662-c31af0772137&calc=f162603fd3be1&unp_tpcid=invoice-buyer-reminder&page=main%3Aemail%3ART000274&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1[.]292[.]0&tenant_name=&xt=145585%2C134642%2C150948%2C104038&link_ref=security_suspicious-activity

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.paypal.com/us/webapps/mpp/security/suspicious-activity?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000274&utm_unptid=f1ccff08-9de5-11ef-9662-c31af0772137&ppid=RT000274&cnac=US&rsta=en_US%28en-US%29&unptid=f1ccff08-9de5-11ef-9662-c31af0772137&calc=f162603fd3be1&unp_tpcid=invoice-buyer-reminder&page=main%3Aemail%3ART000274&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.292.0&tenant_name=&xt=145585%2C134642%2C150948%2C104038&link_ref=security_suspicious-activity
Sample241110-nzxzjayreq

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
2284	msedge.exe
2284	msedge.exe
112	identity_helper.exe
112	identity_helper.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 60	2284	msedge.exe	83
PID 2284 wrote to memory of 60	2284	msedge.exe	83
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4272	2284	msedge.exe	85
PID 2284 wrote to memory of 4212	2284	msedge.exe	86
PID 2284 wrote to memory of 4212	2284	msedge.exe	86
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87
PID 2284 wrote to memory of 920	2284	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/us/webapps/mpp/security/suspicious-activity?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000274&utm_unptid=f1ccff08-9de5-11ef-9662-c31af0772137&ppid=RT000274&cnac=US&rsta=en_US%28en-US%29&unptid=f1ccff08-9de5-11ef-9662-c31af0772137&calc=f162603fd3be1&unp_tpcid=invoice-buyer-reminder&page=main%3Aemail%3ART000274&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.292.0&tenant_name=&xt=145585%2C134642%2C150948%2C104038&link_ref=security_suspicious-activity
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4f9746f8,0x7ffd4f974708,0x7ffd4f974718
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14171748020699944101,5311654926862208321,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 215KB
SHA256 6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
MD5 e579aca9a74ae76669750d8879e16bf3
SHA1 0b8f462b46ec2b2dbaa728bea79d611411bae752
SHA512 df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640
SSDEEP 6144:p44SMI+nILK22Fp9P9xp1mkXRVxCKl6n3P2dQktzsDb1Qr:pSDu2yf9xTXR7zYPTk5ubqr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 a61d845ea8e0596b2a60fd2dfd2c24bceb612aaf0259273889f18070140a2e7a
MD5 bdbabb228c9f2ab37d8c9ffb9d5f289a
SHA1 f4539fda82d702b7a2c2b5eadd0f0c33dc827c88
SHA512 e6111c335e6803d664292c02af81586d8a86579e9f41c90337f95e76c7cac26285aef601d5fd04e42d1a54bbfd291c1e6b143849b73f3539e0242972ca4573ef
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 fef8574a747103a874fbab7e183cdda845a5ca14add5cfce617ef543915982dd
MD5 b3664b70529bdee7cc9d65d2a7cf51b3
SHA1 8b03b3132529e0e772691ecf561a064ebf5dcaba
SHA512 97ddefa1d49c021a99ee8bcf9997cc886097eefffe035b797158c63a8304c3021385ba3813d136c37e754169d676b53e968565b6c1de967af97ee4a2549f7a64
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 13228285ad87c9c62e1dbcbba7a73aff5e543c685c9c107dd5bd3f1bf70c31e7
MD5 28a6599ec93eca519b0560f2e817cacf
SHA1 7d8df3f6341a8d5ae700de5f9f1acb44e5c19a9e
