hxxps://www[.]youtude[.]net/watch?v=i50wel2lVsw

Resubmissions

09/04/2025, 17:31

250409-v3wdfaxycw 10

09/04/2025, 17:30

250409-v264jsxpz2 8

09/04/2025, 17:26

250409-vzvbzaxpt8 4

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtude.net/watch?v=i50wel2lVsw

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_232842035\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_285020415\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_285020415\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_462557537\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_680538006\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_232842035\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1120_911623707\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_680538006\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_232842035\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1120_1457558017\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133886931741063053"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{A82B36DF-D9AD-40C7-AAD0-CE5BFB0EDA19}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5864	msedge.exe
5864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2036	1120	msedge.exe	88
PID 1120 wrote to memory of 2036	1120	msedge.exe	88
PID 1120 wrote to memory of 1380	1120	msedge.exe	89
PID 1120 wrote to memory of 1380	1120	msedge.exe	89
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4524	1120	msedge.exe	90
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91
PID 1120 wrote to memory of 4672	1120	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtude.net/watch?v=i50wel2lVsw
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ff8257ff208,0x7ff8257ff214,0x7ff8257ff220
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1828,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2316,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1872,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4268,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4816,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5584,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6044,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6132,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4960,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6784,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6728,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5268,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=868,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6692,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5836,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5372,i,1693359405079561508,4920312833078655907,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5800

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1120_232842035\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1120_232842035\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1120_285020415\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1120_462557537\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1120_462557537\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1120_680538006\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8625e8ce164e1039c0d19156210674ce

SHA1
9eb5ae97638791b0310807d725ac8815202737d2

SHA256
2f65f9c3c54fe018e0b1f46e3c593d100a87758346d3b00a72cb93042daf60a2

SHA512
3c52b8876982fe41d816f9dfb05cd888c551cf7efd266a448050c87c3fc52cc2172f53c83869b87d7643ce0188004c978570f35b0fcc1cb50c9fffea3dec76a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096

Filesize
29KB

MD5
c341e3c977f99e321b05a4c9a7f5e821

SHA1
e597dfdba884b41ba293ecbe9fca33e1256be92f

SHA256
5f5663a1be2c736c48cf810adc9ff4522fe1ed64000a20afae365061b93b4107

SHA512
651951ddb8c5d536d9f1e199dd5f00a66e46b2c38ebadc7d8827836f48e3dc3862d2af1aef6efd634b73c293323de224639ca2a978d67432074072486145b830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
a0414178d966af9bf6bc0391fd7b9896

SHA1
e3db3d64320e473a2f8330f81a71ec6e6d4a818e

SHA256
dda254105c697bcae9a7f026bfa792f5402c1c17e1e9cab95ec665d859a32f7f

SHA512
c573cba3c965e2d81ca9278bb62e36cec74e2f74d8dab1ee071004eb569de1e8bf65a9d769ce45808dc280aef54c4886befe1e8c68f264917cbcdf1faf5cdcfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58949a.TMP

Filesize
3KB

MD5
a26efbefc6bb87c9dd3227a1b58007c7

SHA1
7a09409a4b40a4bb04eeae03f05e5a1f2f485ab3

SHA256
41a1edf758ad46f0d90a63fda2113d112f70e632669f330f27dd0c2311db450a

SHA512
1845b49947d9c19f4c71a96b96bb1f9a194bbf23f51a5e63a89e328ba94160b09015f5da23575bc855338d7c15c9b99a786e4f951498215134995205784e46b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9251308500eb300ad8fe2064707f1ddf

SHA1
a70c49dc896c25f6db1560657b19dc35c2edd1aa

SHA256
1bfd90fe397f02ac6d35aab222fc65fce3901324af7468ed5b6df26a43a3e553

SHA512
34ecccb1c55d70c5445942e0360f5e032dfd168661c73ad96bf5b9f6830b0c79106d28ade4a11487d6d74043a888334f9b7568c721e82186413113c0ef52d188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ca4b8559fd8cdb60842e08cf9acb814e

SHA1
8a93d8fefb9f470c90ff8eb21dbf892338c89ba6

SHA256
74ec66985e62166a091b27438957c957882886b6193554ae760404b8bb4b647f

SHA512
accc89a4e3a3acddac4da36de2a33697cacdb7ad56f9f8bd10cf08170e08efb9ae4790cd1ca0d8aa1256bb47e5b8be72a025f593d35f4e6178cdf91a20f7861f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
767b97a5d5a07137595d16a3b542e6aa

SHA1
392fb12deb3449615c5cb10bc9d47f5c37cc48ac

SHA256
73dbf597bfffd66773dfbcbfcec9ea4c360db69e2adc37371d9ddb36a4c7c66c

SHA512
832d23798f92ecc832edbb5ad8142268f43d9dbdddfef83e8d2fa593c1d4a0170545afe86ac34618a0ebb60ca9adc841e6f294d5fe9d8b1896ba60536850d60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
0c5f4786dcde7cf205de9be14909cc3c

SHA1
0e0e04767a69e982c00be755eebe42f52258ad02

SHA256
1a4d5e420660464429d3c13a2dbdb0436d56fdf994566de62c2560bc5daefc36

SHA512
666ec4a28c24f20b6f9258d9e5712c36d574612c0c61c9e1eb9b83463e15e67e12189bea77262ddecc535ad3532c8f0eb4f5e00173b19a3ca4aaf4572787220a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
481c6dca308c3e346a062df2cb3a6b18

SHA1
c690d94722d9219981043836b0c5576888973f49

SHA256
38b030c42dbe870fef4889b4d0f7f6a488b83b7c128abcd5f6f25c27113b06eb

SHA512
0b35c9bd9a3f76c601594d7b62bd5d113ec791aff260829ba10b2c86f38830f7ea8cf9fac7ee0d2ed80b84d2107c3ee75b9eea5e09103044d7789b519edf3d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
12039b337e5f450873490114d9ffbafb

SHA1
4b774c5b396f23c46dafa27068213b88ff861c45

SHA256
bc6088f08b83f2c1bbe1ba7923fc7b98f458da915a60ebd55478d348da2752eb

SHA512
d2ca54359dc8cccadeb60f48b234954ad0d4a5d92bca074068ae8ad976a369d93c84422517dbaf06ffe9ac985e5ff42623711e7fdd6da0f8228a7a72ac99fd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
519961b19760d371f179a7c248c6c716

SHA1
2c437b25b729495ef5e7d0654b78f68df1e7d9fc

SHA256
8246e536ecd2e3ea47048c2c3a6945a52e67850f8350ba8694affda50e4f0144

SHA512
dcc4a10c6abf257521e7f6392e170c0957734eabaf39753a0d02d2d349446d250589f314985776c51cb0374b467ac7a7dfcb6f8a16574171456a536d806ca5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
3ef96cc8500083186ff2a2ce588cfd26

SHA1
f9d9290c252f94c5fe99c27e4d6c71c2a5085331

SHA256
7296fa47ac4e409e8b5cad3eee31246126a4596bb926ccab84c3d666f9b85a05

SHA512
810856bea9e40e81d1d5adce7598cb84c0384704cc8e41c721720314f0fe8d0a6bf76d15d4e27eef88ffd6fc3a2d657523debab7d326c644f4adaed81d67fcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bdea9e4-0fb4-4382-a2f8-fb885c038388\index-dir\the-real-index

Filesize
96B

MD5
3b556776838e06b2929903b0aa7770b7

SHA1
d9c0c7b9aaebfafc6aee93524dcbbd34ca4aac0c

SHA256
f7dcfdb98dc6363f6a5a72f918d049e673e4a65835a52418d653e72b9e55180a

SHA512
f031284017b42666844ab8dfb723c85fc994b28906c792e9e376ad2d8ed9a591df48b030d20b0550b4563fbc75758d6c8677950c0c4ccb3a73b6ab9016f9cdbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bdea9e4-0fb4-4382-a2f8-fb885c038388\index-dir\the-real-index~RFe5882c7.TMP

Filesize
48B

MD5
5a58edaa50a9d56edb73dfe93f605387

SHA1
ebbabb0b52153b00e37357f2e5db7bafae4048e2

SHA256
c44e519280044479ea30c371ffcbccee7132de88cc583af45a50c2e8b450bffc

SHA512
1290d5b7afd8935b416288063caf58f701231106d672d57fd46cd179ecc3e987d36ed1a9e847a40310c82c796030007dd1cb294943207023bfa3de220ce0f01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\528cba48-1c87-4b58-b3d5-c55597a81447\index-dir\the-real-index

Filesize
72B

MD5
855b740f289dacd94308647aa751cdf2

SHA1
c540d68d83bfd4c316af41e01ace40fdc907fe93

SHA256
d43fa05d5d902099b3bcd541d45bbad5efc6bccc65d592ae54dbefd29ed3e63f

SHA512
dcdba278f770534a345b83d9e7f26ed38c872bf38e7afbf85d49ef8eb0aa64f630722e232a36dae2a5c2f62c28c792b66df42899bf75a1e392216d021db90afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\528cba48-1c87-4b58-b3d5-c55597a81447\index-dir\the-real-index~RFe586b09.TMP

Filesize
72B

MD5
f7728e11f029bec7a6a9dea4df1404cb

SHA1
b063974029d6c3158003888126aa5ac0ae8387d9

SHA256
d0296baf6a0316dcee74af66e09db38fe50244409703834b3f0f684ae4faeab7

SHA512
80568f1645a093efad44af9964be23152f406bd058f9a48285ee0b054086079ad03daa4c761e124012def063a3124c4639fc01b991a86afd51313e7d1bccc36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\551e402a-b44f-4b78-a1eb-9e88f872c0ce\index-dir\the-real-index

Filesize
72B

MD5
4ae2dca43d6b80cd3b0575c9fe98ded3

SHA1
09e68645340ba7ff802576cb1133737cd63c06ed

SHA256
0acdb531fa7beda9708af766472ddc90d52db6378b35a67c6efbe45f4f8c0ef9

SHA512
7deaa530ed17ff7d5d9bc442612e2a85d4f0e66046416565aed7d873c03ef4081ed6cdbd02bc1e892c7794ae1b4c1c3dac660d92fdce19377f1d6550a7c5582b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index

Filesize
2KB

MD5
9238caf5e5651802c07f8996b5717fac

SHA1
621c461695856679172ac40ababa47439eb088ad

SHA256
7f583dd8d7953a1b4e10de61c0d40d26c0f4c3a6b58b3817241c5c9abac752b4

SHA512
bca9f7580fc97efcf8bbc4fe91ac18a6a3476b612965169e182a3b754de795b51bcd399389f06319a62b988755f9f0ff861b7f0a66683e931cfa6c6799826666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\75b67b01-d915-47a8-b1fb-4d0df8910bb2\index-dir\the-real-index~RFe587f3d.TMP

Filesize
2KB

MD5
1f4ff6d9336be2c755857b14f958c415

SHA1
91d65b2208336a482e55538e21664eb43b39c110

SHA256
d40d13ab55ba1359f89aa4f9e4dcd8bb0a63a5e541b22e2d4441ee605499bb46

SHA512
ca1da990e0a9dd01c3dc695c435ef17964e3c503bd4f821e1469c078316fb192fb1df2384a63a60e39d87f79069103b49f47829dae4706a93fd87d13b7e098ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
488eb051350e3a9386cef2a599ef02c7

SHA1
64097b0e5be175c52ba69e929ed88a1d8720a068

SHA256
fb84b3fd79c746882e08d4c0684d2d486d76e8dd2809c6a73f4b0012764ac948

SHA512
e750c7de7aa88cfe11a28edb49f43321be57ca61978633e7515cb84a8e1e8080ff0fb1664b86b2d77434aca80b4f0325f6c63059a473e19a5240dbacf7959b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
fb0343b5e1fc7a3986ad990c22f611b9

SHA1
50621fa52f9d6614686fa75fc002a73ee2a6208d

SHA256
e13535ca5c8cca298dfc53371f9a534e2b7a9b547d4d893a6887d98c0161d049

SHA512
181ce9ba56b8d6ab9720b1d886744147fda0912702641c3fc7d1b592e16fc3e085274cf41d2ca16da7c671d5fa4b4b31dcceb80d0ec48fe929a4359c76e44569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
116KB

MD5
c4f5bcdfe5a38d692505711fc4e5b078

SHA1
b5c8476d13aca278042713af8602a2757cec19fd

SHA256
f500ac8b5a1ca7a1b59f29cd021961fed354efc240ce44cabe22a1be9d24847a

SHA512
93cbddae6601242469d95e8fc3270ea924bd69c6c3e927792474d72bf6388531f5ebe1665584ca61d4b7e5e0fc65747ab504d4bcae211b14bf0b6f9fc2c38f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
65c548283ece1eadf4e09689833b2339

SHA1
c69d33d6f864ecf98e07d04f95bc37ba2e83fe81

SHA256
54c7812328ba019042cd6d588d9300e0dcffaa41fe71af9701e525eb3a6df09b

SHA512
558487c6429d826016a999dd3a796c5bfcc7fc093404d443d5b03f5d6573eace691c16a79183a59181cb0676b08041c9801751228994b4a43239a172d7ac8c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ae8.TMP

Filesize
72B

MD5
3aba5c6f1e2110a39c60fcb86da3bd50

SHA1
9162db0ecd388ebb2265e35d7ed48c037d323cd1

SHA256
cf3c105630565edda1f2b9d5a8bc8a20881df98ef842589cb9a230a24185b89c

SHA512
e3cc6c7a88f3b2ed348203d1513b5decee5b97c213886a37565c7915d98270fe975e2c33e5acfc5b000ae8ec7393c83b954ad173363533751ac5a16fb56bb06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
8147d67456dd1fdb7349cb5bf1e2ad08

SHA1
d7ef9e1f28fdb7adae09824674b327e19066a0da

SHA256
7563acc6eb340fa73c571b8fecd8e22f9a3808ce1adac838dd147df8b71915a4

SHA512
a279a1f27629e53090d6175bb570576d2de5cfa854c40d809203667e517ffe1726ac26300ff3486221fcd00aea5f1b05f6e727095c0c144d01a8f70bd9b241ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
f349f1f5469b734a114145ed4fbc279b

SHA1
a5b5c07795303da504b16dc86f8d9efb91e00970

SHA256
a1ea28badd1a370d80d5a81ef9ae05cde7ac2e055c2db7bde47d8c3712952fd9

SHA512
26641c3c93ec2a8e2568669efc2d4ba8c4fb445a507800906fc74d607a4bbc3dd30bca71e44faf86c4ca89f9311a4b456ee364790adc01408a5303dee7add8c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
51f41dbe9a0da6272227b0684c92ca3e

SHA1
486f33cc89ec75dd032078b36dbc967f2e9dd169

SHA256
eeaa90beec38b98f72b2a6fe9cd7b0c920713fed9c8bb229a6e3e97cf8449722

SHA512
af063924548e5deff405fefe74a97288c14abdbca7ce580445b250f66609259ea686a472ff2c6c73b859315d45e36c9833ad6df78fcfa019cc4ff07a6f729d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
725ca778127a5567b6d4bec90af5c417

SHA1
1b831d826f76fb5c5b5a036a937a5d423e7f1962

SHA256
7230dfe18de3787d18d03ec139453b04150a0bd4066c2bcb99411f2daa34f6e5

SHA512
2802dbc6f8997f1290c118126e024a58e9bfca82a808e4597793ac622bcbd6b653adc83de176af259b15cd48caef88b934496914865fa1d32a899dd454cf0e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
6cc02a0604756f572db2bb3c25f2c6ac

SHA1
2bcd9f8b19f1e5fe2a46d0019af640ba9ab60db0

SHA256
059186f7303ae182d0a08aeefd7a3184ce3981f7d485686ab2834846fe35bb82

SHA512
fba6d8897b3e5faa8df4ad79ba2e006fc98d6cb0d57e539408fafe57e347391532f4d96b7ac69ae9dc202b52674c493ae37fdaaf3e0f73409c68dc9f22c02c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
210cf6b6c8e9f8cf31f68f81ac7289e6

SHA1
a5b002cc21898728c83c0ebede7007834efdc6f4

SHA256
862df22759fd4cc677f1a799e8d2d2bfbb894c1399c968dfb9c14a0bac67977d

SHA512
4b2b3471a573a7c843d1384317a0f72c6501b92d7e6a5018ba2909b13915549ddb24795d530994b5e9e6b367e1044baed6fc3f22bb3557420d4c9114bab29736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
47763a7dda458e9280be83184180f3e3

SHA1
ff73b18132565e31dbefb2d5eca47d2d84277f50

SHA256
cd4720c1a023821226f4eebe4aa460a8a9d35a00896d6a563388cc7f77326227

SHA512
2b1170918342a2da9dd5564ab2abbea12d06c4e9d25f689fcc17cbcce99da311840ab60343ec743b1969f6edfc3e049f1b83d0533b983e0f08babaea3f035b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
52c8b187bf92d26aabbc2ff89543a1f8

SHA1
29bb8d8f05554a5c353658991d32b817b0a7b81f

SHA256
5b59cb4af58ed4eefae478db38c4db906e27e32d1c3c7535f55caea555cdff62

SHA512
18791473336505c965c6ecf44be2563b4ba134b18df2b95b62dd938dfb8191d50a053cb4b1353a56939751a4795184955054f7d46c9ce78ee43e7b02660ae78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
a2f5e59f56ab1c8aa40ac748676a2c7a

SHA1
6a554f0a152b8ea164973925541744bd9cd7385e

SHA256
f678b7dd6eccef32a548c17ad54794d68a9b2cc3961adc90e759a99d5a4d0836

SHA512
fd028a31fe3a69955c01e4dfd4af383238854078b66d68d72b71e4c1f5182ca77a0f02c7b2cece4bb363b35c9692219c02eb08c996d0de4549b2fcb6ea0fe917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5e938be32ccd877bb985bfaaa6c2a8e1

SHA1
d24248cfb7ba072bd212241422a3114aceffde2c

SHA256
ed853ce50fd414ee1b31b04184c3369bf4f601b83dbb8aba2bd1bc4ab8c8d27d

SHA512
1009e34274f6a5141a4984a809e75a70b15d4310194c430096e3c2263f092f22d847f23532b1815037827b731b01b88835fac65f8983fe11119133ba2f11c5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
7d876055bcf3ffd7a1fe9c54495f0018

SHA1
229aeda2760cd908b585bab4544ac93c9f3bb543

SHA256
87accb1b08bf1030cb9fee97c3834020ddf7192c311a59eb078e18a1fbb2917c

SHA512
9843bcb6c0e496f453e8e5e5f878481d08f995e348a5765fdabe9b624085bb364b19e69fab9d9b6f228ea3bbf2c9a792c5dd0e92af65a34fc15ee8f4a0461f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f5d680a5d88c263f2a73cc8e9d2655c5

SHA1
0edb9f89c5a851cc6e631e2b26f7a7dee5cfafbe

SHA256
9029739a65d0b910bb4d4ecb6506d48fda36085d5ba91a4c777ca4b585a2e7d1

SHA512
9ec0627a2c9d8c06ad0f322e9ff6af2838588af3f7b1e3928156b5401366a9543e4c5c46a322f816bee547b877f9c1f75ec9bf81357070dcaa5f8b2a9101e047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
211a1d427910e6a35bc92350995dc370

SHA1
cddbc4322dd22e63679cdebbd02e9b51b3aa4670

SHA256
fb967986df7a4434a39849459b4b7b3dda7f9c83dc8083282551d94df21c2481

SHA512
3cb8b3d4bc1541e434b4fe63d34f6a7b3eb9afb87e45fc363f0215344017d45f69c8603d01e528e0a4a1f1a0ac8485683bdd433e3dea834ce4f58e3299df09c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58abfa.TMP

Filesize
392B

MD5
80212de24bc9050ddb56e852675ab1bf

SHA1
9c582e05caada0935078dce2b9691a21ebd386ee

SHA256
5676a9512d503616416da725e46a12a539d7940c3452518ac62d5cb811506b4a

SHA512
3fe71c605dd4436152b5ccf8b90fc3914de66ade4ef0c848b7786c49179d15cc04708c11e40d99597b8dc24f4c650cfa2e0e3f6d60d045faa031dcea19726d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
3cd9b821457e06e488c5550f369b4b1e

SHA1
f1c1ca9b2c995d67f89ed6a7752c46f9718df06b

SHA256
5f20d4d22bddf829fdb42f3bbc84ef3e056a2393f0ca53faf7b3837bdc1eed84

SHA512
56284f3c07a455904dcdb7edc879bd812354c4132aaed00a989835256ad7d5c28b6500bcedc838bec56244d1554c0125484462e410cce3ab7f9340e40f22506a

Download Submit