hxxp://sages[.]sagetap[.]io/signup?sagetapReferrerId=6801

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://sages.sagetap.io/signup?sagetapReferrerId=6801

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
468	msedge.exe
468	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1772	468	msedge.exe	83
PID 468 wrote to memory of 1772	468	msedge.exe	83
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 4444	468	msedge.exe	85
PID 468 wrote to memory of 3008	468	msedge.exe	86
PID 468 wrote to memory of 3008	468	msedge.exe	86
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87
PID 468 wrote to memory of 1500	468	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sages.sagetap.io/signup?sagetapReferrerId=6801
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb26ae46f8,0x7ffb26ae4708,0x7ffb26ae4718
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,12018500569895827334,3058619284679841593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8edf5aee848362b3fa4c7102382947c3

SHA1
0ca71672592fef3c37dbf92a155d747c927b433f

SHA256
16594552785f10884854bf38d179c9c3d26d023a089180bfe5a3ceb03c395e6d

SHA512
a8863cfcea01c05938edd34690db467f0d429f0598528f23392ca7e7233a9b2fe2eaf7b886ac965e22e8c63ee79af84654e5b2f7e94033e5f54622f7b9584893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78d53c4ecb4f237a195804abc28ebb1e

SHA1
5b036abe11431d0c164cc5427aa7eaaa2d8d1580

SHA256
b1ead24150c5c17d1e8cdfaa64b4395cb1b0872c6f4bb25eb8e024ba0e39c847

SHA512
90c1e12b736dc1a644262a44141f4bd7eb5fe935249978d1ff083e39017652ab847107add5b5fbeec6318db181cd22a728938fba7c384c8023ed8e3c03e61496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62f3e9a8-7248-4e52-a3a9-cb6f6710dfab.tmp

Filesize
7KB

MD5
0d5686ce4dc46567e30d6b3fa2d63220

SHA1
1489a3c9cc908a647244775ce05a04c986ce3e11

SHA256
3e73f6fc1c100b784514d3c7bdb75fd0702c1f1a23e29da05dae82c602632545

SHA512
212d226a47c0fe2d98a628e265136729b769b8a5efcf57ee713cb73a62b3ee9d70f372196719cb3c25c5a0dfd81b9fa83182180c191797bc8ba3a66018e79f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
b0b1175fcd21fddb8041eecc6795e818

SHA1
e4ea6793408543a00f5be66013d49fa67ebd1b7b

SHA256
ff87bac79b85d48c309c367461256045a89364b667ed3dad9b18723f60d736ab

SHA512
20de4679d4174104be08d0ddb43ac870cbf03ed52bb9fc1dc2fe9f0fddc6d91ec9929e8a7a22fdc8b00c4caa1d8a1a8f184cd9f66f1e89c2f319b0cb4d369739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
56dc9de52727dda556d884b21d89918f

SHA1
63b0afd0203a86e25e94f00a245399b066a72ded

SHA256
bc3c11733803a1ca7f5eca4e1e4a509e0c91a1afc557cb5d5d01e745607b3c40

SHA512
16c70fa4ed129fe2032e50c3b3899c31761278f05606a206139cdf2b5486beca646dba46f9dad4bca84ab5c5acbe35acd129ca9b2ac299d94d28443276f9a91f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e4568f50fa8e5f76f88918b4b2868311

SHA1
d6acf7527a741ee6668ba62f44897f79a515ce35

SHA256
39f087ff86adede7a144adaaddd78b4b30bb743839a02fcc8ea8a79f16ae29d3

SHA512
31b67956c76e1ff6a1ba450e232b7aaf75ae80f657185ede26065c8a78ee66ed90edc386d59b01a2e2b22d5330beccd1eeeb59ed88bb36d2cdbb33b7ed8077d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
633dbc939b8fed4272ff398064745cb5

SHA1
77a18a56a846fc683096e03bbf1378f0096ed5f2

SHA256
fa6f3f29b418ac8a3930492857f5b5d572c4ae34aff52109a4d81b8c123ebf4b

SHA512
96aae0858d2c58a6487d008996b0815f6315cf50d18ae0a35a102d8e293d2a2b39db36703780a97a5a5c3a056ed988886573c9df9dc9e5442fcc1e45fda0c8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82ae654b53f1456dddf50d5ebc1e11c2

SHA1
b393ff671ed4163ace0ceea00cd58ffa4b5383eb

SHA256
16bf318dbf731fe1c51016c505c47e55f1a2fc891306c19bea6307768ba2b325

SHA512
5b6c4578f790a3942cddf026e09499d2627a1c1440384f1b76d7e2850b9a725ad61871c708b3ab11e372b6ef70d4d2279125a411ac7f2975b8119636fd9b7f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1df3627a174d7fae9a9222a05128db4d

SHA1
5e4fcde2a52b8439b4770da68bdbae76d5801fa3

SHA256
5f681a260d6744c6c2841eb20c44bd5deb62abcd0020303844dbcd14111a1e37

SHA512
df37b3ce3a8aeccc0e4985aebc8103331663cc4689be5e7207c40fa2ae87d81fdeca82e827ac9731b56867c3c72db6689a66f1e575d3913d05fe983de829bab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c6a5823d7fd2d99698e69996b71c85e

SHA1
9759897da29ff8418506e3ba071f9390516c8a6a

SHA256
1b7137aee8a2748095a9fb9da1a83aa35bd68be7470f34ffda72255941733905

SHA512
dbd80bd5083f626e10bd60d7dc9b113f55fada890b8a556af7de8ccb3b09525b9d5c83dff5180bdd70283aa8f4c6e940ab7140ea236884bed3576ab1f967797e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c01c6c4b9e19bf71d92f71cc34bc4c0

SHA1
e2524aa199f33fbde7b27474a08e3823573a7fe1

SHA256
3a3c777477b8f3ba9d0509e42a1e320da520c6359e5863fecf31dee3a1da89dd

SHA512
0d426122fa60dc7704ff073412b2f1fede9c3e85fe51ac4f3b61f99cb484038ba28d2b064c6776c58f7b2ee6f503e2cd4b867045c1526d701869526353a0f6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
822b930f10b0855eb146aff0e7f36ebe

SHA1
93c5bcf719d3dfa692696e3fd403e0ee2c2b3e74

SHA256
f450a93ba18d9db33dba2b1c96696ee0ea00a06280c8fb417890277b3647efc3

SHA512
781a7e04157c1f6e04082c3ecc7bea540209acb798e3fd079f2a35ba66febf285e194adcef7f748644effbff674cfd1209cdf1d05bc1dd9aaa208bd7c70ac458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68084c4394cf754666f08b8a21d379f9

SHA1
d9558083dae8b2972317bed6c3d42ea6d674fa11

SHA256
7c0b1d73e776f3f0cf63f0456475bffe1fc328920a1ba1829d87010f554ee5bd

SHA512
117889f70d04554c87e686a0ea7b18374cc41338c3a7206e918db4238b8601790341975e1fd77d22691525e72b3938886e14fd1fead87b0b10983f9c5495bf90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58388f.TMP

Filesize
1KB

MD5
5a26c77ef4ed0e1e80e442d6b044d0c4

SHA1
041c47d5c7fb240678301090f4f0d6c78f8c66bb

SHA256
d170ed055a189ebc2ed2f58be0952f149e295d2c8528dff2ef39dea023b7a5d9

SHA512
4701d0887f64b18fb217a49ea64e407c3208d1ac84a03439eb99af9a5a6d068b3eb79c7c033d5ebfddf6a72a0b7fdd64f4f76469d18a75fd281dd1959fdc22d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2873ff970d2664be1992573247db65e

SHA1
ecef5338f71981d2e2bf954a2217f9ad985b95fb

SHA256
099d31169206865bdb988c75be95a4bffac9326352af5bbc044c59b40c723fec

SHA512
8eea2f57b8fcbc52fff5018eed81df1e02a8cb32e9fcb7164cdd91224b390686ec1aea3f2621d580ace4c2fa4ba2dc004a70a248b1c5af3172179b25e292705c

Download Submit