hxxps://www[.]columbiagaspa[.]com/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
170s
max time network
171s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.columbiagaspa.com/
Sample261020-werwsacf44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3202520547-175870679-441661622-1000\{B541B1D9-B0EC-48B0-BCDA-9A0797E1A305}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2888	1084	msedge.exe	82
PID 1084 wrote to memory of 3980	1084	msedge.exe	83
PID 1084 wrote to memory of 4204	1084	msedge.exe	84
PID 1084 wrote to memory of 3536	1084	msedge.exe	85
PID 1084 wrote to memory of 4204	1084	msedge.exe	84
PID 1084 wrote to memory of 4204	1084	msedge.exe	84
PID 1084 wrote to memory of 3536	1084	msedge.exe	85
PID 1084 wrote to memory of 4176	1084	msedge.exe	86
PID 1084 wrote to memory of 4144	1084	msedge.exe	87
PID 1084 wrote to memory of 4176	1084	msedge.exe	86
PID 1084 wrote to memory of 4176	1084	msedge.exe	86
PID 1084 wrote to memory of 4144	1084	msedge.exe	87
PID 1084 wrote to memory of 4144	1084	msedge.exe	87
PID 1084 wrote to memory of 3584	1084	msedge.exe	88
PID 1084 wrote to memory of 2152	1084	msedge.exe	89
PID 1084 wrote to memory of 3584	1084	msedge.exe	88
PID 1084 wrote to memory of 3584	1084	msedge.exe	88
PID 1084 wrote to memory of 2152	1084	msedge.exe	89
PID 1084 wrote to memory of 2152	1084	msedge.exe	89
PID 1084 wrote to memory of 3604	1084	msedge.exe	94
PID 1084 wrote to memory of 2400	1084	msedge.exe	95
PID 1084 wrote to memory of 3604	1084	msedge.exe	94
PID 1084 wrote to memory of 2400	1084	msedge.exe	95
PID 1084 wrote to memory of 4732	1084	msedge.exe	97
PID 1084 wrote to memory of 3640	1084	msedge.exe	102
PID 1084 wrote to memory of 3640	1084	msedge.exe	102
PID 1084 wrote to memory of 3640	1084	msedge.exe	102
PID 1084 wrote to memory of 3684	1084	msedge.exe	103
PID 1084 wrote to memory of 3684	1084	msedge.exe	103
PID 1084 wrote to memory of 3684	1084	msedge.exe	103
PID 1084 wrote to memory of 1056	1084	msedge.exe	107
PID 1084 wrote to memory of 1056	1084	msedge.exe	107
PID 1084 wrote to memory of 1056	1084	msedge.exe	107
PID 1084 wrote to memory of 1220	1084	msedge.exe	108
PID 1084 wrote to memory of 1220	1084	msedge.exe	108
PID 1084 wrote to memory of 1220	1084	msedge.exe	108
PID 1084 wrote to memory of 2672	1084	msedge.exe	109
PID 1084 wrote to memory of 2672	1084	msedge.exe	109
PID 1084 wrote to memory of 2672	1084	msedge.exe	109
PID 1084 wrote to memory of 1760	1084	msedge.exe	110
PID 1084 wrote to memory of 1760	1084	msedge.exe	110
PID 1084 wrote to memory of 2132	1084	msedge.exe	112
PID 1084 wrote to memory of 2412	1084	msedge.exe	113
PID 1084 wrote to memory of 2944	1084	msedge.exe	114
PID 1084 wrote to memory of 2512	1084	msedge.exe	115
PID 1084 wrote to memory of 2512	1084	msedge.exe	115
PID 1084 wrote to memory of 5104	1084	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.columbiagaspa.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffddc99c188,0x7ffddc99c194,0x7ffddc99c1a0
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,16589508524818614508,16924239151336201961,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,15762555283855707818,8418347901244382074,262144 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,882026075134028005,6633936696981240418,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8979500806112274634,8138703393073628781,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8278985321695211718,7390524430525888619,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,194107663884342017,2008414218293517352,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,12953208707892501676,4766179814088353871,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8187914834992441172,5400781134339843852,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,3914012573731884160,9748873176340031742,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,276590354715791913,13064267417518575108,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,276590354715791913,13064267417518575108,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6312,i,10203753019914507581,15472826659293129825,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,14507730062617154005,9599278319988780080,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6744,i,157970327114798726,13336947830557281169,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6840,i,9450422753898548861,17547915369142839142,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6232,i,526787117473809753,4058989207852857406,2097152 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,16635971346157849565,5770480215165115969,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,11377288319950826165,12661398550123949176,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,1729034047124858670,20165564850053135,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,5270271215705075469,10377161478482526299,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,11118694536817862224,15076638655330717758,524288 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,6955008981044904861,7705501020107473666,262144 --field-trial-handle=2412,i,5344950585595584584,189036238312429424,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e1a6c45-daed-48aa-94b3-03ba900127e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e1a6c45-daed-48aa-94b3-03ba900127e9.tmp
Size 18KB
SHA256 36b1119c9120372203081356d3a37d2e925443ff8b6412d161be7561df5a8d38
MD5 3d4fe9dfaca96b7b8b4894949ef14cd5
SHA1 8936d06bd1322129833202b32e3a290125e7f8d8
SHA512 f4a4029f8d7d8c540f49c87ea37c7d1b0c3ffb34a3a90771796ddef697f62ba6f0c1d175276401f8a68dc9d9a6bd127d493225f30d9782513a355d031db20c4c
SSDEEP 384:LQkUSv0sNxkbat3LTb+5F4W9JAfh3+2lOiiugEWt3glE:F0+7+bjQllJuwlE
TLSH
T180825B757C685C375AE7A501E48B36078FA4C12BD6C82F64E6DDAB2C01CB2D8234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b65a77c-ec4a-4311-9120-816fda9fd14e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b65a77c-ec4a-4311-9120-816fda9fd14e.tmp
Size 18KB
SHA256 e74e8d9c56fba52531c6b00729d662fd04de902bffb1cb7a3cbd2bd0a3c037ed
MD5 5c7bebf096acf8d2e0977f1de72536c0
SHA1 badc8da32ac2dac3246778ca6666e26391ddb586
SHA512 56a73344d7791fc27f0bdfc49bbc472485be427285ae8d55925bcb64fbdb983f3f61d7658c9d010a17a0cf86d3f0d205dacc828de287408a8c54735e34bc2516
SSDEEP 384:CQkUSv0sNxkaat3LTb+5F4W9JAfh3+2lOiiugEWt3glE:6057+bjQllJuwlE
TLSH
T11E826B757C785C375AF79501E48B36078FA4C22BD6C82F64E6DD6B2C01CB2D8234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e540ff94479edeafbd2f52590dd9a8011e45e365c17d276ef0a72a73cf8703b0
MD5 34381c2be9e66e3a3f2106d98929cb65
SHA1 9dbace176fd9f60199e5fcdc1cf19399a18947dc
SHA512 715895995299450f87643e3c2823927f88e88c79d2e3fc83048a5aabc884b75a08b9125c07807996b45cd41a0667c3bd0cf692e72178d58addd93f4d0b89b947
TLSH
T1C7D022B0E3302230EAE8B23200E0C3328802EA020F883F000003E008ACF8BB020C330A
MD5 SHA1 SHA512 TLSH

Submit Download

53333a32-eda9-40eb-ad9f-89132b366101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53333a32-eda9-40eb-ad9f-89132b366101.tmp
Size 11KB
SHA256 51eafe0b17732a12350972767e8d8db3c8b815e959d48fa0a6d8a7229d5c4ed1
MD5 43e47f08b12948a239c0684dbce455f7
SHA1 0423a03f94601019d60bbcef772aff3a3df766c8
SHA512 5d97c623a8b5deb65f079bcd6570af613678c39ef824ce81d5e52b343d655670fa47dfe68caf3013dcadcc10584b6930a3b6bc222e781f9b7c494d4bc3435d16
SSDEEP 192:sxZURln3/fEsgmIdpC8HW6+WNdntCvTMXYtmK/UIg52J:sxZU33/fEsgHDHb+AXVA
TLSH
T1D932C9526F34AA7B4CDBD609BB55BF53E6F59032A1D01E48A6FC8A1C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

630fc85d-98a4-403f-b53a-20847b898569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\630fc85d-98a4-403f-b53a-20847b898569.tmp
Size 27KB
SHA256 cf2754e7172ab080bc6d7cb9635ed02887c99bfa86240f12bda7036922ae7463
MD5 60489d3154e41aaa36eda61906e2b9ea
SHA1 923e0e98f72d1cb1daece2f3986de02c620e796d
SHA512 6aef27a6995853c67e5ac0f82312157d1a6c95538d4f13e9fa9b52ff4117eb6c487276c198e62d07129a39da9f405fbe4b52c904eaae59840df64e3fadeb41c7
SSDEEP 768:hNOtS3IWvUgqc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3LlTtsbyroT6I:hNOtS3IWvUgqcu1ja83LNWbpT6I
TLSH
T1C9C2F93B680CCB7E4FC01E9DDC6A6F977E9802C7A6589D4047F9984C02D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67bbba6d-834a-4835-9c7c-b5c9b018ee6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67bbba6d-834a-4835-9c7c-b5c9b018ee6c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94cb2a7c-41ca-45a0-aff7-fd15d08451cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94cb2a7c-41ca-45a0-aff7-fd15d08451cd.tmp
Size 11KB
SHA256 4ee18e9df4c78f8afd1de615273cc12d4f20eff2ff6b985ac6b2be96831bea89
MD5 833b06ad78ef832ac8d6e3ca0a23e2b5
SHA1 07d4bcfc8c1eb73a0fd6b5f269c2da21fe71c36f
SHA512 d111954a3ce32eac6ba098504a123ede905cac797197758738aa961b46fbef2b2142d29fcca1bcd2772ad1359e1971369e3b31fee9816e581141ca0af282ac6d
SSDEEP 192:sxZURln3/fEsgmIdpw8HW6+WNdncicsTMXYtVNxUIg52J:sxZU33/fEsgHpHbX2X3A
TLSH
T17832D9526F38AA778CCBD60DBA55BF53E6F55032A1D01E48A6FC8A1C05E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

957dd4c8-175a-494b-9f5e-d7699ca5ebb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\957dd4c8-175a-494b-9f5e-d7699ca5ebb2.tmp
Size 10KB
SHA256 8b851b124edcba11abbd7b0b6de029839028fc2946a51e828d2c37680f680e60
MD5 91c20d51f056a2491410655702f5a091
SHA1 cb9c8c7eec3d967aa863418107a96e62072b3f8d
SHA512 5f38f3cca003798ea8ddd5723070cbbc4a7b3eb996b4824ff5075540f879f03f862a23ad89fd460e5b117979ad0663997035c834eeeb9b8ef153fe1ae6ecbfa0
SSDEEP 192:sxZURlW3/fEs9mIdpCAHW6+WN4xG/Ytla/UIgrJ:sxZUG3/fEs9HPHbh/49
TLSH
T19122C9116F34A97B4CCBD20DBA55BF53E6FA4032A1951E48EAFC8A1C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fd79fb6-32ad-484e-8726-d328349e60d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fd79fb6-32ad-484e-8726-d328349e60d5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 29KB
SHA256 3e1b5002dd64d185f806edeefd333348f423584d876cfc966b5c13884c8fe3da
MD5 c54aac7ef64c39b4f384e0d5771d3b46
SHA1 d3e059104378a3844862a5ed12a13f5d423e86b6
SHA512 05d8fddaf5dd7258679a48095e8486c435263206ff56a9e9154740d61b0e0c0a459971e661cd88202d0e65581c7fe5871d86991fefb4ee5558a364367afff5a7
SSDEEP 768:g7/s1DgmjgCjH8DBv0qe7ZaVRs9v4kyXSe5L:g7k1DbjP8F0qe7kLp9
TLSH
T17ED2F2C81198A0C1D26B013BD74F5D9F526ADEEA050CB6A1A4F0948F7E23527DEC44BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 807KB
SHA256 174424e9111bf56ec03ff249a9489681e73ee1a58cc84fbd28302becb82cdd52
MD5 8c414c8dac3b7ba30b7748e5c564e1d6
SHA1 fe23d27f913e43546c04ace544fc550aad01104d
SHA512 2f20ebd6865f526b6072f6aadcbe7fd828a6300940ba659ead91ac5a857ecfa5b32ab3ae51efff09e7ea1eeeec78d5c09506bd9f548907f4587af254f9fefb21
SSDEEP 24576:7IVlO1N+zjW9LqaGveMGbEXPDI8Vi56ehkisX:7IVsN+zXpmMt8RZhUX
TLSH
T1AE05233EAEF05066C9DBA141DE5B04361B397FEC4EA57B2BD565F8FA52902C0A12C3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 330KB
SHA256 1439b04c220c8ec3f0eaf932bcf8415970c683657cd52977dcd1bb84f08c5cd5
MD5 58198fb8f0858d9e51537c66f02054cf
SHA1 38a08350a67e247286291048ff696ec5c9a916c1
SHA512 2afdc4cc32131def72e0d8046fac78a15163fea110d905bd246a63da6d4fa9c0f9916589403eb1639c7e0f8a84dec2bfafe664d933fe53cc41e9860d7811efe8
SSDEEP 6144:+HYZpgr69UOwL2OeZ8hcYvnEmCQdSqtvRkdbw6bkSwUaSe:+6rb8W03CQrRGoDUa7
TLSH
T1627423B32A5FACB03BB5DD47B60B2F952E081D9F819437D0DB72219B0558871171BA2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 121KB
SHA256 3213977489cf5f56790548f5764986f94cae9321a7c4a632e9104e6a0390c815
MD5 ed350e38a037ae00093a3d161f81fe48
SHA1 d67e5fccac4502af6368d9a67f546361ccb63cfa
SHA512 58ad5b3b27e6ae15cb69d12d82958f3117b071c4e228ee30f418e25443f8c3c3416c2d3aba8d60c7e88d7ec8b24bedf413b351cc9c94b88054ab56cec219f1b0
SSDEEP 3072:HVQ03Wq416X86ds8DQpk/PUrXlc45kV5Nxakt1FnrAV/4:1j3WqIfgdOgakXNNFEm
TLSH
T1F4C3128493DE45323BE7687D728FC4110700B02C495FA5DF6479BCF2C2D2966C6ABA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 147KB
SHA256 278a2b3111c14cb5dca30cad3b77b5e4e0194097dd91bc65513b4940ec9a07b2
MD5 00ed937d78dbfa8054d44c6e27ac812f
SHA1 a0dfe5ae26d8c21158531ac2df0cf5d50aedac89
SHA512 0471af9ef77f023833fc6e009b5de2877e465e2cd98d1d4f4c9541e65c99648a7e07855d0b96394f80002392f217e433162d5ed5200d3f4e12196c3f8148ada2
SSDEEP 3072:sJwx77ZAh/TjRoVH5xAa9NwIWdyKd5VYg+b+ipk4Hh:sJIk/TWZ5xAa92I2Ygs+gHh
TLSH
T190E313DFC3BB0CB9E62790013BFD868E49D61AED40677DCB94059E58610AE878EE1316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 30KB
SHA256 6e28f1a97b0ec160fdf4799c4406db3630db4d532ec5af6ed5dd5e2778e83abc
MD5 0e308a7d717f3a246c25d36fb83309f1
SHA1 ec9be08b2e567d559ba0b5fc56394c99e9f55417
SHA512 1c33e3db21c331df1c27af15ac3e398ed6f1267db4bf7870df6a33a76edcaab8e536b160f15f23afb1c0225187af1d3580dfdedcd9d22a23c587d15975fb8675
SSDEEP 768:ImgTl4Z0bIm4ETUj2uEMdZO+dmlYQFxwrHmQLm5VCVcF+ezNdPcBn+J:Iv22Im4ETduhGYQLwKQVV0nzNd0h4
TLSH
T186E2E15073B8251FFBCA44D28E6C7522AC4B3286742F193831CA853E51A2F679B519BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 779KB
SHA256 1f49dffce17ec30e72985869ef990a21e0c88b40423c616d1a1923aa9791f0a2
MD5 9ef040ed40c693e27b6a0b2d934bc729
SHA1 1fda5427221019870d8f2f991396d1ec24bd1808
SHA512 1cfbaf89219288ce6a1eff409afb5bd7e21c941fb26de45c0fd6d5f835e7fcf64a498412bea2cfff8e9c1b15eb5857000df809cbfdb7044b009dac1296eeac62
SSDEEP 24576:Qar7EGlkD1WD3kTyicvD8iCQY62rHoVGTy3V5wD:QaUGaw6y9vD8iCQY1HoVVFs
TLSH
T1010533B470B6F9676B710F2C62979F18B4DC14391F505E4029A12AE933B7B42FE12E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 20KB
SHA256 304cfd5ae094c88c7ee18bc7f7d623b3f0f3d5eb693d6029f898eb6f5a45e072
MD5 4c70497e6a3e8d154a3991ac43786f7a
SHA1 182122f646b0295438f21ff731e09c9f0f592fd5
SHA512 f37de7b9eb5dbbf5b94720e385e977b9452decdbe2a934b7b0ac982da104db49e1cc7f271f1e2f1564b4c82640833b5ebb1c44c8136c659b79d4bdf2773de30f
SSDEEP 384:xMa18zhjmbuRKnbtKMyD63g2jFEvB0pK4Cj9jAzd:GavhnbU3e3gZGCjRAzd
TLSH
T19792DF0769B597414362D673CF2F824693E92634AA5C864B383B0D74FBFBB522978060
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 61KB
SHA256 12e0983c76bab1b708facdef04b15e4342b2608358c4dbe62022c87761a19daf
MD5 6def29fc64ee7fab9a301f6c0e38b6f4
SHA1 ad756aa9cd7aa21d5f479bc6f2df34c9f264c268
SHA512 dfc381182158a632587742d7e6af29898ef7e5149284dd346e77e4065316af7c00b5e58bf8626ab972133a486494e1275d7e5a3aac9416cea1d8350d358ff1e1
SSDEEP 1536:JqogBmbI3UPP25GWYCCptAhKtThScuU76tXxMLCNZ/:9gBfEW5PYCCLOaThduUSXmCNZ
TLSH
T18653029176DAFC074C93B991F210CB885BCD0A7E938EEDE9E3CE4A34024415DAAF8117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 16KB
SHA256 50cc58f9b8e891a75ed0b40ed052e0137c1880fe07638ff67a92491f596924ff
MD5 ff2d60125c235b04d8ca4964f53c8117
SHA1 3cfd80287f85b9fb167d513d5b7a32c9d1e6706a
SHA512 554217fe15c52f2ce498ae7c186464b2def887bc70b4fed2d27973515c08ec84c127fcaa88e2ccd92eb1f5ff5889e31d35162360523598fa26ff84b71da04e11
SSDEEP 384:THtuzsKwzib6zOJ5eSXjT+2H6LztMNPLD1CC0ZCKVy5:TNu+2c4LXZqtMNdKZCgS
TLSH
T16A72D08D2B379FC922C06EC3AA41B73463F4B116497A96A7B55907D3AFF22650A2C421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 29KB
SHA256 2d3fb05921f90db25a4198212e0c58aed7ad1b5250f0fb9e75c674ec2b675a8b
MD5 4b02d31233f6b4ced00fb3da5afea7b9
SHA1 9b45f6613c8124f81d63cba339a9ce917db6d966
SHA512 93ddfcc8d23df0a7b8660eac652650f8b377b1431c0eff97f40bbac9fa0d6512a3c443cc0e488033e0aa399a248e60a6a8e59cd0b35c9eb89e4cce617af10b53
SSDEEP 768:Mi00InbcPYlGelhvi2ABooU3wgCcqn3cc0e4:MianbcCba20ooU3ZX8cPe4
TLSH
T120D2E10D4421EA8A389C5B6ED7EF61DA803BE0F4375F99DDDFE0F0052D78B2A0458899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 270KB
SHA256 9760725e55a55783cc56804b1015a84fbeb2560a441545124d6a7660fd53846d
MD5 f09775b6f0bbc8c60b0e24cec0376280
SHA1 b0d41fb47346ed62c0df597aa3f429ba5333b121
SHA512 5a3dbc8440619d08335ca49c99db19a4db03f1eac09999d441d9953387498a6f035e5757da04039d4c034ad41f388002fae4031c9a1d05f0c2f9f8a6702da347
SSDEEP 6144:fHxiPMwXoEaxfDNcfS4C4APtoo4oBcg+J:fRiEa4cfS4kPtJ4zlJ
TLSH
T149442370E832A0D88B84F852F069BF6C73E57353EDE1971BCD18A933E7AA5025A71D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 346KB
SHA256 12d9d79dfebc7af3bc8f51865b297aae3799b2fa2ce9d188b5741e85350062ff
MD5 a34ac27ab2e9ba9da6a4d1430444fe6b
SHA1 358cb9f7f84a731f77a3f1dd0e4057659a29a224
SHA512 1a2185d4ff72d4d8a759938f1a042d6dac394e83c405382b596e7df04822d6698568be11f51d7b6e26a7bdf4bbde0775ce72f379d28dd66d908a00205d88b264
SSDEEP 6144:5JterkJiB53lK9lud6XRJs4GqwCXjiKjvZbJ7qVZQf/C2v4gOcpv6kWWNbe:5ebsk6zGqVZt70Qy2v4gth6F
TLSH
T19E7423452F6F760DA5489B60BDDA36A24C665B7C460178FC9213C6BE8609FF9D2CE0CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 233KB
SHA256 8d222911d338dce12bd73924a24e5fc9de7bf56ed6c9cc0a6755643903327e9b
MD5 15c511bc63fcaa336898a2e905c2940d
SHA1 db1d2c92abafba3f48defe5fd727e5c4a9ee15ee
SHA512 1034d7ac240df1de1ba5dc49c14a18d5e29e6e565e88e762023d5356b136fd6b877e5cbcf0199d5f5b680a2009193b2ac792a52a7b546f414dbbdfbaf338dd5c
SSDEEP 6144:31cIw7yfYCRKPcnryIrbKNeMILxuB4JnoFwI5:31cl5boOIr8ILxQ4JoFwU
TLSH
T13C34228879A55972C8220DD6E738681C47FE5CEA6CF949CE78393730CF6590C85EE272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 50KB
SHA256 b6d353161f0cce0289b109a6ebd9f7c2b7b52949e8ecd769fcc7c1f418837aa3
MD5 455691c52d05cb81f9e076ac31806ccc
SHA1 c6f928714098af5d2001883c68a22d351d79c4b0
SHA512 5555a6536ff6ce54a34269cd93c239b8bc3a3d902cb6e0f9af72235ace184dff7ca5c5edd4b8c36769fd68dbcff15179ef592195c7201a0c848165c59a38a07b
SSDEEP 1536:9BAeWXdr8DzBuG3aeCa8U/H+sayNq2riy3rQ:9ioH6eCad+shJz3U
TLSH
T1D633F12BB6D3689F710E901328A8E84791ED352B1C7BDECBDD422CD635E66E3C946D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 55KB
SHA256 02692fe47709a8b3bd9e81d9f412d4d71b96da3c6bb980ab6c6ab9a5e95aadbd
MD5 a7f06f31266ac5e84485717d3fbd9d88
SHA1 12936e18cca77dddbb5d58ae7fc1abdfc6acc182
SHA512 d7960819a55bcb25c8a1b32ea074c80dca8d06a42f5378fb3e1d0371fd795d8f2990617c18a6949019227d903abb0d98910f596541789be2e2a0f50c4f513dfb
SSDEEP 1536:lbkdqqqaTNwMXsTw0asPIZQMah3NK9Qp+Lil03xR/FBOx:az5sTCWgaZk9Qp/l03v8
TLSH
T1CD430264E9E4CE143A1A9847CFD5A0238CA7810C9BE257519CFCB8ED9B431122BD3B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 672afdff2786b786db3da78afa2acd21141bb767c646606e3e041a13a061751c
MD5 35aa407ba9cd5658484877099377b764
SHA1 323f442616cbec44a9878afa64a2024ccc6840a4
SHA512 7b998da0603d88a0a2a9de290d5693d71dcffe742ac71d76232517d59b7ae58323dc94137fe8c04e6babfbabb9a6176b7d546b89983fbfadf73c9507351b8cea
SSDEEP 96:BZDKouKxUHUlnaulmcCdyYo8lRRvScHkM0X/fRRGeU//kQRNd:BNKouKxUHUEulmc45RsMmRRVU//RNd
TLSH
T11FB19291B78D1F99EB79103848DCC9AE26F8C4876D822E1E0764F9B8B7537DC5094C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

641867e4-623a-48d6-8bc0-052dd02b4a99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\641867e4-623a-48d6-8bc0-052dd02b4a99.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

58946060-1aaf-4e63-a872-923407457785.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58946060-1aaf-4e63-a872-923407457785.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a6358db6-e67a-4b1b-a317-5dad0e342963.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6358db6-e67a-4b1b-a317-5dad0e342963.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e616d021-1bb3-4650-a509-f4ee0e359973.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e616d021-1bb3-4650-a509-f4ee0e359973.tmp
Size 12KB
SHA256 1e8f2b4e7c0e3840565dbdd9a04383f2f780a3a07c4088f12cb55bd444db8a05
MD5 e4cdfff04d392c06fe0d2acdd6608b4f
SHA1 4861da0ecceeced548095baae499f915407f1686
SHA512 deac66ac87b3c4c67b1b812849676baf4a75305244b454809261265d2dcf07cc80918030ddf15eb7d9e884e224234604d8c0943cc93767de01927c7ca5f7bb0d
SSDEEP 384:DYUalns59s5eCe1e89BedAGZT1scyGPBs+hjsl9rtCcVnaey7QilRmsVRs6pJBRW:L5hh8wegwm
TLSH
T12D429CB7D7E48B5DFB1162F8A6162E1ADE2E8424439C3C5DC8E89F4E93F1431D18294D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 78fc80d0d72c853aec5c1eb26b4b8103c70694f446bf2cf09841eec0bf2556ee
MD5 b6c146b1989079890b1560f44eb34bfa
SHA1 57fb030839ebaaa0286e8e2fdf2fbd8150479d34
SHA512 429d7a677a0056eb9cc652f2577454e3cda63127870de8110b48ccf8ed68c8ca9550420726305cff751a56cf5f142ccee44d62e97a7ef22199934e688efd31ad
SSDEEP 24:K9r8fIfIHKDhW1ySytbyX3gPYUWItKshQ1uSJWOkTU8yINKAhI1WSFK9yXY/8U:KkwIHKlWM7yVRItK6QI+dINK2IgXyO
TLSH
T1C791010133BA0642793D692955789B9F566536E2346CE92F3FBC45B24F2AE040EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e604081b-9a24-484d-b887-ce6821d20c84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e604081b-9a24-484d-b887-ce6821d20c84.tmp
Size 10KB
SHA256 a6e9322345e0652c980cd6db35cb1514b11b40bb6b254fd57f4c2b57c5a70147
MD5 57b2e43a7487da6c457f7570087a0432
SHA1 7d2f34e843b8e8e3df540237d89152e26a3e6bbc
SHA512 b28a29a8821e2ccb05f2f49ec4dabb355b1784d8958068204e5db11663ff9ae44da6a566157252b2050e0e723c74d63302ffa2ea72de4d2082bdb0b0926861c9
SSDEEP 192:sxZURlW3/fEsPmIdpC8HW6+WNdZTMXYtfa/UIg5UJ:sxZUG3/fEsPHDHbUX2C
TLSH
T17122B8126F34A97B8CCBD209BB55BF53D6F95032A1D41E48AAFC8A1C04E67DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bd1d3616-f8a6-49e0-be08-6c6b12fdf5a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd1d3616-f8a6-49e0-be08-6c6b12fdf5a2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd8fdd1e-fbfc-4d3b-addd-4926882eb1a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd8fdd1e-fbfc-4d3b-addd-4926882eb1a3.tmp
Size 25KB
SHA256 c83074d13c767650bf403c00ccb3b33526c3d63442be155d422ab73e6854cde4
MD5 b7b9ab5d1d409548a86c977c46e27596
SHA1 09079895c5032a161ef8eb7c923608d3122dcdb3
SHA512 db7de5d15ff0deb5fb635005636532364418245823fdf5c8fdd0441e1964633f5d428149375efe554e9baf1968aa39fb4c345c2d3c53a65383da3ee40346c734
SSDEEP 384:1iFzQkUSv1zsND8TUNTUlIlkbat3LTbc5F4W9JAfh3+2ydOiiugEWt3glE:8FdNqwgF7cbjQlydJuwlE
TLSH
T15DC208F568D74836DAAE8B03A77E3E038E7CC167B5C46A50B788551CCC8A1BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d995ba86-b96c-4616-856a-ec1bdf087728.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d995ba86-b96c-4616-856a-ec1bdf087728.tmp
Size 8KB
SHA256 a45f2412bcddd13d46fc659045dd09daad9d8821484a357412dc4b4b1bf91506
MD5 05407886248c5de39d63fd63a5352ae9
SHA1 c7ac96719ab21b2ff9d1427e9f8f63ce201735aa
SHA512 7d19b07b01da4ca7e593c5445bacb980d9479ee839b703c815c20ea0851e6d337829a9ab95ac3f4854931d8327200a927cf1666966573f86bf0a0edb84af1151
SSDEEP 192:RONc6v6mUdQmiUybMW7e4W9JbUfbF3+2apo6q2iU6:RONc6CVqp7e4W9JAfh3+2HOiU6
TLSH
T156122B34B8B8682B5DE39954F48736178EA8822BE7C97F90D5DC2A1C05DF29C134B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de202048-4020-4e76-8f8c-76077673eeb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de202048-4020-4e76-8f8c-76077673eeb5.tmp
Size 8KB
SHA256 06d5ff84cf80f2f87c44a40cd1f2ae877b1b73f37bc1b01975c8555c12c343b0
MD5 2821482d6660b016da097bd7caff7073
SHA1 9b11f5178e2fa6a25061773541da802a8f0ee926
SHA512 b91c87427aecbfd05f413993749b390829c86986322e4a913fa5595bff9d957dfe5ae3c07d20e5d17171b7a608b5bf7cbd6f85d46175e670463256fece1870fa
SSDEEP 192:3ONm6v6mtdQmiUyYWRe4W9Jbs1bQKLiU6:3ONm6C8QRe4W9JKYU6
TLSH
T13A02C838BCBC687B9EE79E09B88737179FA4113BA6952F94D6D81A1C00D728C1317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7f93242-8852-4cc8-8232-9bc514998ea0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e7f93242-8852-4cc8-8232-9bc514998ea0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 355fdab33e4e2a5c5e1f47d3f1d1831b69abd79521cb56fedf7ecfdc173ba01d
MD5 4c1e43b5a8e0096876e0d72746c8fe08
SHA1 9abbb3d637df492534033f0bc4c30c0da75122b0
SHA512 fc8622835dc076071e983f535a81523cd1efa7ba98c93320acea329328dc51868eb079e9b049f0ae8826f34d6bf6ea04d37473a81f69547cbf3113ac5d4255ee
TLSH
T12B41FC5866E92148B3B76F1A9FF6B4AD847F7D672F0AD09D10110D4F0662A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4732-314-0x000001DB18A60000-0x000001DB18BBB000-memory.dmp

Download

memory/4732-352-0x000001DB18A60000-0x000001DB18BBB000-memory.dmp

Download