hxxps://www[.]youtube[.]com/@HCP-TZ-202

Resubmissions

03/07/2026, 08:35

260703-kg2yzsdy6y

18/05/2026, 12:42

04/03/2026, 10:38

12/01/2026, 10:51

12/01/2026, 10:03

08/01/2026, 09:30

01/09/2025, 13:26

13/06/2025, 10:59

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2025, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/@HCP-TZ-202
Sample250613-m3fc8avms3

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_799341992\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_206097144\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_206097144\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_206097144\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_799341992\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_206097144\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_473213418\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_473213418\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_473213418\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_473213418\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5856_220081422\_locales\lt\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133942860040654873"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1153236273-2212388449-1493869963-1000\{71347302-8119-4CE4-9F01-3ABFF667C772}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5596	msedge.exe
5596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5400	5856	msedge.exe	86
PID 5856 wrote to memory of 5400	5856	msedge.exe	86
PID 5856 wrote to memory of 3056	5856	msedge.exe	87
PID 5856 wrote to memory of 3056	5856	msedge.exe	87
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 6080	5856	msedge.exe	88
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89
PID 5856 wrote to memory of 3712	5856	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@HCP-TZ-202
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7fff5efff208,0x7fff5efff214,0x7fff5efff220
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2204,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2596,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3544,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4924,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6224,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5164,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5784,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5632,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5796,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3464,i,16784797554464774907,6295549703022254798,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5856_1882691787\manifest.json
Size 176B
SHA256 7bd96fc0239229d64cc38693c64f2524d95711534c606b2b39957af8411d870a
MD5 e7314184e67b4501f5048c2e5f181d96
SHA1 f741a8a1b8c18c8d4974f937ef589b134dde5419
SHA512 773ff8228cc87677e3f74667b61db59decfccb6ca4da80a5ac5e0aff0e3102e08e6c1561df35b9ed64c8b7db8dc8ed27210c2ca0139ec85d17f9e3f57018a086
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5856_206097144\manifest.json
Size 79B
SHA256 6722a860c855cf94a54fd1ffdd3801c4c949f5b67d8601ad300264931057f2bb
MD5 89217e000f3145a2523e43f947208e79
SHA1 cd7915d003ee87f2babc9ee9add12841022710ac
SHA512 385257ef9c67d80006eb350ac79718f30e08d810a1568454806f2505b482e0093f784d0d4cd24078317f863db500898343ce69391c0ae7fc767697f6da38eeaf
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5856_473213418\manifest.json
Size 119B
SHA256 19f33f04d5ddee763e31b83dcad5708824804b05d1271a1c19fcae37d289c142
MD5 293fe80c5a8d993025071817a51068eb
SHA1 fe6db4fdbb16b6b5bbef24d1a109bc9467fe9858
SHA512 cfaa625b81e64a852e93bbb4ebfbb8784fedf0ae1d5d3cb9fb2f74072b5e28214a4d8dad02a972eac1649975abc04810a495bc623915c64562c7e34b5c4600da
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5856_799341992\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5856_799341992\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

8eccd676-095a-4028-96ec-2d072f0acf2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8eccd676-095a-4028-96ec-2d072f0acf2e.tmp
Size 40KB
SHA256 6fe8dcb7770ca87fa080fbf1ff1ac2e57a0c52ebe949507f0ca52c35e254d4bc
MD5 2fe3d329962617d2d0ec9154c2e21001
SHA1 02dba7cdb63b274da92b80205d983b07eeea3c2e
SHA512 58e6239280b8fe95433fba8448091b2f4355af8db746ba2ac769c990b44af13d4b3e59d2842731957657dcfdf1b052a5e028992cc565790986e79f36268bfdd2
SSDEEP 768:yXQiE6esE8lDldUGz3rwgHU/Sz3hihFyGig1Y+C3JHH7+Hj8H2mXsHoV533pY6ko:yjeB85d73lySzxiWsC3IIH2WJY6ko
MD5 SHA1 SHA512 SSDEEP

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.20\autofill_bypass_cache_forms.json
Size 175B
SHA256 b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92
MD5 8060c129d08468ed3f3f3d09f13540ce
SHA1 f979419a76d5abfc89007d91f35412420aeae611
SHA512 99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.20\edge_autofill_global_block_list.json
Size 5KB
SHA256 079c7693884fc076b19f609bbf7f9f00c2238e91267748a1286f6048c6530a60
MD5 fb107ee2ac829d6b098f794f0aa9acb8
SHA1 2931d4efeaa747070a6f8f8b30e3136b492dc4d9
SHA512 a94a154aab818efe95b8e64b0eee8a4bcefee0d283f509a1ef191ca7aca9653a3369677a01e7e04eb3d47c2f34629b164e77609ead7d7acd7be13e7b78b07004
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lydMsSb:MYL7O9FnLk25+tF4B8K5b+QiGoztWuDI
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.20\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac41191dcaf36d91f7bd9a077bc59b1bd7218daa27b263d1da6a548f58264987
MD5 36326fcbb6119326e7c8aa24c4156548
SHA1 ed128a9727e1d58b970e732b8c66fc827b18372b
SHA512 ed5c79f1edc0c65a1cf0ace91ea5538245c1569c3b25ae3cdf033ffcb55d37e7b09baec36570e82fc1525c24224cea08a53abab7e52db6376f48f099ffefd1fe
MD5 SHA1 SHA512

Submit Download

030e400b-43ac-4168-9c70-cfccad29c7fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\030e400b-43ac-4168-9c70-cfccad29c7fb.tmp
Size 36KB
SHA256 c61c311a82393012fd46189605dd872736c88048dcc2b84ebabd8f08e6675204
MD5 01c4b8e359a3393e4de1dabc53412cdc
SHA1 eab1272c043b9d7219c231ef5796d163ed8568c7
SHA512 a0ca76ef55a685171fe6a31bce8cd59797e298e4ce30b7f6fc934558672f0e4075f8d23ccffb7dca87cba62ad43b0166caa64babe099e1def7d9f7eb1dcaeec0
SSDEEP 768:N3tt5TP7pLBLNyIWFIgYc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvs+3Ll/tAwSroa:N3tt5TJ9NyIWFIgYcu1jaMs+3LFOwJuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 31dc7f3937efa879e0c6789bfe15c845d925d6f4b8ae897f0984d7d1c8249fcb
MD5 010f88bc062f40b589dcdaaf9d111063
SHA1 4ff131efcb009735185da8c3bcaeec4b2a40eb14
SHA512 1ca8475bd7b3761664b35399af0dc6c812eb916f884d31f68c418cab75967cde6338bf091e9dca27676a4094b6cb26b187df99a0f8e9e5a7f324fa8481d767a3
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5811ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5811ce.TMP
Size 2KB
SHA256 72965707f2d6619ead8e0fb339570dd2d8ba12b3f1ee921ea68ecce18643ab35
MD5 d266a6474a458519850365769a66ce6d
SHA1 bfb54cbb0d37f7769211b3758653d897956705de
SHA512 4d96712f858913186649b5351b3319a5f12d59745a66cf6c69726ba8ca07fcb58078ab270fcfd7ad831d9877bf17df60dd544bb751333f930b4cdf508e0235aa
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 009739f327f486a6be5aa70dcea4bfcb75c4481ad260905f68851fad57f4ef4e
MD5 409a538d5fa9d92513143cfb9c55a579
SHA1 6a9a4925f67ef6de17b5403b0b505fdec1666121
SHA512 82d249ac5534258416de9878ffb6cafd61507d1685c42b66204bc7ec5c4655f8f4c63603bbf4517813f05fe8b7052c7244e80a1d1ddaad762b89082239fe848a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9aa8fd39b871e8afd8f9152ebf9faadbf41dd0053f8b22c7be80a4902935efcf
MD5 fdf1a3fa99907a2ac56e0150497048e0
SHA1 7c57176d7c4a5cce15e62c6fb0fd9e5336b20173
SHA512 90fce266979ebf79cad24f67614f26d5716b19b94828571257c73c6fb49b37e943a32ae307f7d1646a90f49f67fd388d6353914c1f0febda9603d800c2f50b75
SSDEEP 384:sVPiLqhMUMsOiGXd9LLPU0G7a4HSDo/gpOobB3As:s5thMU1md9LrXca4HSs/gpOobB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 baca68429f24e252f6054c40c4105041c8b7c75b65e75e0e84cbab405b20e082
MD5 d108ec87d2e6eb8c04cef79a81585fbd
SHA1 a33733a5e8b126c0655d92a436b9ab61740303a3
SHA512 8f9174eba2144721a8341acbeabf94e6f2e01f921138e78e3088759fe3b823d07c408e6992807cd0dfb825e40d7eb2c57b2323e481190e14189dfe2c99e9232a
SSDEEP 384:sVPiLIMUMsOiGXdjLLPH0G7aAHSXwdgpOobB3Al:s5zMU1mdjLrUcaAHSgdgpOobBQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 d48ed6d1a091db20b971315e68e06941aaf9d6445b494f5befba7468b808fdf1
MD5 9c3bb7674b177ca40f10e44a56a9def7
SHA1 abc0137df961502127c92e2ceae556c80239dcef
SHA512 7d47018e5f0b4a4422d789c01c268b113c81979123b7e426eb1a07afacda6143b4a1cdb83601e68092bbccbfd44b5a22787c649f7ed6c3a0cfa067c6ad5249fc
SSDEEP 384:7jKPTZdJUl4Pb3dRbIxsD6HeLX1hdgBsD/jhdXsVQc:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 467B
SHA256 ba2cb38918905f159a4d26492ad525f1b46cd32a9915a90edf3745764d46d867
MD5 fb92e9510c06c4722db889a34175f7ba
SHA1 029bcf51e21bf18b292918300767480e5ea9275b
SHA512 af4074c9173fbf6da8719136972f901022fa84ee1d5b3ae1cfdb5fa10c67a8b15b82e92ab2088d254e8da6933fb647dd7e4433025d041f11c465c5d9c34c238a
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 900B
SHA256 14ea8dfc1f82b95924db834243dadf17b559de175efb7f0b630ef340d9197f99
MD5 363b13b7fb5353c9eabb0f279143939f
SHA1 760e9cbfd0ffbf9e9f56ac906c1619a6fc74cab4
SHA512 d538be363ebc856f24a6c85b8af5082426a5b1762cf3009f7120ca7ef97fa5144d9ce56c5f9fbd6eeb91f9b2a9040300312bdf831726b2e1db4c1cc3fd9c4444
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 5KB
SHA256 adcdaf95b9f8b2aea0983b0ce86287de47c68b7049bb7d0632192cbb9542771c
MD5 f81f00e9aef88cf66be2f8a1ee0fce62
SHA1 f5313aad314f7aeb3d998c9c75651bfc14efe58f
SHA512 236927eb50f77616cf392f1d0a1ca8ba2e8a5cf51d5ca225c7c6c61974049a9b4a0fe7c93ac9d276c8ddbbcf42fe86045c9faee3cde1d381d1538ce61cad47a9
SSDEEP 96:K5JR+0+IC+H+DQ+B+XST+STk0I0ZeNcUyn/xa7VyG7uw5TR4owF:K5XST+STktWejypahyGBFNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8acb8b1b2c7a4c15d6ff5c19908ff15f11a5fad5ba2647dca067e91c6032c332
MD5 c100f08ce0400044fcc5e0f43c03570e
SHA1 92db3f97c2c91c547f4ebbbf9a55a533ee691b4c
SHA512 bb9ced9e5f9388c1ad5f2594e02b4c01a38c9d67fcc34be430dec36a4f81f0c85e7083d514e3bc265f53b9da92b1f57ad8f29ec59eafbfb111a1a1422417580f
SSDEEP 768:OQiE6esE8lDldUGz3rwgHU2U3KhFyGig1Yc+DNKf64Yw2mXsHoV533pY6ko:meB85d73lXUaWfIf64J2WJY6ko
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 c91213686a5ac3d58a0ac2d8a629bd6328468d63297c65df34c497a3f99551f0
MD5 8ffd4f974e4755e6681f460cff87394b
SHA1 43e1ef1daa1a47857e83f5f7151603d63e9a2ee7
SHA512 20c51c653088e0ab4c88408668eda917cbaf9ef9e7a012e3b4483248bc78b15cc2f8f46ea093a87a0c4583fc7baaaa698684ace773e41c55c2214926f2c207ca
SSDEEP 768:p+XQPE6esE8lDldUGr3uwg+U/DfpwhyahFyGig1Y+C3JHHT+Hj80f/e6dpY6I4tP:p+ceB85dj3LyDfpIyaWsC3II0fm67Y65
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 0b2da77c611c1becc283e057ffb7a01164de1e48049664397ede638504c35b5d
MD5 91f7f060b702671239cc742e5d98d192
SHA1 9cd22df2459fcdf418d7d412fea2196659e0f85e
SHA512 b3dd8c1a3e3ffe30d0b9ffdebd2ebd9ba006dc18dcf5ed576f1443dda4139b217d5765826ab09fe6cd92ecaead6b4e41113faf4bf34f1850c7775a85100d5a29
SSDEEP 768:p+XQiE6esE8lDldUGr3uwg+U/rfpwhyahFyGig1Y+C3JHH7+Hj80f/e6dpY6I4tP:p+jeB85dj3LyrfpIyaWsC3II0fm67Y65
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 53KB
SHA256 0faddc2013bcb811a7b650eb8afeb1c56db86442cb3781732ae5d41fd2603e94
MD5 2f970f10963dc7b9313c6d38403a890a
SHA1 8dec2eac9cbc88ee7ef3fbba79aff99424250015
SHA512 c24cd03731e3febb3551c464a88156775e2055f7bf4cb16ffba6df3d8a6a8f0e0db8c357ad74e99729bf52750656b349932e6e0816028d19db965d5c9eeefc10
SSDEEP 1536:p+3eB85dY3qyDTpIyaWsC3sI0fm67Y6R2Wt:jB8KqSaWsv/cO2Wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.5.15.1\keys.json
Size 7KB
SHA256 f967e18d5b1839ba801212f032e7e6dd92f7ba6958bc3ae9b122d9fadf2b1bf4
MD5 03f15dff10ac451682f8a308674ddf77
SHA1 c723e23c49bed8a52b8f947b2cb8879a110fc94b
SHA512 df8fdc89cc1e6f2edce49b41bd9f71dc7f7a8daab40f1355415119f9c0a0d5067337d966472ad49f855ecb9a89bee8d1711d8a869589a03e469530ee8d7e0f3e
SSDEEP 96:UXq6pG2GE+Vy2+yzdswsDm4+m0plhYvPuW+wkpTm+ozdswsDm4+uTaQSfmXAgz+y:uNtGbVKyR9Pm4lOvMwkoR9PuGMXcy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff
Size 153KB
SHA256 fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff
MD5 cc05ed3e66468e692745ba6563c69740
SHA1 eae9dbd4d36aa91fd43f7d452ac3d252b103759d
SHA512 4b527db02d6ea36b914558a3e44fd3d15772bf2be4ba0a640bf70427af07dcde5ed6967930cc3624a244cfc82290f125eea2754812586216b3d5a37757ce8db4
SSDEEP 3072:dMO8I/Yce/ywr7jDIbm0l4nbcFyEMz8sCMuiXp6amLWlFCnr2dTP:d0/7Hz0lC5EM5/p6amlnidTP
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 05fbaf011e567c700e0317a776ccbf7f955df6156a319f9d9a504b8ea9b63f34
MD5 82b5126df6ee9698a73d515fc5402585
SHA1 d22cfd48214f2ca0e69e393bb2201805ba67c898
SHA512 7c287a6b22ad78268c36c22c889949964ac52e2c00e8f7b716dbf4b336c423b7d58cc9c1147d162d812de42ca9e865f6c5e18617d950951ac3dd4882a95769f3
MD5 SHA1 SHA512

Submit Download