SHA512 e8c03c2eff8b0ee1d6e7d8cee99c9a63a90f9578c48cf3dc30566d2a464628a2388cfd4bb1f440b2c7cdb06f2dbe85f739bac60f8358ef1cfc208644e7c99144
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b387dd65737f1104fc3016c047671a2819685e7012a2b77330713b8cce705b7b
MD5 d7e56a5d373d37855b7f7cda6bd60a95
SHA1 16e2a264df332fc380ffb2a2cc2b374a601f8dbb
SHA512 d90b9764496ed8c4481f7088cbe2051680c6d5995c397c90e4d383130094ecb3d498b086c3e5352866c5f805ca86b8dfb0a8b5f117138bf984348379898f530a
SSDEEP 96:nCks316MFwpvWMoiVmdeHAnKeGUWQyV+VDCziEwb:nCkGEMFGWMXGKxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 815d3d9155f3383b962f5c8b9024bb380cc2ad2432ee6b58ae3a9c7a67d22c71
MD5 1bac315270ad1e56ab6ea5e60046a351
SHA1 1caebe8271b401f3b63a8e4fa39389ba6cf93e2f
SHA512 953e8011a1e845db7779552055131582b3446e25bc099cbf13b0a2c0d7152e251b79fabfe549047429a8880b4e9eb623f39ffbc9b627cb2136c170a7a3fc28ac
SSDEEP 96:nCkV3168Fwp2FWMoiVmdepu61cpfV2AnK/GUWQyV+VDCAiEwb:nCkdE8FRFWM5u66pt2GK+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 25af3076f663958b9e8cb6e956683e7bcd63295989eafc5c91f46c78fe4cb510
MD5 54acf96b01242b72cfed019dd0887576
SHA1 4de25252bf6759b5717b32f3f2897d69894e03d4
SHA512 8880f78cfa0623b65876d96cbc8d447cab9cfb73026218ddebb45b4b5cc93f75dfaabb1d8397c6abd844c406ac6c56848e948b878480a9c2bf732f5b7e298702
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 261a7fbb2c0f709df6756282bbc68b8fead4eb5f14c90fda2e253c98a778f669
MD5 47ebcb06630efd3b8d6b05aa750e2dce
SHA1 97f418debc33a86935eb7aa65eaa8c2a42ebd73d
SHA512 e61e59d5fded8c47662928fac8bb9856b4f090c475122cc9e2353e34fe9234e456c5d2b7f9b7abe2a82e5137d23e5c2862774d39633b2fd1bf06b3f95fc4828c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 702B
SHA256 7121cc453a256082ee12d78882978cd792d1035c0c5fe5705c2bc4760d5aa32c
MD5 f87756263bde4ae4d0f1ac7500636935
SHA1 1dc7217cdb4031de4ab2d42099e63220ebbed274
SHA512 ba79f32edda01658645991b0240fd3289a3dc67dccf05f3b607b4c341a2cf737bc5fe513965440d9f4bb0bf20afe047ee981f89f79c6be24879c690b9e7f5403
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 702B
SHA256 78ac951e609ce4899e93c83ae6e431b500c89704a0b309e5af0426e970a54cd2
MD5 33185afd79d738122043a6a647070c46
SHA1 a582f22c9899bf4bcc5ab6d2a9bf6c1480bf6aec
SHA512 abd5579b5ed5bfb81991f037deb38dd974a0470b188c5d18a29d8852a41cb24c3306c4aefc1178fe016d9aacb349cdab39ddd732fb2ceb03f6e3f30da6d93e03
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d699.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d699.TMP
Size 698B
SHA256 203596fb8d40e84f79df5cf1fc89373841475336fac7edc930d6170134f37588
MD5 b8c33715040cd8544732ec0279e43d66
SHA1 3dd9a01a746b9c43d7a758bdfb72fe43720634f4
SHA512 50642d24fa8f0953a9214a7f57b530d0f0407958ab708055750dac1b3e6f46f9fae74e814894025ad178dc85c16b263f31b66bc63b416d06f09bc5e52a382a18
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5122e0440ec282c664ec061dce6a57f172c886546698971b7ad827e45b77015a
MD5 fdb6ece174b5e62acddffd8eb201711c
SHA1 3e09570034649e394d9c4f8a103cbb15cb2643bb
SHA512 f8da232e3d146f34132e0ab5b92bb568e96e591cbaacf8d3fc72d66960bd22c0e47f08c17f0cf8b7ac4773353abddae4d501b3a40b9e6c1c0cee4c1e52edbb39
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0Ve2RUYkNCHqRUx3GPOxu:A9iIxuERzA83h09RZxYYRm9SFGmx8o/u
MD5 SHA1 SHA512 SSDEEP

Submit Download