hxxps://app[.]response[.]siemens[.]com/e/es?s=2033604275&e=3948076&elqTrackId=62d7b9f91d5a411693b2506548de2ddb&elq=f19d199fe9744e8288c62197d4828cf0&elqaid=80777&elqat=1&elqak=8AF5D93114418E7C5095E4F3A88C7D1B40BC6F0AD9D20D24BBDFC650E7CB9E34822A

Analysis

user interaction
yes
max time kernel
46s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.response.siemens.com/e/es?s=2033604275&e=3948076&elqTrackId=62d7b9f91d5a411693b2506548de2ddb&elq=f19d199fe9744e8288c62197d4828cf0&elqaid=80777&elqat=1&elqak=8AF5D93114418E7C5095E4F3A88C7D1B40BC6F0AD9D20D24BBDFC650E7CB9E34822A
Sample260813-v79fvscc85

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311163500252763"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{21951AD3-244E-471E-9E26-16E8C0D2E0AD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1984	2080	msedge.exe	84
PID 2080 wrote to memory of 2488	2080	msedge.exe	85
PID 2080 wrote to memory of 1320	2080	msedge.exe	86
PID 2080 wrote to memory of 1320	2080	msedge.exe	86
PID 2080 wrote to memory of 1320	2080	msedge.exe	86
PID 2080 wrote to memory of 3952	2080	msedge.exe	88
PID 2080 wrote to memory of 3952	2080	msedge.exe	88
PID 2080 wrote to memory of 628	2080	msedge.exe	89
PID 2080 wrote to memory of 628	2080	msedge.exe	89
PID 2080 wrote to memory of 628	2080	msedge.exe	89
PID 2080 wrote to memory of 4468	2080	msedge.exe	90
PID 2080 wrote to memory of 4468	2080	msedge.exe	90
PID 2080 wrote to memory of 4468	2080	msedge.exe	90
PID 2080 wrote to memory of 3996	2080	msedge.exe	91
PID 2080 wrote to memory of 3996	2080	msedge.exe	91
PID 2080 wrote to memory of 3996	2080	msedge.exe	91
PID 2080 wrote to memory of 3920	2080	msedge.exe	92
PID 2080 wrote to memory of 3920	2080	msedge.exe	92
PID 2080 wrote to memory of 3920	2080	msedge.exe	92
PID 2080 wrote to memory of 4800	2080	msedge.exe	96
PID 2080 wrote to memory of 4076	2080	msedge.exe	97
PID 2080 wrote to memory of 4800	2080	msedge.exe	96
PID 2080 wrote to memory of 4076	2080	msedge.exe	97
PID 2080 wrote to memory of 5092	2080	msedge.exe	99
PID 2080 wrote to memory of 3068	2080	msedge.exe	106
PID 2080 wrote to memory of 3068	2080	msedge.exe	106
PID 2080 wrote to memory of 3068	2080	msedge.exe	106
PID 2080 wrote to memory of 5092	2080	msedge.exe	109
PID 2080 wrote to memory of 2472	2080	msedge.exe	110
PID 2080 wrote to memory of 3316	2080	msedge.exe	111
PID 2080 wrote to memory of 1264	2080	msedge.exe	113
PID 2080 wrote to memory of 1264	2080	msedge.exe	113
PID 2080 wrote to memory of 3368	2080	msedge.exe	114
PID 2080 wrote to memory of 3368	2080	msedge.exe	114
PID 2080 wrote to memory of 3368	2080	msedge.exe	114
PID 2080 wrote to memory of 4860	2080	msedge.exe	115
PID 2080 wrote to memory of 4860	2080	msedge.exe	115
PID 2080 wrote to memory of 4860	2080	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.response.siemens.com/e/es?s=2033604275&e=3948076&elqTrackId=62d7b9f91d5a411693b2506548de2ddb&elq=f19d199fe9744e8288c62197d4828cf0&elqaid=80777&elqat=1&elqak=8AF5D93114418E7C5095E4F3A88C7D1B40BC6F0AD9D20D24BBDFC650E7CB9E34822A
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x27c,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3852089291027971594,2697126271504771790,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,4335010944179265191,17162164475760990657,262144 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,7279484452171492611,7194087851746867992,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,9493316457343382453,15033869198910530767,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16717567634368778447,15356263048796220953,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,2510301014314902202,8497718914131865425,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,5765893172823313767,18028643704968285129,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11311225372263636804,6736825040280240213,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,13409488337941495444,8533852088244750420,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17032102035500089176,4050435889059628532,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17032102035500089176,4050435889059628532,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4368,i,13357560019535522350,4045281748166385035,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,2282072041969782154,5943110810398914218,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1175571120533000001,18197985278280296798,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,18416962493479454855,4601484953978886558,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,1540055029392404143,6465824046933293610,524288 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4324,i,6057088698817568489,7756321205944794219,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4240,i,16743209243287675145,9532143190789656237,2097152 --field-trial-handle=2220,i,13163347282507007823,16918495128856549603,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 65539b3b2947a15a8ec701eed77f7f9cdb732ec8ff0e811c44f800bbf1a36f8e
MD5 f085b91a112a946d771f68fbfb60f32a
SHA1 59773d6b5f66d9afb7c31beb340fc82d1efa6ce5
SHA512 4781d68407b24929123d43907dd0f9426f10cf5b7ce1feae7f11c6e8407d105f4c8d115778c2b2602ad49aa3b562b0b05688648e5ef1448b8eb4eafbedc6b6c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T1EBB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 68KB
SHA256 616fb6d532c1a2357c688d924047ab1265768fcb5336ff6afa22733ada1cf01a
MD5 5a51b3960487eac8ea626e24d4162084
SHA1 e63826c77edf48cba38533385e28bef9a2b6a001
SHA512 cba27ba59c1e80ffaad47d22b08dbd025e9b3d419e9689f646be8f0d101bca8135dead374ac1311f18f1edbd42124877eabe41881d56b86a52d13c693d812840
SSDEEP 1536:T5UoF9/WBvOtWHrRdS04aMf4Pbdmo/2qsn1Z4BXXdYx8WO5F:T5lf/bYHriaMOMoY1ItYx8WOz
TLSH
T19063129017935058EF7F36BE78019DDB8A55B51EC5B100FF386EAC354234B98811EEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2ce76a0ca6ea6582e1eb1e9db83c786990c289d2fc2fdc49441c908a49e7d59
MD5 e30b67ada29f25874790c579288af673
SHA1 350abf97e4b3e3ab867ea466a13ef46512f5eb07
SHA512 063077b71e4ab6aeb516f26bd40505f7ee8eb6b9e4f38c63421bd953d1381a8dfa937d387ca042cc165283cea65753aee02485cdb40b53d3f99985f3c2a8fcfb
TLSH
T18C71B534552A93DFF7E602B290C12255F6328DEAFE273E412F2379B45E01FA08169399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5829e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5829e9.TMP
Size 3KB
SHA256 8027bf04088be2b62e3b6abba1137c3645c1ade28c58a0340ce396b4aab31f00
MD5 5352fd633f1a1000c63f0c06cf3fe27f
SHA1 80d85e79d94537e4b45ff215d6c206ccc810aeee
SHA512 16e936774ae738d670fb94912a74c64f5cd70c6375f5dc3d794800e7b148f37489daa11f455d54fe1399d58c452c71e52bb027e2ad3d42d854edff09f43db5a7
TLSH
T1B4719334551A53DFF7E602B290C12259F6328DEAFE273E412F2379B55E01FA0816A388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

