hxxps://floydai[.]net/

Analysis

max time kernel
286s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://floydai.net/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
4864	msedge.exe
4864	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2752	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4312	4864	msedge.exe	83
PID 4864 wrote to memory of 4312	4864	msedge.exe	83
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3732	4864	msedge.exe	84
PID 4864 wrote to memory of 3588	4864	msedge.exe	85
PID 4864 wrote to memory of 3588	4864	msedge.exe	85
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86
PID 4864 wrote to memory of 3472	4864	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://floydai.net/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac07e46f8,0x7ffac07e4708,0x7ffac07e4718
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17532658272607662278,10062728370169664130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
591f7cce07a1a8f3ac65fe49e4eb3c7c

SHA1
c91b6e691932d0d77a5c5071a01a7df57e226948

SHA256
d7561adcf6ebf034e6032f4db0b1576918c5a8fef5983471608e64e8ce53a733

SHA512
fdcfef49584d3dc94e3a45a635d1790c0a571e65b4ff9158ee7e3726add942e7c78f2656a3de59a11ce0cdee63636c1593b289ced58d2cb5f29e3bef18dc2a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ed10f05d11d8ce3eeb0261ab61192ff9

SHA1
6d59c56ab440b258099db154f5682bf744739ff1

SHA256
83143296a5d76c830df43d0337e23159b3f988d9af6809b75e4f10795c01f2ce

SHA512
f3a808df54ec5d111aa64505144a761a5e4cbdc6f718f6be7eea1ab59f07f1719df40eac3a0e3a64d2df9ad4e6dc02d3f03dcf208d54eee5dab09843f32e2ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1f8309cc03247d83bd0af260229dfda5

SHA1
c085536054ff2344d7cd664338815d3ad7160319

SHA256
362281b96364416e7ab1026c31a23d29021d414f18a3d726e37dd331aedf985c

SHA512
2dd0837c18d65b3158f7589e39827195796fba9f3df8ac07eaeb2798d3375a9aa78b11dd503c955eb295651d4e9ca1a5c7771ef7e88a69a6948937e55348d5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
78571495331c39396e94cfa7e0e99349

SHA1
f22e84202952580fb5b47d67cc2a919792bb56fc

SHA256
825879d4af1e05fb67a1814d5bb444fe787ff4d700cd9d19c84a7f7ad993d752

SHA512
39c11cbc5ee022d07b2020c27ae2c0e3f888a6d9e3c2c0fd915a0b2c96377a26c939a7896ae31c4f5f633676dae341b34b6f2c4d18170b20e18c64cb0ca1a17f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6a89d8ded95380f477d90b2ca41f4817

SHA1
9b1c33fdebdd0c5f8e0a735d8568ac77e3a88e03

SHA256
f2b1ea184665648f80f6a506faf9d363a70a29ff45c39fee9cfee91c33c5a714

SHA512
01c26510bef97cf43fab60d381a137fedc7ac1c214fa3018dbc7ac4933f940781ae0496d3e9894c3344f54ff2d54856a9d874a573b36732cbede9f3e9feb2473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
727b6070196590bdcb89394ec9d168e4

SHA1
db707ed2aa2a5fb24c43a11ac0024cecf99e52b0

SHA256
57c6f6713b567aafa35b44975d35685d51c096315666502486e533a216269061

SHA512
1738712918feef7b6dcefb0a7617145f04e2017e4851e9a0323c6fb69a3b120ccecb23683c5e8256ac9c899264f8b7cb613e131e14946d6d63f1928e9a7793c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84a13889cd32372bc57145205d9f05a6

SHA1
83a874b7e1426c55cd3e080c4295a35e4c7853a4

SHA256
23dcf7b0844de60598e49edeb77c8e51a6721a98e09f1ade63c5dc3a1e72b4f0

SHA512
04cd1a24b9989a06975c4b8e56cfdc6df4fe4cf6cb3641bcb43223dab4f6a854123d217c0948e59aa9109a6bb0997493a3a0cfb573a7e23f3757feaa66d19ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fe61444462ce9d45a50aa0a85e8f99c2

SHA1
6554e18575fff09c19444eaf80c80b0fae1e49c3

SHA256
f7bfa9b2451f5805a023e156bc7fd16a265affa00b7f58f2792bcfa382bda23f

SHA512
0f0200fb220bda59bfd60063e1f699e26ac43c137fd3f820ab5affcd605f29e0e5d4350883b0eb658d32324210de18de91b5fc3445ec381614650693897d304f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
b79a2bcfcbf3bb65f7f44278e569021e

SHA1
04e5e0c5668ab666f4e106c49785260817c42f05

SHA256
ce323ef5f3aed4464efcd143ccb95ddcc9aa4a5912e75482029fc94f9c4493aa

SHA512
0256d11b0690b977e98046df3da37bea5bad9f36d9a7b7095677150e55f2e10ede5f82d069828d463df879d767f9facb2f7c1790680aa777f2865e91ba764150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
cec184aae78ee005fe0c91d79b5ced29

SHA1
06d9880002c06e5441efecca6c7b90da0c660148

SHA256
8aac4b794aa94a7d2c6265e64f174c8606480c257ae53fc1807f1793c32bd066

SHA512
eebe04986f43838c0c465e15dce2c3a8791b50d1b326ae4fde57503d00cb216b5b5a17f7f1c5e7d1d0729e551bfd404818100c28e6fd16c60824729435292dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d532.TMP

Filesize
869B

MD5
2cbe1f6711a5fb518c372d7853eda594

SHA1
9d02d6d8ede00ac929c9ba43b67081c9985c5ebd

SHA256
6716dcbfb3f28d806494b4034e0f9d87b5eacbaed93415e78c54927c875caa9e

SHA512
f7a50d0b91595ef8ae07771ddd533f9511983dae072d5e0902fefd0c5c7a10eb598fa15dddafa4942c74a607f8e760df3822a2182da1761fa2d077e1407bd0a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
343834e9618a2a4c522d80579c63e865

SHA1
6ac14fdc7a5f999cdf66012bfea529944cab5bc3

SHA256
009e53ce0872f5c29e35773296d3a24aaa8d74c10f839c3def54d2f80b36ea0c

SHA512
9b57b45ad33a04de6168bbeb72cbd9618a9e0ee743fbffe04620ea5fae34cc8d0da44e3011bf18507849e85439d256c1b401b961318df7de90df9a467dcf916e

Download Submit