hxxps://www[.]dropbox[.]com/scl/fi/w74kylcode9d59zqgkhdt/Sit-SteuerungsTechnik-GmbH[.]paper?rlkey=d8gopyatii2psnzjy4jku29f9&st=vxdcohiq&dl=0

Analysis

user interaction
yes
max time kernel
112s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/w74kylcode9d59zqgkhdt/Sit-SteuerungsTechnik-GmbH.paper?rlkey=d8gopyatii2psnzjy4jku29f9&st=vxdcohiq&dl=0
Sample260702-mcec8set7n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274611432921388"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{47A2E866-8843-4495-A045-B396A7197A5F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1856	368	msedge.exe	85
PID 368 wrote to memory of 3284	368	msedge.exe	86
PID 368 wrote to memory of 4060	368	msedge.exe	87
PID 368 wrote to memory of 3284	368	msedge.exe	86
PID 368 wrote to memory of 3284	368	msedge.exe	86
PID 368 wrote to memory of 4696	368	msedge.exe	89
PID 368 wrote to memory of 4696	368	msedge.exe	89
PID 368 wrote to memory of 4304	368	msedge.exe	90
PID 368 wrote to memory of 4304	368	msedge.exe	90
PID 368 wrote to memory of 4304	368	msedge.exe	90
PID 368 wrote to memory of 4572	368	msedge.exe	91
PID 368 wrote to memory of 4572	368	msedge.exe	91
PID 368 wrote to memory of 4572	368	msedge.exe	91
PID 368 wrote to memory of 4640	368	msedge.exe	92
PID 368 wrote to memory of 5032	368	msedge.exe	93
PID 368 wrote to memory of 4640	368	msedge.exe	92
PID 368 wrote to memory of 4640	368	msedge.exe	92
PID 368 wrote to memory of 5032	368	msedge.exe	93
PID 368 wrote to memory of 5032	368	msedge.exe	93
PID 368 wrote to memory of 2880	368	msedge.exe	96
PID 368 wrote to memory of 2880	368	msedge.exe	96
PID 368 wrote to memory of 2880	368	msedge.exe	96
PID 368 wrote to memory of 1260	368	msedge.exe	98
PID 368 wrote to memory of 4216	368	msedge.exe	99
PID 368 wrote to memory of 1260	368	msedge.exe	98
PID 368 wrote to memory of 4216	368	msedge.exe	99
PID 368 wrote to memory of 4360	368	msedge.exe	101
PID 368 wrote to memory of 3952	368	msedge.exe	102
PID 368 wrote to memory of 3952	368	msedge.exe	102
PID 368 wrote to memory of 3952	368	msedge.exe	102
PID 368 wrote to memory of 1776	368	msedge.exe	114
PID 368 wrote to memory of 892	368	msedge.exe	115
PID 368 wrote to memory of 4360	368	msedge.exe	116
PID 368 wrote to memory of 4932	368	msedge.exe	118
PID 368 wrote to memory of 4932	368	msedge.exe	118
PID 368 wrote to memory of 1808	368	msedge.exe	120
PID 368 wrote to memory of 1808	368	msedge.exe	120
PID 368 wrote to memory of 1808	368	msedge.exe	120
PID 368 wrote to memory of 3808	368	msedge.exe	121
PID 368 wrote to memory of 3808	368	msedge.exe	121
PID 368 wrote to memory of 3808	368	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/w74kylcode9d59zqgkhdt/Sit-SteuerungsTechnik-GmbH.paper?rlkey=d8gopyatii2psnzjy4jku29f9&st=vxdcohiq&dl=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa9aebc188,0x7ffa9aebc194,0x7ffa9aebc1a0
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12089326289634667288,2372440669075341959,262144 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=276 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,3801118800755665707,16313393786570971574,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,4479662955616363879,6409341847540670915,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,13087512239580164571,4450178795645849348,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,15790161894472395891,10674139750798269304,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,8076892460182567714,17590175261562561016,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,15323500243378573988,8377300895688807253,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,3932710902506321068,403955370969473454,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,12768838102313848358,14152601048778201483,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10415865430165112750,14449688900568558892,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11469874740818885124,1541231117773154025,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11469874740818885124,1541231117773154025,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6256,i,14248577758028575528,14208719807253299453,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10330140385079713521,16944811298158110936,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17328074416994004161,1151178725622244470,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8809592804043544564,15373632550166781241,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1105419066517168393,1076673054943164308,524288 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6556,i,6752302687049509056,9946490986280977131,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6560,i,13203007897861068864,17854908745368721711,2097152 --field-trial-handle=2268,i,18136463719190502522,12398425486554664088,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7fa943ff71a6a869db8c285327117203245791808298c03ae6ec0e284036387d
MD5 ab955abcf0f917a9e71a1ba16a5b5d5f
SHA1 e4d291a52f3f24cd0128f07a35333047f3616801
SHA512 4d22af6c90d8051914919e820bb4a09c2746aaae9ef1a3e24917bb2e2172acb09b8aef342ff8e46ef7297d845e049e36f9e3f4237dba0ca53bdcd483febe3a62
SSDEEP 48:MXYOtmdu6VaLbEegWsUFrfC0u4Dr0tGq/LQvtP5lEQoSW7jts6InzflvCjrZnU9X:+nhL7egrfC0YPLgz2Qo06Inztvir29P/
TLSH
T1AFA18171E293C4F8DFB7403180E58A35327226D7FC8ECA626C9E66B8254E3D18998504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bb20f7a79b4e9dcef708fe57717e58728225066190fadaee76de9c7d75280745
MD5 3a5226af4a4734096116b6db0bdfdeea
SHA1 7f91462ea0899a966f3d225642e40f22bb449565
SHA512 d3f7b71b6e7e24e9835e22aab8fbbeb9ad6ae6fd96d88f372d275407bf129ec23afa2fb2c45a7ccb39d6d4ef0357b952112363d35793cba62796dc84ff491991
TLSH
T14481A8F387E1862EE91152F5AA146E1FCF6C1924532C3C2AC9D5AF5B93E3472E00164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 27b2604c99f70ff13f8259824305e95f8bec2e54381e2181de0033e8c78a7e93
MD5 be3494bcd4a311aad2a7297c7a5f6e69
SHA1 0dbf44aec36d94488f989f228ac499d2783e499b
SHA512 b719a9cd8e9f530bf814dedcb8b29f83a882e518be8db9c91fbbe9b2f356e96636c5d83f8a3f09ddcd470d558d4669cfaa31b6fb6d497c37bb126f7a89d2d057
SSDEEP 192:sxZzRIyM/jK1Ml8MkM/f0szCcA2SVyIdpWi5HW6+WN8gJ/YvR09Af6IgrJ:sxZzmMM/f0sGcd2nHbl/vAS9
TLSH
T1A152E852AA34997BCCCBD209F951BF53D6F9156392900E44AAFCCA0C05E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b3d95f7fd14b2b422843f1970ef9308a589776f3fc78e33cd1e1e301bbe23e59
MD5 69ec249862b85e9348e2cd792e47b621
SHA1 06d0e4b06a8df4f03f61bf88775f5df978aa7c3d
SHA512 b7bed8dced5f481f81223f59f649df4c84d210cdbf760fc1400b03993b43a8f5ac0da9b8a90b7e25281c440aed8a65fb9c245f265c5ece38c399dba1bf6aba16
SSDEEP 192:sxZzRIyMojK1Ml8MkM/f0shCcAQSVyIdpJGi5HW6+WN9r0hgJ/YvkOz9lf6Ig5V+:sxZzdMM/f0s0cj2pHbqy/TUlSj+
TLSH
T1CE62E752AA345977CCDBD209B945BF53D6F915A392900E44AAFCCA0C05E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b96b0d4aebb59629f51bda7f8476f1d79c623dc5cb6ff4a851ed7109619e681f
MD5 73c112f3787247109cbae682190423dc
SHA1 01a5aaf67c1bd270cc1d7f3281cb501df69d6ed0
SHA512 f5dd043986e94b9081f93542182dfec9c67e30f3e82f309e88560f05286fd638f70647fea43631e9f915c749c04ca28a16fd0a73b92db2b4bc51ff7637c10225
SSDEEP 768:wqseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppProK1:wqseJ3xWvhfynu1jaVcL88pcM
TLSH
T11AD20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d90415aa72683fd3dc14bf990245d8ec3f486c09b42677c9193192cf083b86a7
MD5 b834702a21cc0a15dfe6b36958f6a094
SHA1 8f3c53c2eb95ad237506eb49273e06e5b9f20e77
SHA512 597d54d44467b396c7e8560f860f6673633de6eaaac25baf9d0bb99bcc3758e65d5720e5ad62cc5be9760aaebfa252a389b5add93014750bac039f91e043b8fc
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUhk/oNJ/9dRz:KYH+KggmKQIKpieqcAKN2z/oNJ/9dRz
TLSH
T1AE916A12353B074278BD2458B2A695379E4137A33418796F7BB840A24E27E626EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38621cfc-5207-4bbe-8d90-fbf5bc8a6321.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\38621cfc-5207-4bbe-8d90-fbf5bc8a6321.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4cd5d5057328198f21e494c0d31ec6741b83deeee15c0b5e310fb6dfa1fad7d4
MD5 73b01516f5fedc532ec728facec2a8f0
SHA1 be267295c767eeb5ebfe2f4872825c206aeff840
SHA512 c2d9c759e0781abdb68dbf3c36c6008b206a23f16133b24ef925f6c26295c2c0ef2426ef067c35ee5688c860f5352957e3a346ccab44e49f61d00b2ca6d344c9
SSDEEP 192:u7TSNWMsnMcPPQLz3XX9VofsNj1Q6mM7HfqQmiU1Hp9J8BMTA++FdLCgFd3Eu8zH:AtNn/s3n9SfsNj1z7/mX9J2NdtdUvtVF
TLSH
T1E1626B72AC745D2B9EA2E584F1463B039FF0916B96C42F94E5EC6F0C05CB66C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0de2b98d7d3075645e8e2c0ef6af05bdcf0eef4cb920bcb2d59e8f3fa967f319
MD5 9dc1c03a6b9bd9bdd7a585dd49b0cadf
SHA1 17193a097b761d04b6e6ba0eade456d8be24b204
SHA512 d64ed2b1dd7a6bea1f8700278e0db7d850cb1093a88cdd4de8a13d923f2296723b16a16a817afead834188040b6b13eb1bbf4d5226dc4a7cefc243baa278aba6
SSDEEP 192:lONF6vMtPQmiUy6/ThTA++FdLR847I4U/u:lONF6UtR5T+dVlU/u
TLSH
T1A7020835AC786C7BAAA3AE49F48A37175FE4216FA5D05B50EAE82F1C01D764C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 58e28bd2a0f0a134b2103c2dfabd2c99792111aef4c8b2de2381fe8955e2b479
MD5 eb41b0d5a6345a99262f1031eba6359f
SHA1 193a1fcf475b3fce33a59b2579d3d5e25dd114c8
SHA512 a20c1fe94c8e34e7abe44486cbf59aae891e3019f6fc65e23c0a330381c169818f123fed90dec10f5fc4131c1c4f95747c6fa58de252085a10d6fb5cc6742043
SSDEEP 192:4ON26vMFPQmiUyE/ChTA++FdLCgFd3EK80IZqAU/u:4ON26UFR5C+dtdUTtU/u
TLSH
T1CC120A72AC689C2BAE93B545F48A36135EB0926BDAC46B90F6DC3F1C06DF65C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c34515892124ce4e5b1ca4e3649dd49c690bd3c9d82adfda1a8642417040b10a
MD5 7d15753e2d71c430d505bfb644680657
SHA1 5fb3f2e117e615d1e3c55ffd700e2cf4552cbd0f
SHA512 c7547cb7aa923a3ac16ec72237e93eca219b4ff6abb0f4601966bd60a312e6b92eff46b51774f00cb5fc466e9460b5d342be8bbe12e718ccf2d2c42b384c6f4c
SSDEEP 384:xwiF1tNn/s3n9SmzsN98TUNTUlIl1z7/mW9J2NdtdUJtVF:xLF1j+9BMwgn79JwBUJtVF
TLSH
T1F1B2F7F258D7893AD9AE9B47E37D2E025EBCD167B5806A50B3985E0CCD8A17FC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 0096f3ddce3ac1c21d280828f28322e3b94185070adba47419227271a034b0c9
MD5 67ce3afdd91703127734fbe683071631
SHA1 b3d84e05f7f81a11caec4af7ec751042ce9bb055
SHA512 911b2e9fc82d158d609a8b2335a0ee29ce67e8075399486f05630536e199dafcce1785c10a18709838dbd18c46183ccbed587cbf72f778d8593f06c52152e1cf
SSDEEP 192:u4TSNWMsnMcPPQLz3XX9VofsNjmQ6mM7HfqQmiU1Hp9J8BMTA++FdLCgFd3Eu8zH:FtNn/s3n9SfsNjmz7/mX9J2NdtdUvtVF
TLSH
T144625B72AC745D2B9EA2A584F1463B039FF4916B96C46F94E5EC6F0C06CB26C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fadeed833aea066f8cc6f083034567f92681d0bdaf123a33a35b8571481ae639
MD5 4b68b982774577282f729761c45d8538
SHA1 98c0ed94858fedc8a1e54de3636ea3019ceb279c
SHA512 eefb0ac9a3424edd47f7202028b6272af66a659a238badf4b87ac660b8322821a19ac0f419a9eb78f138503b54abaae72da9cab656482989f3046a5a4fe4b277
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c8f56f100421a77421de2007ab2a7416a630111d15a238c901c397328a15f859
MD5 969376bf3f203d1df421b0db15122450
SHA1 caa46f390f3deca829f054677bff23791de23fa8
SHA512 611c4116d4c065989c090b0b17a3fc5b250810b485c841279da7f919a9ccda42cae3449697413e76ba656b5b85754511ca4a567c110f5c35aacb46875983546a
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1eb54e9d53df151090ab614295623ea78a0ed31a600aa8f3912ab3764692e7a8
MD5 91e60fdd9b857c980c3583db6225b753
SHA1 feb189ffe7b53c6197b32d6b487d381f097903a2
SHA512 14637532e17a5ae4835bd06cc58e4e1c1add0379de45b2e8784b770ee543b7a71424b5e5f41b369521ec03ce7922f598fcd8044902d031451bca347929d37b94
TLSH
T1D1412B58B6E91158B3B76E5AAFF7A86D487FB9772F06C49D10010E4E0A62F40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads