hxxps://midawek[.]xyz/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://midawek.xyz/
Sample260730-tyaeqssbnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299025089259014"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9B6AC68A-838A-4CE2-9B91-45B8A4B66764}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{6BBBE087-54CE-4663-BFFF-F86E524D0E58}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2500	3212	msedge.exe	85
PID 3212 wrote to memory of 4384	3212	msedge.exe	86
PID 3212 wrote to memory of 4392	3212	msedge.exe	87
PID 3212 wrote to memory of 4392	3212	msedge.exe	87
PID 3212 wrote to memory of 4392	3212	msedge.exe	87
PID 3212 wrote to memory of 4632	3212	msedge.exe	88
PID 3212 wrote to memory of 4632	3212	msedge.exe	88
PID 3212 wrote to memory of 3828	3212	msedge.exe	89
PID 3212 wrote to memory of 3828	3212	msedge.exe	89
PID 3212 wrote to memory of 3828	3212	msedge.exe	89
PID 3212 wrote to memory of 3284	3212	msedge.exe	90
PID 3212 wrote to memory of 3284	3212	msedge.exe	90
PID 3212 wrote to memory of 3284	3212	msedge.exe	90
PID 3212 wrote to memory of 2576	3212	msedge.exe	92
PID 3212 wrote to memory of 2576	3212	msedge.exe	92
PID 3212 wrote to memory of 2576	3212	msedge.exe	92
PID 3212 wrote to memory of 4272	3212	msedge.exe	93
PID 3212 wrote to memory of 4272	3212	msedge.exe	93
PID 3212 wrote to memory of 4272	3212	msedge.exe	93
PID 3212 wrote to memory of 1568	3212	msedge.exe	97
PID 3212 wrote to memory of 512	3212	msedge.exe	98
PID 3212 wrote to memory of 1568	3212	msedge.exe	97
PID 3212 wrote to memory of 512	3212	msedge.exe	98
PID 3212 wrote to memory of 3332	3212	msedge.exe	105
PID 3212 wrote to memory of 1828	3212	msedge.exe	111
PID 3212 wrote to memory of 3064	3212	msedge.exe	112
PID 3212 wrote to memory of 1408	3212	msedge.exe	113
PID 3212 wrote to memory of 3524	3212	msedge.exe	115
PID 3212 wrote to memory of 3524	3212	msedge.exe	115
PID 3212 wrote to memory of 4644	3212	msedge.exe	116
PID 3212 wrote to memory of 4864	3212	msedge.exe	117
PID 3212 wrote to memory of 4864	3212	msedge.exe	117
PID 3212 wrote to memory of 4864	3212	msedge.exe	117
PID 3212 wrote to memory of 4768	3212	msedge.exe	118
PID 3212 wrote to memory of 4768	3212	msedge.exe	118
PID 3212 wrote to memory of 4768	3212	msedge.exe	118
PID 3212 wrote to memory of 4800	3212	msedge.exe	119
PID 3212 wrote to memory of 4800	3212	msedge.exe	119
PID 3212 wrote to memory of 4800	3212	msedge.exe	119
PID 3212 wrote to memory of 4212	3212	msedge.exe	120
PID 3212 wrote to memory of 4212	3212	msedge.exe	120
PID 3212 wrote to memory of 760	3212	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://midawek.xyz/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff81128c188,0x7ff81128c194,0x7ff81128c1a0
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12199285736526627091,9343903625610487478,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,3765141575591860587,8607809290351201441,262144 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,2810918168177695572,2372725983681139263,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,2408145298766551903,17664789931116202839,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,18217161739486921913,17247901492145252454,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8383880317637733524,13079057977518380206,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11611145015585113287,18259696552815930608,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6348489043797353123,6790132423145771908,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,4408306352263726815,15657737883087559868,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15553477530724295657,14688828851743311671,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15553477530724295657,14688828851743311671,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,8389741171473478738,10438823569979230576,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,17931279712560047902,17250295762009949593,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,12998510300931563022,4648228798309217685,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,667639161231737253,3198876420512278434,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,16417704532289241395,533730648766416709,262144 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3340,i,17768214068492484934,1717441599207959891,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5260,i,7160742599556761372,12963505678325816231,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6536,i,1904954722207359828,15570748765424805935,2097152 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5796577615538344964,15188908424837606259,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,3226557613740481606,7371102315900902588,524288 --field-trial-handle=2144,i,16661138209501342035,4928590457513412501,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Modifies registry class
  PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3bc6f5c22e10305be021a6318b0eabf0a6abf49a3bdc5b39af41db7ab0278e3f
MD5 04168e374d81980fc5f3466ce4149565
SHA1 292f2330e00859ee9546278a7256f137039595ee
SHA512 87855cfb3a78e7d87b2345fa049ddcadfc780ea959a15238de760aadddea6c61d083e45f41ffc37deb36919420f10e888485a11d7239e8afc3ab6380c8ac066f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T132B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 326e02a5d71a3fcd9b96f786287403488e12c272fe92a7044235a73bcdc533a6
MD5 72bbdb479c61929c7576d30bb7377a88
SHA1 4c447815873119b6788bab724908f2d76df21a1c
SHA512 854b332631de10dcedca754f2aad7645bc3f3bc510404d3c823bf5b1b2e5d23e3810e9c51dd57413ac1e7fa479485786c1cf6666e913688873797c1d55b9ce9a
TLSH
T1347171F83151576DF73042B1ABEE02617435BAD8F847BFAA2060A876490DBED7C1C02B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e31.TMP
Size 3KB
SHA256 a014330a91573300d7564c17fdf80835a3f42990b149c2339942653b7fbffe50
MD5 9f035f73c99aa810c1ba3049432d00a5
SHA1 c3e5a18317ffddbff325958782c8f66336fb5a06
SHA512 8ba10687c1b045fca7d4a383eb5cbc3df36f49defc5b926acccc2881f370fb8a4ed3cb4df3c179d2c117d9d2d37a1a7e0a9eb96121e1ad5c800f5110bacf9a06
TLSH
T1DC7160F431111B7DF3300271ABEE02257538BAD9F4477FAA1064A836490DBED7C2802B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 72KB
SHA256 f165597b775a59b259620fc0bb2f734e9b66370ac13c8a3e0e21a87df9b68899
MD5 6d788ba934d1d14d4bd925fa609b84da
SHA1 787ad6b499ce79227bec2cad989ef6bb1b95f80e
SHA512 2fc4a23dc5b811b3a98d885d77236b75f8bf35d1307371bc61833332f01e3f447af335e7e851f1449070091dd0b6e5817e9e7103b137d33f95a476e44672fd62
SSDEEP 768:7SeWJkTZPRTJnCfDBvRVIck2MGxnueq0Zu4RaeKc+6Yx8DB08WgeADCGlS27LtL0:7Se6BHVAmx1uglS2XtLeEKP83SL/
TLSH
T1F173A41F46D45EDAC309C1F248254FA66B3A1C0668D860EFF4CA766EF977A901331E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 97565b0ae04c00c1b1ad60eb93dc0fc2934e40847672c273efc641fe72c36b57
MD5 672e3e801da42321f51a3cd25272238b
SHA1 6f291c3a26c404bf6c0f596b2767ed30b83bc630
SHA512 3b06c98513627e0739e1e639ec9a2e4487e1d5363dc4784fbe1d6a25bd08bc0358c6c26fc9e664cd78cacf2689e0244cafa8ebc02e7d69251f9cc4efe6feac2c
TLSH
T13EE0202CC8C9C26F516464EB55347B4DE5BB651FD7CCFD460F45CC107046548E66D1D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3eb67c134e15e4cdd8cd3dd4f8db55bee94c4f3effadb2c4b56829cadacb6ac9
MD5 d59a02741664fe440fc7deb0224a622e
SHA1 b9663273387380c2d563f21d1eb872fa75f985da
SHA512 8783b9826525dfbba89aadba78ead8a9ef5144ca4d9df310025939ba7cd556ad66d6b0a0ee18d2de39c54361faa0c5a67b5082083c6f504549aa113e0cd41705
SSDEEP 96:DhOu1euquIuau63zBuEMuLuturu3uBuk7uIuquQadu8xwQ:DUDHF9V1VMiK6cKV7V9dad3T
TLSH
T1BE8157E7C7E4877DD81252F5A7242E1BCE190A5843283E25C9E5DF4BA3E2170F109A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 82cbe6588e9821dce9c0206cda5e951831755552051f75475abd9620348c2b77
MD5 5464dcbdefc1965dbcef11d6a22dd5c4
SHA1 a1d1bda6f91110af176f07cee972d658586a09b2
SHA512 957e318d5d310d4c5dda420527de3b545d6d147fac0fb6c4ddc981f7df872f30c279197e503d22ef619fadab370572cbae8bcf8ffb3619ae182a898cff1699b6
SSDEEP 192:sxZKRvyM/jK1Ml8MkY/fysjz2VOIdpgKHW6+WNfyG+/YvpW2DipIgrJ:sxZKVMY/fysjzCXHbU/0c9
TLSH
T10A42E816AA345977CCDBD209FA55BF53D6F91472E2901E44A9FCCA0C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dd8d6d0da00f88541be284be1dc285f224c6300bac1e9c16de18605bded71f6c
MD5 e9cfa113e7323ac0341d5962a50b6653
SHA1 1364d8eaa5fca0b80958965c51f7e838f6d05e91
SHA512 93ec38c20e8d8dceca25f44ccbdc9cb5354a91ab08b9f024acd0f6cebde94075c9a81be9bb044f1d71e093ee47dbf0725745d26b92aa0db780139397948f0150
SSDEEP 192:sxZKRvyM/jK1Ml8UQdkY/fysyGFVOIdp2FHW6+WNf2TXYvK5wipIg5NJ:sxZKVq2Y/fysyGfiHbUX6cF
TLSH
T13552C716AA349977CDDBD20DBA41BF93D6F51472A3901E44A9FCCA0C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 725e91ec7c8a9db1a6a36d8af03fa5a6c2131197ae38c58be3c6bfc47cde758e
MD5 21ba39f5dbb1dbb2fe5324f0dc560910
SHA1 a385fdfe8fafdf682a03fd4d46216d674758d7fb
SHA512 485cc3f163530a002a34edd781782e1efb213ecc41f40de0bd68003ec8d454280b2587c872083b85d0cf872199279cb51ceb3c3dec18c6664ad78716ed7484c1
SSDEEP 768:9hseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppCrokl:9hseJ3xWvhfwnu1jaVcL88pZW
TLSH
T1B1E20B2B680CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 24e0210137ae4d95f41f7d3c1684e837e20859b8b9668868f5b7f923a24c921d
MD5 c956e7b22aa36a6ca1f0d4e90fe6ba78
SHA1 4fac0a03704609eee6f70d7dfbb0da77cd2e6f52
SHA512 22c7848494f1e2c86db73707d23b5b455416f78848f37d29038fd7116c95478537791cfb768878188f75cbc945e1ad095157847d0d56787016eb92a87c2efe3b
TLSH
T1DFD0A7E325A0468982B45EE42474B15DC50ADD4A9C81CDA85290B1103175E13C656D6D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 9d34ba4f820632bbae2c0752e7f5bdfb04019424860a0b71b774b98a7c5c664d
MD5 d528d0beb0b227c8b838202475949c40
SHA1 78a0afd82cc5889792faaeeb80706d0eb5144526
SHA512 1bb24a5a1750d4867be8b25d76088b143bdc51b462f85913e3efd5f40d7384a7bb42f7e357ac53df8e10f70ac5ed0b563488dff134c255e2af5c3810e9f97bfd
TLSH
T16CD023D9C27085474AB09FC45038116CD417CC4BD4C1D8D47545F12230FC713C143DA9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 de5047b24b0c40cb3b2059d4758450df204caf18c8c05df79a68e849f28061d7
MD5 2c0f6a4519106ada58b3f0ef6489ffd7
SHA1 2306bd3acf915c1cdbb6447fc8b5e896d8773ea1
SHA512 3f16fdea64645981e91e9eb1c988a76bf75259c6eb330dc5f7d1549c6c05e6812918fcce792782960f393f53c38123e2004ddefd41c235d5f8249aba877e9655
TLSH
T101C09BF7551486CB86709FD41034571DD51BC54FD4C1CCE4714591113079A2385825A9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a45a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a45a5.TMP
Size 137B
SHA256 c97891b28779b115891314b7c1460c6914638b92dc2eb10a682b9243565ec61e
MD5 6f1502a07870ed83d0665656905acdaa
SHA1 e1897ec8dc9c202de92842b3d34feacb6d326dc6
SHA512 805b66f427400e0d94bb25d7ab3d08d1e21a5ec875bb8f90bc897d0aa66188caaff911ece232ffcfc126f971dc0a18ee658f91ec8a689a040b545334e8c1b027
TLSH
T17EC09BF7552486C747715AD51034575DD51BCC9FD8C1CCE4754AB0113079927C5415A9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f2202a39d37f888bafed92ecce80357cf127f7a9dfda6cb1279cfaf442d9beeb
MD5 7ac75d147cf91cd9a5343c17ab05b9a0
SHA1 0645da75f59a339eeceb311916624ab422b85bdf
SHA512 7964fc891a013ecb907fa7dc5ec2c3383c70d201febdb384d636434cedff998424707df4c27c867d58939d7b89253a0e0853f30472f5330cceff120eee3bde07
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1Ek:KYHIhKggkXyBcIHK5W8Ty95I5KSEcK
TLSH
T1B2913202347B12023C7D294DB6A196364E4231E375ACB4AF7FF900A55E66E124EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccb23361-1cad-4e82-aca2-759b207960b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ccb23361-1cad-4e82-aca2-759b207960b0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 0b68d197a38621cff089688539bfde86e768ceadcfb4ce4ac22e7bd44a49a687
MD5 05926b5da945f5a6ba99d72270c833e5
SHA1 bf497fb833d107e8604d53e6fd9c56d739413d8f
SHA512 a8ba292b3a37f4dd586f061ea0f0a0009de171e5b73d816410f1b20dc96d46da76738dca69d398bc7580d534cce5eca0755f9f6a2f7cd86ea4f99fcc0163c731
SSDEEP 384:mZcIhsNGFZopd7P7CPRvMldLKoJrLyZx5:0hloT7PoilhLyL5
TLSH
T13C626D725C749C379AA3F186F88E37135EF49037E7C45B54E5EDAF0D01D6668030691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e7695f778e5082fe601fd83be1e7ecf45ec4834c7e4664aa4d57dd7df8325ecd
MD5 0d8e7c696c2bb21bd1e8af42ed9845eb
SHA1 d3d0638a10b2e81dc8f26fb6912d130d21b9ce01
SHA512 50f3ce7a6c2a025b946b4ca8e996eeef1fdfeeec204c2a52893d0824971fd383376ccd521f368c314cfc41f20f997de39eff4403194966076d4eda392ad9577a
SSDEEP 384:aiFiZcINzsNG8TUNTUlIlwZopd7P7CPIvMldLKoJrByZx5:RFQ1HwgIoT7PBilhByL5
TLSH
T1A8B218F248D7883AD9AEA743E77D2E034EBCC067B5805650B7D95A0DCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 517dcb4d8f31eedd84d1b0a7cf75ebd70d50121bd9bd9fbfe16ca051ffb83a53
MD5 7aa64db2442208c1442733bbdd5b12de
SHA1 a8be258c5c6e0ce6027535a7fe47bc8110c48a54
SHA512 f21ea654f654c07bd383e9e9536ddb6b760564dd30bba75c63b879a5e98ce94cb456c7efca19dda514a361f515309a4191c93ef90d0edd664154b035048bd8bc
SSDEEP 192:lON76vMtPQmiUyxSThTFp+FdLXKV847MFU/u:lON76UtRvTOdLK1QU/u
TLSH
T1B902F835AC786C7B9AB3BD46F58E27171FE421ABE9D01B54EAE82F1D00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a2ac98431acdf595b05ee06c2f49e1e6657d90a48e29aac0a41e65510d17bfdc
MD5 48b8ff025eb1b9467703f1b0ac46bae0
SHA1 d0459659249d583f366711b58d5df3cf576ab53c
SHA512 3c166c87882136f4022e4bc462c3283c6ecf59538a6394b177b65e3df6b9b0b62f057b478336614210861bff021aae4ef31016db6cbb83205a41b119620e2667
SSDEEP 384:GZcIhsNGwZopd7P7CPRvMldLKoJrLyZx5:UhAoT7PoilhLyL5
TLSH
T14B626C726C748C379AA3F186F98A37135EF49037E7C45B54E5EDAF0E00D6668130691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9bb3e052bf9209be5ed7df7219535c21dd7bdd78302586aa339bd2d596c2643d
MD5 bc4b9df751e2c363029c1c45eb53d26a
SHA1 c50ff6257d7a7ac56ad6346d10677aacfe4595c0
SHA512 56a21b729056e5b0cfabf429435e7f84ff443d7a94266d8bc203f5175f4f3134657cb910dfada916a58c663d49d6c441362882eac38c0f2a302b395abc1f8a54
SSDEEP 192:EON36vMFPQmiUyNSvchTFp+FdLXKxzSJrs80Ikq0U/u:EON36UFRRvcOdLKoJrRyU/u
TLSH
T1FE122C32AC649C3B5DA3B582F48B36135EF0916BEBC46B50FADD2F1D01DA66C1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32bf3033-1d87-49cd-9d9a-e2056d108890.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32bf3033-1d87-49cd-9d9a-e2056d108890.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e9735c7f1836f6d39410c3e1a6b14bd78be01b270e742158e73c61dfbe287e1
MD5 8f4945a5d765dc7717ab25112257a28c
SHA1 bfcd004b2451423dffbe68b425d62747ac69fd9d
SHA512 361284426ac824aa97f0b3085b6ea3113ef74631e6c48f2363061c7374966b974f96f45dd697a393ac0919b53a84b522d6abb396dad910155b7c953102131a12
TLSH
T13141484DB7ED0108B3B76E56AFF6A46E487BB8332F06D55E10110E4F0A62A00C971737
MD5 SHA1 SHA512 TLSH

Submit Download