hxxps://www[.]columbiagasohio[.]com/home

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
31s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.columbiagasohio.com/home
Sample261027-rydfaasv2r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{114F4BD0-58CE-474C-9C49-84565B76732D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3408	2464	msedge.exe	86
PID 2464 wrote to memory of 2076	2464	msedge.exe	87
PID 2464 wrote to memory of 2816	2464	msedge.exe	88
PID 2464 wrote to memory of 2816	2464	msedge.exe	88
PID 2464 wrote to memory of 2816	2464	msedge.exe	88
PID 2464 wrote to memory of 2360	2464	msedge.exe	89
PID 2464 wrote to memory of 2360	2464	msedge.exe	89
PID 2464 wrote to memory of 2584	2464	msedge.exe	90
PID 2464 wrote to memory of 2584	2464	msedge.exe	90
PID 2464 wrote to memory of 2096	2464	msedge.exe	91
PID 2464 wrote to memory of 2584	2464	msedge.exe	90
PID 2464 wrote to memory of 2096	2464	msedge.exe	91
PID 2464 wrote to memory of 2096	2464	msedge.exe	91
PID 2464 wrote to memory of 968	2464	msedge.exe	93
PID 2464 wrote to memory of 968	2464	msedge.exe	93
PID 2464 wrote to memory of 968	2464	msedge.exe	93
PID 2464 wrote to memory of 4872	2464	msedge.exe	94
PID 2464 wrote to memory of 4872	2464	msedge.exe	94
PID 2464 wrote to memory of 4872	2464	msedge.exe	94
PID 2464 wrote to memory of 4268	2464	msedge.exe	98
PID 2464 wrote to memory of 1032	2464	msedge.exe	99
PID 2464 wrote to memory of 4268	2464	msedge.exe	98
PID 2464 wrote to memory of 1032	2464	msedge.exe	99
PID 2464 wrote to memory of 3892	2464	msedge.exe	101
PID 2464 wrote to memory of 3804	2464	msedge.exe	104
PID 2464 wrote to memory of 3804	2464	msedge.exe	104
PID 2464 wrote to memory of 3804	2464	msedge.exe	104
PID 2464 wrote to memory of 2908	2464	msedge.exe	107
PID 2464 wrote to memory of 2908	2464	msedge.exe	107
PID 2464 wrote to memory of 2908	2464	msedge.exe	107
PID 2464 wrote to memory of 4104	2464	msedge.exe	111
PID 2464 wrote to memory of 4104	2464	msedge.exe	111
PID 2464 wrote to memory of 4104	2464	msedge.exe	111
PID 2464 wrote to memory of 5080	2464	msedge.exe	113
PID 2464 wrote to memory of 2284	2464	msedge.exe	114
PID 2464 wrote to memory of 4272	2464	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.columbiagasohio.com/home
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85e7fc188,0x7ff85e7fc194,0x7ff85e7fc1a0
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,17708175712568180420,16109920498249279427,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5907174317935519637,2418629348896054759,262144 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,15245027033075162545,9811995554819148874,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,595331315997318647,1219868596557648818,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9640898947706827031,11653865238850054818,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,11901256979694048486,16637969811921915058,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,741347519232648618,8514639383633183220,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,707424423188915495,8126921853843669330,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,7531107912636901781,2343257336762376359,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7685238164835497948,8006707182217858835,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7685238164835497948,8006707182217858835,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,15711777134285381220,214538504362488047,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,6604077550370525051,4327126490200288233,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4556,i,5497956047373456713,13130191868239407154,2097152 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,1151026831654629021,11055611449779379478,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6028571599328788175,9382711861959447599,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17524441058759756627,2685126026168308495,524288 --field-trial-handle=2192,i,12280163588816113666,10721701001566155595,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5f93b1cf-e4b7-4400-9a3a-ceef8d96f5d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f93b1cf-e4b7-4400-9a3a-ceef8d96f5d7.tmp
Size 8KB
SHA256 24f699eb95ab03c6eb07503b3f04d2162a03d3238469194aa8501f8687fce45f
MD5 ec22e9b897e8b5fb01063599714cb141
SHA1 214ae65b6009c5ec2dad068d328e72ed031f2918
SHA512 af68e195d683e2826e0dbbf119457b362e1cf62ce37a25ddc724d48824d663531d638682200a9573f40e5f82816813ebe6279dac24a25e3d1c41b223948f29f7
SSDEEP 192:yONlp6IEPQmiUyPsTLuIGmAcjzor5RZtDXe27Hiiq8U6:yONlp6DR5LuIGmAs8PDXnHicU6
TLSH
T138120936ACB8EC6B9EE3A944F44735239EA58127E7C86F90D5DC2A1C01DF25C530A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6181d435-7f5e-435f-b716-13a2626f3d7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6181d435-7f5e-435f-b716-13a2626f3d7d.tmp
Size 18KB
SHA256 9f259bc4d6071aaacf9afc649ed78953d0654b9d96173e99660f79f9580805c9
MD5 6041e51dcf5ba6e676c0d22d45ee0fb1
SHA1 e724ef63e7391aed28278e92988eae8407d76f4f
SHA512 07837fd468b84a4c7fe2480a7fc4ff70d3825d887b658313953aa96a331e160230a12ef407018a1a9f91408f6cf4774a86df1c288a37eb00ff7547c2a234e1b7
SSDEEP 384:0EvFwPasu9sNBMODmK1bXpzIGmAs8PDXviicmAk7f6hK8N:0E57K51LlLviicmAkD6hPN
TLSH
T15A826B329C74AC375EE3AA54F55A3623DEB4817B97C45F60D6ED6B0D00DE3C8130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

334d3971-128f-4953-90da-61b9235ac609.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\334d3971-128f-4953-90da-61b9235ac609.tmp
Size 10KB
SHA256 bc5e72c9ea2daeeeb86f8fc80357ac71c80caca2b4742924815f945a18d41ab0
MD5 e0971a6a135683a45780135ba14fab4e
SHA1 ea7ee80653dab490578faead60eca6abc43941de
SHA512 3f889762a68274aaf6ebe4a19a0701155be4b196c4143b9f42b03341ce59822b5648441a260b2a97ecd73678276438e37bdadfa9cd9e8d2af76208106551a826
SSDEEP 192:sxZP0R3WPe/fLsHonk+Idpy/HW6+WNMsT/YapR51N9IgrJ:sxZP0km/fLsHon8MHb7/fT9
TLSH
T16122A7126E38A93B8CCBD609FA65BF13E6F9503291D41E88EAFC951C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e9344ce-9a9b-4b13-8a1c-a8a6aa1d90b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e9344ce-9a9b-4b13-8a1c-a8a6aa1d90b7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fac138f6-6081-4408-988c-4db8389b12f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fac138f6-6081-4408-988c-4db8389b12f9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

16c13c93-719f-4e5f-96b1-06c4dbc727af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\16c13c93-719f-4e5f-96b1-06c4dbc727af.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c07e3814-13f2-4d00-b463-24f946f19adc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c07e3814-13f2-4d00-b463-24f946f19adc.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f973c8d6ef1821265748c772e5e2451ff49077a52be81571f11dba0410c71e90
MD5 8caceb361247df0e2df7e6284631900c
SHA1 3127e54b6cd8cd22d2c85e79ee07691681725617
SHA512 ea44939c5fd07a3601c5db2742dbe824b3cc7eb965dcfbe9301f4e00bea1b8e9302da8be566dbaa04c913055e283a2a10895c6b9efc1b9f4735ca30158fe3f2a
SSDEEP 48:K036j3Z5JibhMRISHiK9H1tixnyYkV3LyLRAthrvzMb/KXIS5MK9Z1zMxxcYKbRe:Kc0AKla+CaQKTSMr6KIIS6EwKRyY
TLSH
T1B1B1F21571BB535038BD294880B6971E528231B33658E62FBFBD00F64D6EE484DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be54f424-fa30-44ca-89d4-6a0d966cef0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be54f424-fa30-44ca-89d4-6a0d966cef0b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f985b8e9-d695-4e12-b10f-39364e1e10de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f985b8e9-d695-4e12-b10f-39364e1e10de.tmp
Size 27KB
SHA256 30a5dd18c98a1cf204d6420e75779eb83ea4add6e60a3ba49c0d3d629e38c88f
MD5 b1bca021ffd8a4e57cdeb0e0e70e071a
SHA1 1b95ad798b89de97b93b4b6b0b0ac7d3e9288ba7
SHA512 58d61f4db9628b34207d3033920f8e5112ee03b06567ca9743509f14cdf5c7f8caf396a288da2eb1009dafc803cedbeae9b630a406e692b97d8cc6c23bd1731e
SSDEEP 768:WeWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy71ro4AfebmRV:WeWPcLKWvKeEeu1jaClLiF7O4AWbmRV
TLSH
T1F6C2EA3B640CCB7E5FC01A9DDC5A6FA76E9802C79A644D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff6c878b-8ffe-4459-b6c3-481731c42952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff6c878b-8ffe-4459-b6c3-481731c42952.tmp
Size 10KB
SHA256 e95321555d01c0b74caf027c5d18e4407202dbb32ef80070e6f74f3e36e93922
MD5 be0cc30d2c6cfd901a3f803ffdcee9da
SHA1 058a936d375aa428933af9444abec798a0be1fe3
SHA512 abc791a2070cb32e656e41bc2488c87e7d34c7fca4a013dc0ab6cbe9a060b398137661ea898a3d5a83c25d5b50734a42a50b0f4536045ca7ede0ae33466d99aa
SSDEEP 192:sxZP0R3WPe/fLsQonk+Idpy/HW6+WNMsT/YapR51N9Ig5eJ:sxZP0km/fLsQon8MHb7/fTQ
TLSH
T15E22B8126E38A97B8CCBD609FA65BF13D6F5503291D41E88EAFC951C04E76DD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcad1a1d-3804-4892-9cf5-27f336c9ff5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dcad1a1d-3804-4892-9cf5-27f336c9ff5d.tmp
Size 8KB
SHA256 8d5d1495653764f866baa0ab9743cc960b5185b9efd8c5254d6d1ddf94233d08
MD5 fdfedf8501bf32f2f7bfc72cfdc17079
SHA1 f63f57d122ecf512da0a8176736140641e61fed7
SHA512 3b2ea116a84927cfee7b9d74aa67b10b22a31f7ed3432f5a461b9751c586d0a565f3713d5269f1cb0967898fede46aaa02114d2b964273552bd7b9b730656c53
SSDEEP 192:aONj6IE7QmiUyTsTPuIGmAcjzor5RZSC7sizeeU6:aONj6DtLPuIGmAs8RsiaeU6
TLSH
T15002EA35AC787C7B9FF3AD09B4873A239EA5112BE6952F94DAD81B1D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 685b85d1ce609ecb9bd5d35ae06973c6782c7e492cb7140ef02bcf566d6ba959
MD5 1bbbe4c1e1b049ab7f75b527c4d0e588
SHA1 ca661634e74f208f64f75b63d70cc7d81b02f643
SHA512 3c5dbf8b5b2a975b8a3a2f0394fa119ded101e89ee2554f8748f3017729e77cc9788994c148a00c6614073cb6408478633c7ad3e0a693d229fd4a1f204015e2d
TLSH
T117412758A6EA0108B3B76F56AFF6B86E487A7D732E07D46E10110E4F0623A40C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads