hxxps://www[.]paypal[.]com/invoice/payerView/details/INV2-XSWC-STPD-7MR3-E4Z2?locale[.]x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=808aaa65-be10-11ef-bd58-c3218314ff97&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=808aaa65-be10-11ef-bd58-c3218314ff97&calc=514c1cfa9cab1&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1[.]296[.]0&tenant_name=&xt=145585%2C134644%2C150948%2C104038&link_ref=details_inv2-xswc-stpd-7mr3-e4z2

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.paypal.com/invoice/payerView/details/INV2-XSWC-STPD-7MR3-E4Z2?locale.x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=808aaa65-be10-11ef-bd58-c3218314ff97&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=808aaa65-be10-11ef-bd58-c3218314ff97&calc=514c1cfa9cab1&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C134644%2C150948%2C104038&link_ref=details_inv2-xswc-stpd-7mr3-e4z2

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4588	msedge.exe
4588	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1268	4588	msedge.exe	84
PID 4588 wrote to memory of 1268	4588	msedge.exe	84
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 2940	4588	msedge.exe	85
PID 4588 wrote to memory of 4608	4588	msedge.exe	86
PID 4588 wrote to memory of 4608	4588	msedge.exe	86
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87
PID 4588 wrote to memory of 5096	4588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/invoice/payerView/details/INV2-XSWC-STPD-7MR3-E4Z2?locale.x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=808aaa65-be10-11ef-bd58-c3218314ff97&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=808aaa65-be10-11ef-bd58-c3218314ff97&calc=514c1cfa9cab1&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C134644%2C150948%2C104038&link_ref=details_inv2-xswc-stpd-7mr3-e4z2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce3ba46f8,0x7ffce3ba4708,0x7ffce3ba4718
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2772 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12562994113397462447,415471631572009276,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02a4cc86-26bb-4e4a-91e4-b8a2ee9be029.tmp

Filesize
10KB

MD5
854d9fc662a8eb289c26b880dcad70c2

SHA1
ba9756cd77aa641fad75624f35f2e56a9047d76b

SHA256
e7231d0b25ef2e1c8425c7747bb6e8f94cd20179311b191aa2e8d10d67de7961

SHA512
f61395bc0741b188ae0b2ae36614182889e6839da6927accf38a18a4dfd8ddc5e8b37bcf5d2cb16d18f34acddf16b8ff1c60c418fafacbafa3daf0357d22bc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
4d58cfd77d7efb6a9a6bf406b1192eae

SHA1
b4831383920591d4fc3c2ef807fd4484af7f3bc4

SHA256
00b7157ecda6427e46c1208953501ad38fa5b8850d106916729772ea4d5893ac

SHA512
f68583fd93c8de9e13da5a2be1d76570149c61a0ebcc4e89dea6a105af51e082ba3f9b60c373eb90216316731ccecf763ae301659d1e9566e33cb0321086b0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b0fbf2715e760e5d461454c75b4fd107

SHA1
863e8e788358cec1d811baba142c36c729df7963

SHA256
81ab61c119712d09eeeba424c03e10a03cd14e799c6b033db279b3246979bfe3

SHA512
0e9090fa956698d96dd083ecadf77dc177678da7bd6890abd146c21bca3a75dcd89a98f58757e8d6001b0fca557f15c4ff58bb418c247d22ab03710ab2f694cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3431d13353093b4088a7218a4a8d2b67

SHA1
e5bea4ef14e613f7dbb642da7a0abf5c69b7f282

SHA256
666ca40d43901f9abb4cdf8b69573708df76d03ca7d05c66b8abd3ce31d4aba0

SHA512
33bd54affba72dc6d28c13693e13669eeb9bb9fd37d5396a6577497973c870dc00e563a53ee95ab8a6a3e5b665ff427c72386d46e7a8f3e1458ced9ab1e8128c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
043e290d9287334e5d2ecae93e466b74

SHA1
bee3c3824f3328cd9821c048a1dac9cdaef69544

SHA256
7751ea41099d719661922b189a169f8fadfef85c57f8a4de9500eaeaf2870360

SHA512
49e0010e1d86c11fbfbb97977331d6e56547bc8963fb495b24f4f93ba3fea58ece3756da2d9019bd6cd2679bf804d19f90d16e7b66fc928a4b02bc7f796738a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
6dd3310f66f6baef702e3c33e959fa1b

SHA1
833874fb3b17f5ee4a6e9ff59d4f3734f59f0511

SHA256
4614ea8f98de7392debb0878a9941e3b24272f28c6bdaf61044327bfeed42fdd

SHA512
cbfcdb42595eafc0c1d38a86b7002b7ed0f7c6987c4e30e9af446fbd946ed5625597f7c7594b0bea1a792148bd71df5cb93cb462ed6db65d18e6d6397339611d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598831.TMP

Filesize
871B

MD5
eb5f603cec0b4e535ce8f85a13eacf09

SHA1
d83e505ea2fe4a9a7000bb12c8808f076ce5c611

SHA256
69d5751146e1599a8fb276996d44728859fdf162558109b5c9c951d409a1ef17

SHA512
f1600bbed2742e0f22e09145d79fbb47cabbe85b3a0a3844aa276528bcf21b78b980303ccc754e97cd26d8ec3afa408a29e734764c809fc4788bf82a53caa74c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit