hxxp://123movies[.]com

Analysis

max time kernel
50s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://123movies.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
2780	msedge.exe
2780	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4564	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2980	2780	msedge.exe	82
PID 2780 wrote to memory of 2980	2780	msedge.exe	82
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 5100	2780	msedge.exe	83
PID 2780 wrote to memory of 4772	2780	msedge.exe	84
PID 2780 wrote to memory of 4772	2780	msedge.exe	84
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85
PID 2780 wrote to memory of 3084	2780	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://123movies.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10453532378273489810,14854715900319684045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
a9b3ebb37e81328421a614a3d955d875

SHA1
77e8f0f895d6ac828df6b205d20fbe74a4aa310e

SHA256
cf20d4a7fec8b1bd2d3bf9185d23df4f47be0222d50b0b92a54653d5f40758ee

SHA512
57fbaf67386f4ef10431f9e469463551a792db929cede3bd1e7b93ca3a3c1453ecff7ee3e4edeb5c537c36d9aaf3f6d473e6d11d51a1ceff133dd1dd4f41a83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8604d7ed3b90f002afc8e2c8186eab73

SHA1
5c82e4ba3315c7e6dbca62efa803324bd280afb1

SHA256
7ccaec259a0c80c4a826a0d8172b3f9383435dce0d489b0b336aa584a05cb022

SHA512
4e34c86647a3e450d7047ab5990b4590c222ec3f4b451829874c12651a469945ddb433a71ff7f65dc64d1d3c11edd026c23b66c36eacc24b8ae9e05dcaeb7137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b0bbae4563659cd2d8a5de56df0b6d4

SHA1
9c1e161bd2c5c0501bb8a3ce963236b759e0523d

SHA256
c892467563d37fb07458cc773b3ae2fac32a8d99188a318d3a227e4f9a00c0e2

SHA512
42bd44ce89943462b5978b02ae9a2264b84176f1349e4cdc02b006c2c8e654ca71d65eae93f62b237444272ebc6caaa439ab97bec74a126763ba768155dca8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bccb6c67cb51559ee47a8e6da6ed815a

SHA1
7e06b43150ebd9df1ca2b163b305f3c235b5ae44

SHA256
f9e565e343a8a8cd5f9d315a46c08c89759c82ca7785e13326c833d3f8e62710

SHA512
244e54bb2d493890c0c905bb1c8d80c36a83ef187a3e18b8353cf01adac6d1fc82c0b5aa05a6bfaa03c37a0e7149e2ace53b2adfff7613d4090b313562b830c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2acd70cb4177e17837be439020d26799cc1b0f71\383f45bd-7faf-4c1a-8db3-6bed53ad295a\index-dir\the-real-index

Filesize
72B

MD5
7af5cc500453dda3d71fe2866b8d266e

SHA1
3d39570704bec3e777936f20afc3a224ae7b77ad

SHA256
7bad07a763c399a030005cef8bde1255119e63549c75218297ce5a93a9f30da0

SHA512
bd5ecc0905e09d405282bd9d4be5db4f8fe44b179452d728f49bef904f25d6daf9e50bada406747acd744b0c51492c4a04ff404a9653b0690d977db8b8e98aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2acd70cb4177e17837be439020d26799cc1b0f71\383f45bd-7faf-4c1a-8db3-6bed53ad295a\index-dir\the-real-index~RFe57db7b.TMP

Filesize
48B

MD5
d279ec6aac4d139c2b8e8f357a02edd9

SHA1
57b948448c0a722ef6ab9de93bd4aa0c8c992172

SHA256
a100ca97136a0dcf83d82e9cea056ae79bdad0f6d58d1fd217b81e70a765b957

SHA512
60430e8ca67b7db644e07255c2d45fe2ba2f3cf872780c6a3ab0620a31e228e253b095f1766cc170cf6e340ce9f8871f0aeab26a0ddd1ddb342b593d5c301f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2acd70cb4177e17837be439020d26799cc1b0f71\index.txt

Filesize
113B

MD5
74c80069a12eef73d6d233002fb3e5ed

SHA1
47b4bd73e1449c53c0a1bb5d441ce53efc3d5a1f

SHA256
a3f2ff8fee0f9bd56ff1cf22c4c557528c3e93d1075c6554c0049359a36ad52e

SHA512
8c292a237c748bc98aef5bcbd9466f015dce631d59c5331c68ceec593e8be2387ccfaee99ceabf7405597e95260d61ee34350cafb1fddbbd2d4f37f73b4264ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2acd70cb4177e17837be439020d26799cc1b0f71\index.txt

Filesize
107B

MD5
54b71a23baf22872d570551d7bacbda3

SHA1
80ef2c241a8c8b676a8655b0945ef3ddfeb9aec2

SHA256
9eb274edbe7831a5cf6eab2b0425f4f8379d38070057e1ee77d23b155ddbc1c8

SHA512
1a292e6df91eafb40a57581bc5483da5daf80ff6ae54584fc80143e7abb337238a5fe1a79e1720f2d229ef58c9a938d17f00f9ae529c6cd80320018b5394ae6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
96B

MD5
e85d380f60d7b6288d16f04ae67fcecf

SHA1
93ac6f572e1131158254501f52d5816e9ffae75f

SHA256
70e291797dc8fa6b7e7a5dc0f758a622e873b58bcc3b0d32a037bb828836833f

SHA512
13774e6e0b9edf696b144004f51b3c03b458f76b89dbf46887a8bafedaff95f77c0b41f437a4ef9e1503db9faef9df170f9c92d6d1744fe5f8b5ab3dfdf56e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57db5c.TMP

Filesize
48B

MD5
c7454a599227b53d0dccd6458fde12dd

SHA1
b407dda3d934784a7b03fdd673fea5bd2a124b16

SHA256
b922c505cc6b425164f6b7f0a24b545f87a07edc4993d425f0d9c2f83746eef3

SHA512
f4bf77e66a1186c2d5c71ce7841bb1079da264926885a8243b033fe98ccf68113d53d6522428a8778c74f285f9968d8d598744c4fde21cbaabbaec5903b8fda1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
2e80c3d5e5c1e5afa63bdbecac421c1e

SHA1
9841ed0027267b621169305cf21c6f648ba74590

SHA256
4f1eaf80974eef10987c88a7003a3049b545110d181253a99edf904eb1b802cf

SHA512
774df004d299405db39c821fe4ffbe44356461b249367a7de76f1fa09702fc3469ee16e62673c362507c2e2a24a677009feebc814d5cab6bf74b674a08509010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582565.TMP

Filesize
700B

MD5
1cfa0bdd9a2a6e501f30172df2fd1cc7

SHA1
9efc9256f1dc42b3c859b6c4deb90686fb151194

SHA256
b3269af59e11172b7e26517699fe512c780e65bca63ace38dacac857bf45acec

SHA512
1cac7b7cd17d91134b122a4c843b2b7d4b3ab935f52b0172dafe25c64e87867748ff285693ebc994be57134b86c80dd195bad0324a19bd050179e71813ed2cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
90274fdab97c6e160cb60520d9d07c9d

SHA1
e4603e4580935de52b81601ba902d3377d788971

SHA256
496248a46457265278ca577f97bb10eb3ad0ac9b17f0c853cbbc5b46163b89d5

SHA512
813af0b032f76ce1ee7d6e03a977a39a349c24fdf70ff7ce2cba3857d763b33d5768a5fbb51f0a5dc363439c1ce417a8673689d7671e6d663b280928325798f3

Download Submit