hxxps://www[.]paypal[.]com/invoice/payerView/details/INV2-4Y5S-ZHHK-H6YD-XFNM?locale[.]x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&calc=f197313b75001&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1[.]296[.]0&tenant_name=&xt=145585%2C134645%2C150948%2C104038&link_ref=details_inv2-4y5s-zhhk-h6yd-xfnm

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.paypal.com/invoice/payerView/details/INV2-4Y5S-ZHHK-H6YD-XFNM?locale.x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&calc=f197313b75001&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C134645%2C150948%2C104038&link_ref=details_inv2-4y5s-zhhk-h6yd-xfnm

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
1972	identity_helper.exe
1972	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4848	4616	msedge.exe	82
PID 4616 wrote to memory of 4848	4616	msedge.exe	82
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 4292	4616	msedge.exe	84
PID 4616 wrote to memory of 2064	4616	msedge.exe	85
PID 4616 wrote to memory of 2064	4616	msedge.exe	85
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86
PID 4616 wrote to memory of 3988	4616	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/invoice/payerView/details/INV2-4Y5S-ZHHK-H6YD-XFNM?locale.x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=2b834b25-bed9-11ef-9f14-9f2105d19291&calc=f197313b75001&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C134645%2C150948%2C104038&link_ref=details_inv2-4y5s-zhhk-h6yd-xfnm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdcc846f8,0x7fffdcc84708,0x7fffdcc84718
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13259060673184953278,6294925753861447209,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ab3f5890e4c4f55cd18bb5d5ab617f54

SHA1
293a13000cc48b078e53169d91402dd80352d3bd

SHA256
9d2cdebcc6ceb77dba6ff54d216eba5cc37fcbf7bf37dc36357091ae82df0871

SHA512
372a1de833a11f724e7e150107f377a12e90b3a1d114ba9118bdee8bd28f639bc31f1db996bf6566f807404b6866e4a0b5f361ff42d400064aa0da6e03d96feb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
356cb389a2114e9aeedbeec73332b47b

SHA1
d2be4dedf3844586769313b06ae56071f2851362

SHA256
a7c2965f6b80d03dde5dec1be2e7aba45d96377c8b76da1b197d4aec6856d345

SHA512
433820fe65634341837eabe5acb22efb4f2618b81dfa309759a488f188fe73e46557634aa5caa5f2b24682f20818244bb4d9e204896fc5f23603bb504bd30bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e50def68788713da5a9407b13818e43

SHA1
3e18702a37d89b2b2b0846aff253f4c4f91dc100

SHA256
2823b439d4855d8cf4e6958ec83baa6cee743e3c894b2177f8bb1f802a374e81

SHA512
375b3ad1d54b8bcd2c05d6ecd25e559d783bd91cdf30666317e1bea0f2e1ee6dff4fcf7fd2f27514aec5858e24a775fe080609126d75ae65b2b66045f294273c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20aa32867461835116be0b720ce5b83b

SHA1
57e9ab94824f221363e1c2631352beb0f753aa47

SHA256
868f68ecc2004d388026b926d22fc90a145cb1b4d037f0f120cec7826400df47

SHA512
2cc6d3bedbcf512788eadee3d1cc77ba20ce838ebc12a7c57d9812a8ce297d04256e415be7824f5ba5703fb6bdd703ac3b7f3a379c059949325d843f22fee3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
28ed65ce72db1bd0169e43faf284c367

SHA1
243d8cdde15b18debd8aa08dce7eab1d60515953

SHA256
f01a839d66154fc53c9ccce7938653d88f070616d969403f3a7b7933a1befbbf

SHA512
a591ab8ef0f4ef0266304c5f18c656f788f33df373fb2d76ece8e24b9e205c48628332bf90093400569222519e91d28f0f250636828e271ac43feccb4c8ce19a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584457.TMP

Filesize
871B

MD5
d3c9ffac0477246fbbdd754edc798545

SHA1
2220f58b5bde24b5e3ee0b1f1240b08b8572458c

SHA256
6ad73a3c1015e92d520f860608c8ddd2e97030dc5a47c2b6034a3f38a0c7f2af

SHA512
7c6b300076c78fbf5fb0438025cde5fa62e52ba45a9acde66acf287e0f3c49117231544614f7978cd6d87df20358217d5f9354646010ee27c35f8f08a2611f36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25a727256e91a50bf90439972cadcda2

SHA1
74b849fc8c7ba8f80f7995cff19fe530fc74ab1b

SHA256
14e10b9d4f07bebb1d504fe5b5ff1ebe42432ff1efae54198d3542fb5acf340c

SHA512
d38c67aa598a545babf91712b3d7253021920e459523caa38b9b3e71a58257d49bded11b353e0654464ef3659d560e5cea3f0f7be5c1a7293402fb338beb1c16

Download Submit