eb9ef969-4b82-4ced-ba06-7d2121d5d53f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eb9ef969-4b82-4ced-ba06-7d2121d5d53f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 700079b6adf55d8490dd520ee294ba3177d24152964c125a62e3b23a6a718a0c
MD5 a2b3b84fc0531ddf7d800c68d44fdce1
SHA1 246f7a7a65a88a97d71951afd0f20fc127b33a7a
SHA512 9aaf3f47858212f125e01d937125dcc39c0483c90fc1f7e9057e4256fe61fe55cac475b9e08b38b6b4571f76b0cd68929b313fed675fd9420ee56f749d6c3667
SSDEEP 192:sxZKRLyM/jK1Ml8MkX/f3sWJrIdpmK3HW6+WN70D/YIoma+qIgrJ:sxZKZMX/f3sWJ0b3Hbk/lq9
TLSH
T16052E7166B34A977CCDBD209F9457F53E6F50472A2901E44ADFCCA1C05E6AED220B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 37f70620d0e1712ae0b8f6101c8633c6d1b4d13228904b20825d0b0405e55cb0
MD5 180079b5be82bfce1380f919e57b383f
SHA1 3ebee4a249d59f7d70872c29d77cb2f4974bafa1
SHA512 af2336da4e7ab18bff4ab91bf2681ad153caad8b9c0a0d8a0b206184c01e39613fddf729cac3a1460f6cf37e702fcb8fb58f3d2c6260afe5dd15e7c1ce845097
SSDEEP 768:ZVsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR93roWD/:ZVsqxXlWvJD6Tu1ja54LAs9kWT
TLSH
T1A4D20B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 54f04bfb7c45000bc50b344a280bff398fdc277387e293c8b92410f21bf48a1c
MD5 bd08697d10a63664eb9d6e5c10c95e55
SHA1 7f37d3e54ddfe1974a0f22555b690dd9a058b166
SHA512 ae06c132658a050cd005deca0a38e1b98e38169df00f8089620ef5fe1e2ee9abae72c988d222c813b7f10258eeccfab21519a7ba2048b72fdcf9b658d475e454
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMkoADsPTdhNwz:KYbaKYIKvdCKegCeHuKMknDsPTdhNwz
TLSH
T1EC91E119357A0212387D3968B2669A3B4F413A63701CE46F3FB850A64BA7E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e87c2a52761f01b780ca946ae337f915233ae02243b2cc3e0dfd13b1b3fe2cc3
MD5 42c2ba933b23b5c848b0b9537e7438ba
SHA1 4fcacc2bb989c24ee21c4508f7afff24ba7fd113
SHA512 11dfca43795f1cce2328b86d98c6143b44256df0f6027dc166ff920060a0a5abc041a9f93e82d8af773a01d52fe75ecb901d5d2be4b5ecfff6a0ff8fc24121eb
SSDEEP 384:iZcIhsNkKyX0Qb3yAVRNmd2OYoFOOOPrXLpe8C/D:QhPX0bWHmRtOOi9Pg
TLSH
T1FF929E316D782C6B5EF6B945E58736079FF89167FAC82B84A5DCDF0C01DA5A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d9e4c30444034918ababb19ce0cf8db060694fb7192ed7a36f3321ba4daba5f
MD5 e44cb263e69fbd98232849a2c5c666fe
SHA1 b61fda8123e43d490c0608cc7319bed9c65de520
SHA512 c52fdac3831d147257d79c6571526609b65f1af54712b0568a396a629dc1eec34a53a9c817fcc99e1f5175c21c3163e3b5470ff189e54835328aa964a3643199
SSDEEP 192:tON06JkRtQmiUyPlW+RN5+Fd107sh3hRHJU6:tON06UrOW+RNmd283JU6
TLSH
T19902C935AC382CBB8FF26D09B58737175FA4217BBA952B84DAE85F1C01D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d62bb9944cd14fbb75b9e0c7da489065533dc6c402e162dc33acde6aba0d1d1
MD5 5733046c9ea169012155c621b4d25fb5
SHA1 61088f12a365643998bbfee6a5d2825363da8c12
SHA512 201cd41a9a86380940a03a98307f67bd57d895788c77144522df087145a896180c596f8de0d79721983614d272c1ce24d6fe02791de974bdc4ce4af64530b192
SSDEEP 192:QON/V6JkRdQmiUy5lg+RN5+Fd107ptpefPwoU9VczqoaU6:QONt6UbGg+RNmd2OYolOU6
TLSH
T1D1120935AC686C6B4EE27845F48736175FA5516BEE893F8095EC5E0C01EFAAC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 93be30084ddad88fe7bc49a47e74ad7838f74fcf0a3db9c1301f0b9653e6d468
MD5 ad49c9dae4bf261e8f0bbdfee1899ef1
SHA1 743133f7658a33639c5299fb34124ce290a0aaa8
SHA512 2a2dceef5c39f6132c5cba463f4abae7bd616af1dccaa1394f7d212e47bbe8159c9105d0ac3c5c9d6d8ef29153bb6124c790fa37ffab237e9826c3bf06112f47
SSDEEP 384:8ZcIhsNkJyX0Qb38x2VRNmd2OYoFOOOPrXLpe8C/D:qhoX0ZxUHmRtOOi9Pg
TLSH
T1F0929F316D782C6B5EF6B945E58736079FF89167FAC82B8465ECDF0C01DA5A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d092f24238a7b1f6c3d116e58732b4eb003e1fe0e8a5a428783331be3be195d2
MD5 387187d433d547bed684035ff3da29db
SHA1 652e0a9c3c411d6fa2a55d5b417e0a1c07420316
SHA512 4446c56e7cf8c272ffd60ccd7946727d591408ab713ae211462c36b1e1723283eb8524afd66c13b50146cb9fa1ffb9cc1810ae8e5154203f3737f32a6bde3333
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58818f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58818f.TMP
Size 392B
SHA256 4462597849f074a7b8463e2dcba5e6b31b07aeb46455b7d1aa60836f8d7e5bd1
MD5 95b4bc016d39887066458dc51f7f947d
SHA1 ff8659ec3fd0b7faf10c7a38f00bc4712c677eca
SHA512 070fec4bf8bb136728bb26859ea136fd93b8524c49aebbebd6009b98bbd1006d49b5170621fb996633da8b105c0ced8458006dcd533b4a78ac81c2db676f0f79
MD5 SHA1 SHA512

Submit Download

d911f936-9496-488f-ba40-49387d52901f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d911f936-9496-488f-ba40-49387d52901f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7c1374a240d9a0b746148d4dd2da9e498adad834e042844c6f95529db507c95d
MD5 7d1ce172d743567e1f32450d051f931c
SHA1 50a371302935ee4786cdce498bd20e3ac4a52974
SHA512 30ffd9d2a38539e668427d6dcfac287eef1a835abf1a32d9d707b1297a3044063e29dd1d1df5a029fd7dd4e1eabd301e656d9bd82850ee0af78d6486209a654f
TLSH
T1A9410958B6FA1148B3B76E56ABF3686E587E78772E46D45E10010E4F0A63A41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads