hxxps://www[.]shodan[.]io/search?query=oxpguest01[.]neom[.]com

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.shodan.io/search?query=oxpguest01.neom.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
1208	msedge.exe
1208	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1652	1208	msedge.exe	15
PID 1208 wrote to memory of 1652	1208	msedge.exe	15
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2052	1208	msedge.exe	21
PID 1208 wrote to memory of 2676	1208	msedge.exe	23
PID 1208 wrote to memory of 2676	1208	msedge.exe	23
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22
PID 1208 wrote to memory of 2296	1208	msedge.exe	22

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc181346f8,0x7ffc18134708,0x7ffc18134718
1⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.shodan.io/search?query=oxpguest01.neom.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14861961446250098364,10165090606619089559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e97a5cf-8c35-4049-bcde-54d392a6e181.tmp

Filesize
5KB

MD5
5b364b05d6c6a5db846913a15072327a

SHA1
18e7df77982310a3ddc43b7d012582ad902f765e

SHA256
0ec883ec848f3e5cf2168a31ad072161b0d2e647512596805c5d6488c30059fc

SHA512
c09a52be6a6c8965edb3d995dec5d7d32504ac6f10b13ae4b9eec3d0d1039c0a0dc1e78ee9c88b308131d8859f451b0909f890fa747ac67f6be68970d0d150f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a7a5a7dae91fe4640229448f6c1d1c6b

SHA1
9a5869f332ae0d457e428c0926764c49e215e7a8

SHA256
842a38444ca298ba62e1ef29a329d36fa4f180bf9e66144443eef68b931b65e9

SHA512
68c6f4c398a355f0d6e2932df963a62f2d2c81d294785f746ee08424302d44609b325577341309bcdcb15df7051439260c770cfed006776b4b3fc56651fe32cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
27c5513b5ed0db6c280a0c198ed050c1

SHA1
2d257dae17321e176e5e635a296a06f25dfdfe75

SHA256
4c58c9089cae9c177cda21f94ee99dce2f6ff4f5f21d82d98adc0809dd2afd44

SHA512
7045173e1d2480c95b2215aad7c1d9c90d6468a1a5675bc86f416b67d72345e29e93c324571ffc83eb2fb179534f489126b112910c55822a72e51e9292c3dad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
330B

MD5
fa7b9789a7ba4b342d5181c328ceb779

SHA1
a0de5a9d38ac408739e22a99817183bdff7cc995

SHA256
6614601035530bc252b4d9165be5fdc259865ec1b6e58be510d052dde2337fd9

SHA512
4259ac3ea88b1eef49dd450591c412bafeae8d3eb7250f2b21f419be2a65c3de95ad007d1cf92063febae7cdc8b3c0b976407b860deb45ee118a06b0272b2005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d037224162a15b5b93d0bb6639163e34

SHA1
f1173f92998587052256c7e967b1a025677e6f94

SHA256
da4776a9d9ff57748f171ec56881385d84ec1cea33fa27325e5e2556afbcbfe8

SHA512
5f16def1d617f74a9a3a1fa3452d641c3d0dbdb3c7331be60ee264b4ec4d3717f9cb6695103dc0dfd0f2cc7d7b66b7915159302ab131402a484ac0419b32bd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6db5713b9b5794aa2392f00f606c6eb7

SHA1
3a4239e6542eb7760c73cd1f7417acf91bb2b81a

SHA256
870768e19e485c574b4ac4c4ff590f01621991a49091103db15362e29af0bc33

SHA512
ce4dec9a9f11ca3b5fd790d080e6015bdf11a21b1c5e4d159da7bb833031898b44f442dbf89c25ceb19f24663d3009dfdec5e3d9b792418b2b9c5bd2791de045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e2141a092dbad2f5ecca508a7fab853

SHA1
d3de68afb2296ec42a8e12f06d4de7f53412c13d

SHA256
f9acd89e31e74b807effa7e4b10420e2a67aefc4717bb7582219417c71feb96c

SHA512
bcd203a421bd5edc61cfaa1767c90ddd2afddd6e14c2bcd9f9368b117d1925343e9f55e1eb6dd6fa006e285db293eba0528938562bf82b8cad3e7c12fc1488dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6935010fb932b32832749a6dc415de7

SHA1
81b5d1f43184e35f808b7120b1ba5b7e25f06f24

SHA256
5a88cf3e6cf9baee2d61db2a21b7159e2afb530c694270b6342ae8cc52af32e1

SHA512
99642cbcb1e5d6904fa7000a023aa7c87d7a7c8efe34c8ae538106616a730b27c46c79db5a32cbf8eb4be2933c3db0084a211fe2c846eaad65f1ce2a6ae34d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
16KB

MD5
d0f629a12608d9176adb2f66bf5c3635

SHA1
5dc13cb240ee30a72c8fff20ad28fd0e424e12ce

SHA256
ef458d47e2fe49e0099b092b9b03528f9ae4cce73dcfbff96ead98a199de215c

SHA512
8ff1be1144ff4d23fb22e9f67988549c99396166dbd2796f617655409a3dcfad8928338560b1ecf7ebb457043266a2e8fc8962acdb6771db4174c006fdf95b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
faa063c2b7b3ca52cf39c88ae8cf9d72

SHA1
cb5ae17d67afc5e789c5fa4e12a70e0e9e0b6d52

SHA256
e8568980718187119a6ebbfb6ff0e3fc32c6331c492a145e1e62d259ba40f7d6

SHA512
bebe49c8f58ce341ecda3e0f80f5c683051143d386b6326d2a50156a9c4c38ef886c5224fd049f1c34c8fe2ba774c00a6a076b9787d9725db44949629d2555ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
81afdff81c16c9a32886fefa0843e15f

SHA1
4a775e749c12e14b1fa7761da0bfdae6531b62e2

SHA256
5d4e4a9ef69bb909f726c829454a4aea797737b8ec86e049f23bc75849eab9db

SHA512
c77d0a4b547d7987d5e48f8efdc582947a370c4201cad7e5407550e6901af0de5d94553b09d9975540011b8a76aa139f993d19fe127fbe8f31ade0d463c775f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583246.TMP

Filesize
203B

MD5
f3db8d227571d2a2ebd248e9abab626b

SHA1
61557f7a34f4158ae8ae1b9dd902bce60a470576

SHA256
deadf13c07b835623bebacec06cfd958429b81b7f2c1c4245e821c39cd1cb1a2

SHA512
1e869cf99bb04b85089e9f1c4a08b1aee01bdf597fda6782c1d80d149f237624dfbfb5f780776d663c0d00d6dad82435694f8fe81de47fdcf52f8c94ec6570fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3843fc202350a863e77f186bc885ed41

SHA1
12df5f8ece4ba53a79c6c2e8909c7e158087a664

SHA256
6a5e18cd1dc99ff5e8a53866f9b64297d5d778e3d1920dea1c61790ab6686c32

SHA512
3bba88e7f6a028a9e32fd0434efb54074a0fae16a24ef4c7c96c4cc1db87e04f1244194f31dd2c9108d4551f9b6cc2f6f58342ed26f6c2897b518d2e01c4fd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e8c4b736531bb6c2bf466878b13cb7e6

SHA1
19b79a04f7899018ca72e653ffaa423f064ead57

SHA256
b43d556104604d41e7968b455d83dedb6ca20e4f90322d97a2c7effeec081c34

SHA512
f489e5700536020df2ff360e1b36ae7004c23259cff197906fbe6737a5f01616c45b77d0f71e9a7cb2b836a59da2d7e74573a429d4650cb411a51ecac0f8989a

Download Submit