hxxp://c6gj-static[.]net

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://c6gj-static.net

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 364679.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
4500	msedge.exe
4500	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4060	4500	msedge.exe	89
PID 4500 wrote to memory of 4060	4500	msedge.exe	89
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1828	4500	msedge.exe	90
PID 4500 wrote to memory of 1760	4500	msedge.exe	92
PID 4500 wrote to memory of 1760	4500	msedge.exe	92
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91
PID 4500 wrote to memory of 2812	4500	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://c6gj-static.net
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe62d346f8,0x7ffe62d34708,0x7ffe62d34718
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1550512620047269739,15043633744508432839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4605b34274cad387c3cc6f62c3dca1d9

SHA1
7eed850355328c31b7656888679acc51c142376f

SHA256
ecaab319a2290c63f82bd5949cfe21e5ae8087f13e6e6d5be4dedde19863c2dc

SHA512
b3e90bb58518e4aa347dc66a9c3f48eaa699109390fe6f736595f8a19235817c77be81490e733d75cd197350e51ff0d4bf8bb920389cabbfac786b17b1d639b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c82b4fdf7ed128147f2be078c530eb9d

SHA1
4102a4d2cbd4eb829c62359d4475d2b22ecfecd7

SHA256
96c05f8917869856fa5c870cfcad2a782412b9bfab3528e29b79fdbff63907ab

SHA512
02acc7caca75096caee9a29e25f0be6b22b008d836aeee851b8600e8bc302e10f6ae8bca7448fcd7619e7fd35712822d142fdc9a773d44a2cc36b9eddad4dff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94e0fce4e9eeeb6420f57d2cadc60812

SHA1
500fb57fa935861e373d46b79d94a56bf889f7c6

SHA256
3e5e9f7d4cf17d128521ea646ed33862f94d1eb1b13f979c36a6a3ca8a82c691

SHA512
8e90c5677096cce084e4b9d7d3aacc68378325150a5f9a54ef99b2c63794bf35acf2be57194407afd227c5374b9c3ca92ceee60f7f4f36843381745658e03a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a318c22b4e37d54b5b3a17b15fa20bfe

SHA1
13fba4841320602510f78a6d89dc6ab3315cd994

SHA256
f4a2ad2a7df7f63ceb81667bd4069056871d053141b35f94b9059adf23ac7973

SHA512
338fcb01072654eb2984576f077d490f08327c248b9b7e01607369b23094ccc0eaa13094f88c311adde553d504f0e70355ff20838f309a970b2e0c466c00156e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9c36b364028eb2a4889aec7cab98e814

SHA1
b0b2dda65059dd400a908686ec518f7805fb1a71

SHA256
e6a00218891114ed5b098d7097297eee62398d0513ea8c540ebce4d284e18203

SHA512
1ec69ef7fb0abacb1e2082c70440d9e4af723a37468cc54bc28610db38890dd31f581733fb41ea1e8f224952f3f28f1c4730ed5e94c5d553b59183ce2725c109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3a87b03d691b883c3102e229ccee742

SHA1
5d2389baae1af9214a0dddf615e35ae6183ac16b

SHA256
7931ddf9f2c0f0217efff5095c2af1fca19309d41e762ea336a411122a333e74

SHA512
62391a25f242b275d11e6b57337964247045b709603dd73e28b433f6eedd5db9698dd020553c2fe726c74c595bf2fc3fabf5cc96917da99040078aba3b4d6d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
63cc08d8102b3ab9c6e00880c5f0ecda

SHA1
4fea01b25401ef4f6266a198947ec5f5cf81993b

SHA256
f40b67735f568f03ebeecd04153fa8951aae9ce7648367e2690aa7d2d6ad67ad

SHA512
ea66e242b3bb22f130383c54440790146a9bc2629cef50e042cea334a1f8f4d0a658f7e2a58b58e974b125bc94f3ef513fdb4f22870b341551f58bafdae3e8c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cf08.TMP

Filesize
372B

MD5
8291bb7ab7c8c4edae6fcb7dbe4b91aa

SHA1
1b251af6ae034b16b2835b400fd5441a079cfa28

SHA256
006ce8b013cb76abfd218627a6eb36feaebec790f63ceef2458f1a7087e26d1c

SHA512
83f526653425022441a417a1b34940539662a6e540f99def90ab5a566612f1155d794a7a0e8f90a9c9ca576d950751e923d01db05b1cff930344747535993939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000010

Filesize
17KB

MD5
9d94395346f6683bb6b116c66d2b643f

SHA1
62e3103ae9b8d5eca5b64a2feb18d77ce925c864

SHA256
8eca00f18dc0287afaf00f6404d330652a4b1a810f7dae73c774bb9b01dbd982

SHA512
7eef3ff363f58c948a44a88a648be00a788d9fde4e133a5bb136856972243fcb287c32bbb12288c20c2621a19570dc5fef994ec6f761fe7b41337b3e1ae36349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000016

Filesize
20KB

MD5
e8e1f8273c10625d8b5e1541f8cab8fd

SHA1
18d7a3b3362fc592407e5b174a8fb60a128ce544

SHA256
45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

SHA512
ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5a36c964a0c9952aa625daea95fd6d89

SHA1
e25b92c69f10ddcc7ffe974525424abf7c771cf1

SHA256
a24652f46f5c87e9919ef6f0cb20ef55255018dac25bf0ef6727fa05f1be1d99

SHA512
00061eba12767438af6bb46e4845cccaab258bce22a1bf5ed7a57b300ebd97ff8608a849da459ac2248428ce66ddaa90fcc951f8bb4cf0241288691f764235cd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 364679.crdownload

Filesize
2.9MB

MD5
dc29dd92582fe161658ceea65e314239

SHA1
22cbba5817885e3bd99470cfda7a49a7aa005a65

SHA256
e2e0b07cf6f82a50a7875022f5d3bf13ccd0b8e25d5d23a884ad5eb18ca8d306

SHA512
0ca785098d55efa83b1bebac71cc9d926661d67eb0dba85db3afdcf54653c1e9902f74a2e094c1ee1b0645833216b9653e71d354fdbfa5e8ec43ab149c4ff413

Download Submit