hxxps://googlemail[.]com

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-fr
resource tags

arch:x64arch:x86image:win10v2004-20250217-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
11/03/2025, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://googlemail.com

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page 1 IoCs

phishing google

flow	pid	Process
64	3136	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
1668	msedge.exe
1668	msedge.exe
5000	identity_helper.exe
5000	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4824	1668	msedge.exe	87
PID 1668 wrote to memory of 4824	1668	msedge.exe	87
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3960	1668	msedge.exe	88
PID 1668 wrote to memory of 3136	1668	msedge.exe	89
PID 1668 wrote to memory of 3136	1668	msedge.exe	89
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90
PID 1668 wrote to memory of 4916	1668	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://googlemail.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff01bf46f8,0x7fff01bf4708,0x7fff01bf4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Detected google phishing page
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11092975612489295481,229962875778536809,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3dccc2c6175ad8e6b4ccab9deeb1f1ab

SHA1
656e1d2f03db7f4dbc04202f0813157675d2a808

SHA256
05352e621d37e3edd7473482fe065168c15adf5c52b2353bc6754dab145db12f

SHA512
2907595e056ea4e013074348236b6e8e76db6b594b141c1a063e1cdb76832482b3b915fb51a4e1b469fae9e29f306a7b83a9af9d426d9828b8aba71ed475adcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
84da4219c4768f49a56c6007a6dd0cb2

SHA1
fe14668cd143ce3d6bac96f126b6c20bb9b12519

SHA256
db8a012f50a42de44bbe20a0dd4cc63d7692310dc91623a8443ced87191a2d6b

SHA512
b4e4640855a4c69df50c93332a5dc7309bb5d0b675a63ffac585bb9e72807a28a11140a7d2fc8c74a08b84634cb00466793d18d7710fff12865582117e570e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
114b89965c9c6c3aa02c38d580bb6caa

SHA1
3b12b7b3ae5f8898594229cb9cd90607a8e8c5f2

SHA256
808689355b89ce4f98d3d3b3b8217295249f1283c883f482f21b524cbae5bf5a

SHA512
0039f2abb6f1f2ea1ffc97d22c9db9fabb93d83c1d946226b453cb1d248b3a0304f0429f12ef522a6a47518d8a3a7e657af03c29173d8dae615e9f55f7260bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
53deb12958c8c39ea710f6878c9f08fc

SHA1
f952c76518901050f43ee002525079a44aa29f04

SHA256
bf02b1b44b68ae3963a14c0a5c6a7c51fd3afc0dbe0a43ce04e07743c90cb45c

SHA512
a369c5805bcc711d0c1c186348b7828d2a8323fd660cb14ae637076df8611fe1e1932cbba1e675b26361f68d29a38ad291bde682644fa6ee45b87fe90b7e302b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb7d9d766d965d782772e413c1f1b3f9

SHA1
c1b5c6a8f7dc2717b65994c9b85a7a30a07a7904

SHA256
3415911ba6454521633e6449d512bb04909413793b904f32b163e7a2f49d4d04

SHA512
796727e134d097ec40fc1886edc3ccf02f84fef88390efdc9e9e293d757ca29c9cbcd0f1506d5861aaa7b52b166b1e7f0dfc6b3d4ac4d33694db8922415d24f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2aa9c57b4902dda625abe6fd89d3ceb5

SHA1
069f085a0cb566fd9987c91c3d541ff4ae2293d3

SHA256
77d5a1d376419a207fc78c345189857cf84dd2749313be49d512c1df48a0ab5d

SHA512
50eed941526ca5d78d740662fdc568a4c2c744d2552aa91f0afcc26341176ce9b1a07c4c468bfa29ab0eaa62ffb7dfe097433f4693b2bc9351988ee19179a244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0659dd0c6e0013954819185abe7bf6c1

SHA1
0d309adaeb84bff4820da5cec4110adf991a4e64

SHA256
7d377988c1b8a678f3e347c70129ec07ee0b807c14f97b609d8e8106bbf3cdbb

SHA512
05a16b76d45e870ccb1a7761a70f05790798f472d47749552d6e3b5e8c249f9686965d0fc1ebb9bb0b8951e1e4f3942b01994154de5ba805e0af439c756b45a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0779f2efb2e61e6fbd2b90352a187406

SHA1
e7231ccd800c08b9a6384f3f182e6cbfc513ddb4

SHA256
09c8cb23b875177865e5c94c88e5188e581f184932ca70c530efb30d3db7cfcc

SHA512
adfcf4c5ae559d0f4ca30097a07e840a6038e8e656d0d5e12c58f88d423ff33d02f408919ba03c7d85d31023a282590c4d7b548ec83fadc93ba839d427f0dfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
227163f24fa04482cc01ca83ce6dfc0c

SHA1
3286eae34162f8f2cf6962e7ea42e1afc0b2b594

SHA256
f243209cb82f47d5dd693ab5e235fb0270623f92cf5071f8f5ec6ea4778f0fcd

SHA512
c74c0b81545c538578147d23cc803ea0560dca1803933813e16214dbe6b54a2f4c23aa956ebfe4a0da9b81cb0780409dd709ec16a5af90766eeb774f282f6be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a19a.TMP

Filesize
370B

MD5
4d666f21d3944c60c05644f96de4d5b4

SHA1
92d629613db7faab603d4a52fd7b661f8eb823dc

SHA256
7baeb07c16958a463d1d68c5a2fccd600561f3206d30a1acd4c11c25cd48d323

SHA512
7777844b9aadef75704f788dcfd0affc50f291860bd5483f39d69030f707873f6a64cd839f2f4d4215c968844cb34c6e103488d12757a648e04ce55adb03dd2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9adb8bfe970f77cb67f4bcd01f124f4

SHA1
8511d8fdfb6e7298227b42508f88dd9f894d83c1

SHA256
e6c3e9937bad0f572e98b0992cbd342ac06d278bfbe7b7692c69512f1c5564ce

SHA512
ac31f4f0e78be3ad2c90fe1393cbf8294ecadcfabcfbfa50b00338a17a6eba10ca1bd9e4b5087743b28c177c230d2e584b2070626b820c8853b4443c3c7222bf

Download Submit