hxxp://ajax[.]googleapls[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ajax.googleapls.com
Sample261102-rfgpzsfc84

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{401EE2E6-7ECA-4086-AEE8-80153B1BF0DB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1520	1276	msedge.exe	84
PID 1276 wrote to memory of 4644	1276	msedge.exe	85
PID 1276 wrote to memory of 4784	1276	msedge.exe	86
PID 1276 wrote to memory of 4784	1276	msedge.exe	86
PID 1276 wrote to memory of 4784	1276	msedge.exe	86
PID 1276 wrote to memory of 1428	1276	msedge.exe	87
PID 1276 wrote to memory of 1428	1276	msedge.exe	87
PID 1276 wrote to memory of 3788	1276	msedge.exe	89
PID 1276 wrote to memory of 3788	1276	msedge.exe	89
PID 1276 wrote to memory of 3788	1276	msedge.exe	89
PID 1276 wrote to memory of 3776	1276	msedge.exe	90
PID 1276 wrote to memory of 3776	1276	msedge.exe	90
PID 1276 wrote to memory of 3776	1276	msedge.exe	90
PID 1276 wrote to memory of 2232	1276	msedge.exe	91
PID 1276 wrote to memory of 1484	1276	msedge.exe	92
PID 1276 wrote to memory of 2232	1276	msedge.exe	91
PID 1276 wrote to memory of 2232	1276	msedge.exe	91
PID 1276 wrote to memory of 1484	1276	msedge.exe	92
PID 1276 wrote to memory of 1484	1276	msedge.exe	92
PID 1276 wrote to memory of 4804	1276	msedge.exe	95
PID 1276 wrote to memory of 4804	1276	msedge.exe	95
PID 1276 wrote to memory of 4804	1276	msedge.exe	95
PID 1276 wrote to memory of 3264	1276	msedge.exe	99
PID 1276 wrote to memory of 3180	1276	msedge.exe	100
PID 1276 wrote to memory of 3264	1276	msedge.exe	99
PID 1276 wrote to memory of 3180	1276	msedge.exe	100
PID 1276 wrote to memory of 4048	1276	msedge.exe	102
PID 1276 wrote to memory of 4976	1276	msedge.exe	108
PID 1276 wrote to memory of 4976	1276	msedge.exe	108
PID 1276 wrote to memory of 4976	1276	msedge.exe	108
PID 1276 wrote to memory of 2504	1276	msedge.exe	109
PID 1276 wrote to memory of 2504	1276	msedge.exe	109
PID 1276 wrote to memory of 2504	1276	msedge.exe	109
PID 1276 wrote to memory of 3396	1276	msedge.exe	110
PID 1276 wrote to memory of 3396	1276	msedge.exe	110
PID 1276 wrote to memory of 3396	1276	msedge.exe	110
PID 1276 wrote to memory of 3740	1276	msedge.exe	112
PID 1276 wrote to memory of 2940	1276	msedge.exe	113
PID 1276 wrote to memory of 2612	1276	msedge.exe	114
PID 1276 wrote to memory of 4304	1276	msedge.exe	115
PID 1276 wrote to memory of 4304	1276	msedge.exe	115
PID 1276 wrote to memory of 2592	1276	msedge.exe	117
PID 1276 wrote to memory of 2592	1276	msedge.exe	117
PID 1276 wrote to memory of 2592	1276	msedge.exe	117
PID 1276 wrote to memory of 2892	1276	msedge.exe	118
PID 1276 wrote to memory of 2892	1276	msedge.exe	118
PID 1276 wrote to memory of 5080	1276	msedge.exe	119
PID 1276 wrote to memory of 5080	1276	msedge.exe	119
PID 1276 wrote to memory of 5080	1276	msedge.exe	119
PID 1276 wrote to memory of 3144	1276	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ajax.googleapls.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x260,0x7ffa7730c188,0x7ffa7730c194,0x7ffa7730c1a0
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,2163292575316489165,3645655393789874788,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,18101389655899731000,15173819774952969154,262144 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,6138176564179267352,16634860350982264313,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11734339298532994060,3664588052812276266,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10266528130275499212,516677527703178912,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,5014818063081329908,898244119610160531,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7774549204343676317,6165129376566766565,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4352,i,7470103228030165937,6532847719672911107,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12426107990274477467,9189370371511810910,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,12908174064148949709,12077087964935341506,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,2757990230577854427,3538412445067426767,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,2757990230577854427,3538412445067426767,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5876,i,17396996504733458973,15008682053609364201,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3564,i,15534564161570268657,14465897181904958819,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6428,i,1051952768319077869,10289917402954091140,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,497445456926327481,5690380714457662653,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11138852549046509929,3055173427894215518,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,4530496991645525929,2824570835411968482,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9096904486139857515,6348628786095594721,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3652,i,7863480938448895448,3125515871981078650,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6086448237925163066,17022424284451843465,524288 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=756,i,7443246851049964200,1538082810232221418,2097152 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=992 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,13516580039560602698,139861527676733763,262144 --field-trial-handle=2316,i,17473781722163172826,6967920377901874787,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5febba21-5a49-46a3-97b4-f09ec91cd760.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5febba21-5a49-46a3-97b4-f09ec91cd760.tmp
Size 8KB
SHA256 638c01762d34a6d1da0ad1c67540099f98c9fdb293ecdab8b4788d274304ff83
MD5 e76b3ca9a38694d09e0241d4c159bdc2
SHA1 9a28f72af1a118e1d4937ea3608b22bdc8af0453
SHA512 f946f91a435e91b3e90182bac3db9824fa6d2cd7a99382d10b147b77af8fe8338712f474d832b51f1acde4103a2f48b776c71c68456c38dfa6f7eb771ee767bc
SSDEEP 192:sONV6iDUQmiUyNRkq5u88PA9+aMuZMqq1U6:sONV6xgkq5u8i0+aTU1U6
TLSH
T1CF123B36B878BC6B6DA39961F44736239EB5426BD7886F80D9DC272C05EF19C1307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64665990-72f1-4929-b2d3-e413d9269b05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64665990-72f1-4929-b2d3-e413d9269b05.tmp
Size 18KB
SHA256 a467cee45078b64c3b13e5999165e5697b5d971e1c8257e5ff49d127fe160c2b
MD5 6273a3166e6e50949db71b12e46b2c6e
SHA1 bf46bd0fa1af6be5e5f0814571f9768f598845c5
SHA512 fb0c391920d0eb0b241c62670e23e7ecbdba4c60e018a8dd5e5d0faab078c3994be78f5d9158c448d71d2d166f89d4863bb2bfac0e17fab4833357f87c973fcf
SSDEEP 384:iQkUSv0sNsmhf+Eb4p5u8i0+auU1H7vBEupIIl8:a0+1bykCuU1H75EyLm
TLSH
T16D828D72AC697C3B5EB39620F54A3623EEB4815BD3D85F80D9DD972D01DB1C92307A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eda1244-e741-4c02-bd88-154e43486b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9eda1244-e741-4c02-bd88-154e43486b90.tmp
Size 18KB
SHA256 845e3ec539e497848d67f42c8b33f43f9617b64c589471f33baf39f3115b4bb7
MD5 7abf31aab1661745955f49fb166f7ac9
SHA1 37cc97eb9c923db19f257c09c523c32dd4180544
SHA512 215a051baa6b773f2c5e527961a66b7a26567ab05ab3d314b20347b8811815e8488a0a6355b9596b383dd25f239274a71f3c56fb35ceb13390cb91701e44db98
SSDEEP 384:AQkUSv0sNsrhf+jb4p5u8i0+auU1H7vBEupIIl8:o0B2bykCuU1H75EyLm
TLSH
T102828C72AC697C3B5EB39620F14A3623DEB4815BD3D85F80D9DD972C01DB1D92307A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a203e061-a53e-4c8b-a8c7-424c9b49c5c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a203e061-a53e-4c8b-a8c7-424c9b49c5c6.tmp
Size 105KB
SHA256 e2d1a78ddd4a2613e2e137a9b8a6ee6a025f24ce78c71783944f051445e3063d
MD5 a68138180bf134fe6e360a0e37c3184b
SHA1 359c64103a0eb1cbba384f963ad47bd6cac7e41c
SHA512 a8338bac44852d511db583b349822cd7e5ec3c426141655b68ecc184832731c5830c69e5af34998dd6e85c0ddb2400530e818deb283053d561c8afc2b615cacf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T178B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

3e493587-81f6-4f5d-ba5a-eaef88a957cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e493587-81f6-4f5d-ba5a-eaef88a957cf.tmp
Size 9KB
SHA256 d4d74621c887a6661187c8691759689d6e8182a85fbc598ddf9023d29322b9e0
MD5 9d360019571770ec0403616d7b9f248e
SHA1 383d72d6c709d3d5f7058261f10d336bf39f03c8
SHA512 0aa7bb2416173288d1c75e2e252e3412e300b917f7484e1cf4cd81b9856946a52fc1725f8eb92242c9d7c4b5b670a61b39e7120bfa340d72b52440934a952792
SSDEEP 192:sxZ4RaWL/f4soYaIdpjzHW6+WNEpd/Ya8LE6IgrJ:sxZ4fL/f4soYzXHbk/I9
TLSH
T14D22B8526E28B97B8CC7D21DBE25BF57D6F9503291D11E48AAFC861C04E7ACD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

584503d2-58f9-454f-8ee6-9a22cbca7b3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\584503d2-58f9-454f-8ee6-9a22cbca7b3c.tmp
Size 9KB
SHA256 309dfc9b3e3936eb6fa82bc17476010df32584ca61c510825e489f7dfda36f77
MD5 65188099513257c47ec0733d41c21d4d
SHA1 378a6469b89ce301d794a0d9828c498ab0f8a8b0
SHA512 37b243dfe295dd5f00ceb7ca3f977fe648ed3839ef3febf110884808aa637c4504235697eff34293d19ef772796e083acfae8ef586f5046c94b147634464cbe5
SSDEEP 192:sxZ4RaWL/f4sTYaIdpjzHW6+WNEpd/Ya8LE6Ig5TJ:sxZ4fL/f4sTYz3Hbk/IT
TLSH
T1DF22B852AE28B97B8CC7D21DBE25BF57D6F9503191D11E48AAFC861C08E7ACD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5897c713-fd4a-429d-a1a6-406f2905f6f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5897c713-fd4a-429d-a1a6-406f2905f6f1.tmp
Size 10KB
SHA256 98b822a64ec655da7ade1da76aea20c2f6f353c0c5f65acd5e5ac20c6990db6f
MD5 b8d85d344b7f4fd8f1e6a28fe634d25f
SHA1 9e5888ecde906368845ee1c28090bf46a5c76790
SHA512 a447383caf538fdeda275b9841bd85ef2e35504732def13144b2c5695f43f093dc05fbc603e5ec398051a786ba7b44b808b93bc00a4c8dea8c788b59cb364b52
SSDEEP 192:sxZ4RaWL/f4slYaIdp9zHW6+WNEpd/YawOmE6Ig5hJ:sxZ4fL/f4slYzRHbk/4hF
TLSH
T10B22D852AE28B97B8CC7E21DBE25BF57E6F5503291D11E48AAFC861C04E7ACD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d0222cf-6ca9-4939-a28d-7b6e761fbfe3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d0222cf-6ca9-4939-a28d-7b6e761fbfe3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9e17195a-d5df-4a27-80bb-346ed454f858.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e17195a-d5df-4a27-80bb-346ed454f858.tmp
Size 27KB
SHA256 047b038d8cf36f054d5f236b170869fa8df5f2ca625c67ab3f2574c2047cdb2a
MD5 50f42a2f6e758c0f9a8967a2920342be
SHA1 ca3ac516753dbdc5be011d25d0021bab3108810d
SHA512 44c4be53cc194336a5567527243028e7fdeef47f2e3fc581fa646410442aef264a5402fad3bc7cf3a4b5a2806a3eadaddd82d3dbf805bee980e6b2a0fdda6adf
SSDEEP 768:+XyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH35roQZ9H:+XyQRbrWvvlpZu1jaXKLf33yQZ9H
TLSH
T188C2F92B640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4eb0c52121b05e1797b7fdfe1246a88836e38fe399e2fc6abc83b2f21f0fb8ca
MD5 4d57477c57b6b46db95cfe605bf24115
SHA1 b081732fc96328f3f272a1d7198276b1f3467a23
SHA512 22a7780b6a438c0706fd0022dbaba170acc969ead60e2e264ded9ce5cd1ea94df30bba5344785b6c0d110be568391c00738eb0758bfd87642e09828c41a63b7d
TLSH
T14BE0CD9905DBC63FE208F48701E8D74CC290761BD7C4795E57C4D5F67541D44B2D7AA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f3cd83c49fd123c77dff20f46c97cb91d277b69a49e9e6fb0a60dc6bdaee20c9
MD5 73c5d38c57fab3da7054c2f82db954cf
SHA1 c32f8674753068c604edbe06821d8bc373b90da6
SHA512 b6e22fb074ef68cfe81bf3109372718d279f042de49de8b440185804f9932a5428c6447d6c7bc35f4d1a1a68d8f59416be782aaea54da99c8f82971ec55e9981
TLSH
T12E616178B8FCC4D5F7D8447CDBD52A8736BCEA829C979EF201A0DB786D8AF101054046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 596964eff5991dbde50e8ddbb6a1488af5695c8458a613b2bcb53b01aab1f754
MD5 e3dd541771ba312f7345925b5d2d3b3b
SHA1 bc1f782d0b7cc5f468764da575621484a053cbdf
SHA512 f196144247a1f4916f22c9cede3639e2604db0a40ce8d52ddce0dc176c5f292cef043f09f8d79690eac56fca4205b46dc3d7e61585359947870988f719692b29
TLSH
T1C7615078B8FCC4D5F7D8447CCFD52A8A36BCEA869C979EF201A0DB786D8AF101054056
MD5 SHA1 SHA512 TLSH

Submit Download

6669dbcc-9104-4906-96b8-353bb8cf7bda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6669dbcc-9104-4906-96b8-353bb8cf7bda.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

02efb56b-f890-4e37-a6a0-2fdba909d38a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02efb56b-f890-4e37-a6a0-2fdba909d38a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

cfd68f7d-31dd-4296-92ef-1de6e4228f3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfd68f7d-31dd-4296-92ef-1de6e4228f3e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f392c577-d978-4ecd-951a-4a263dd309e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f392c577-d978-4ecd-951a-4a263dd309e6.tmp
Size 1KB
SHA256 53d6fd745ab35ff69072553e4574e2ee651ae68faa25998d4a8c60f5d61cf826
MD5 cb44073371df146d71e8ee9299ae72b0
SHA1 0533620e39d8cd5035ad94a441c1374f1130f032
SHA512 a1626c87b0653280a4a96f15c0ff656034fb20d49fd5ce71e4cc212596ab59fc24c0be51e11aff0cd3fc6bf62ba63c85410383461bca9b3b8d4c4ce2ed668a9e
TLSH
T1E5316AB3C3D88A6EC8115AF0AB147E1FCE2D491943283D1AC9D4EF5B97E2472D14158F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0af24617a5fb53587fdbbbfd3bb5481cb79c43a8109e80fd23cf1558f26dd281
MD5 488f175f81be9bcefce3c00aee7abef0
SHA1 7ea595ee4c2995970ac0dcb36cbe48d1fea29023
SHA512 b5b2b071842a22aa7bf8724d40e365b8b0b0ef08f81f0bac4849d5422ea027e4bb81cffca63c57a46a3b0bf23993af5d5c199afe5c5ee840fc50448ca29e2ce7
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWXbe:K8S4K7S6aaoKnKEggKdmKf
TLSH
T104912111326B078039BD295884B6872B524275F3302DA93BBFBD55F24F6AE140DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc429e64-5b82-479d-a0c1-7ab31e8f3df0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc429e64-5b82-479d-a0c1-7ab31e8f3df0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccaba78c-3feb-4070-a509-a954405a9182.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccaba78c-3feb-4070-a509-a954405a9182.tmp
Size 10KB
SHA256 0cc3b633e11d55faff094265f48eae11d29807790a57950a7b092fc9cde6c669
MD5 3fbeb376f26ce2d9ed185c9adaf0d3cb
SHA1 fc21006083d0d22ef4f3db246bad87f42d27eb4f
SHA512 19be8ff6f0e48a1faa8bc1e4bc9e85d3d111c507528a588d87f71b6db13dd4c81fd5b65ea9f318fb9febd560b520765f04f25cf9df0f9eb76f414273aacaa7ea
SSDEEP 192:sxZ4RaWL/f4slYaIdpjzHW6+WNEpd/YaZOpE6Ig5hJ:sxZ4fL/f4slYz3Hbk/ROF
TLSH
T10B22D952AE28B97B8CC7E21DBE15BF57E6F5503291D11E48AAFC861C04E7ACD124740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f0ab978a-291d-4528-8ab0-8491c5e76702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f0ab978a-291d-4528-8ab0-8491c5e76702.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caca4a9f-b8c8-4e5d-8b07-b2a0563d9ce9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\caca4a9f-b8c8-4e5d-8b07-b2a0563d9ce9.tmp
Size 26KB
SHA256 42e9165eceec503b2ce15c4b2b274c99119e08aacbc59687c53f16346bf3e773
MD5 7f5e7c1634e2f3131e035d573be92a5f
SHA1 d909e550e86b46b1a12a7b873219dc23fafd8a7f
SHA512 c26d627750572628b13124831c47150604cf61848b0a1d053c00e370aa3147b6459ad4cf2c61301f0feadd18271562a603ee58915ca0c48ca4b500d1aa9474c1
SSDEEP 384:UiFzQkUSvTzsNk8TUNTUlIlmhf+eb4p5u8i0+anU1H7vBEupIIl8:vFd3lwgILbykCnU1H75EyLm
TLSH
T119C217F258D7A83AE9AE8B13A73D3D128DBCC157F6849A40FB89551CCC861BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed0a0518-1194-4a0a-9187-e537a03f0988.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed0a0518-1194-4a0a-9187-e537a03f0988.tmp
Size 8KB
SHA256 2ef1efa32f59216b26ee0cc5d128b7eacea82a6c254214e38cddbf38f5de67bb
MD5 167e8ee63c295d717e4d02d4e0302594
SHA1 791631b78e3d8b4fe6c59c7a209b770a5873fed5
SHA512 d2c63bc8098e7e470f11296f2a3ebc1e23a719adf16a7bc47e74d2725ec46ab46093faefb89bb0aed79263bbeba565b92429263de8185c87b6aae8831ddd1eb5
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5YmDXBfPGxvw45RxmJm78lFIxCYbqF:SONo6iDCQmiUy7RHq5u88PAgSqhaqU6
TLSH
T14B020A39AC787CBBAEF3AD15B54737179FA4117BE6941B84DAE8162C01E768C1303923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea8629a7-084a-4f96-8b68-88941136540f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea8629a7-084a-4f96-8b68-88941136540f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 085182bae569712ad305518aad8b8da6c62d67de3e9cb89227ddf09658b56eee
MD5 515fc4ea60ef5706d726476447e80ba8
SHA1 0cd18cec87395c05fc32296455e8c400e71b7211
SHA512 16bcae46a6a7b6698f7bd5e5571354dfcbfbeca137cd1648dd85b9e2e83e8777445b713cb596ba802affa668648955c5e0dfebd2ebb0a484c0e4e9b67cbfdc62
TLSH
T131410759BAEA1158B3B76E16ABF7A86D447FBD332F06949D00110D4E0A67A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download