hxxps://www2[.]desotec[.]com/listUnsubscribeHeader/u/851593/82c45b71954014ed845fb3a9574be9b8c6ada762838c3f1d8f629a3c0b659b64/1251842826

Analysis

user interaction
yes
max time kernel
30s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www2.desotec.com/listUnsubscribeHeader/u/851593/82c45b71954014ed845fb3a9574be9b8c6ada762838c3f1d8f629a3c0b659b64/1251842826
Sample260706-gdatjsat51

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277900622678019"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{8720850F-F954-474B-BE10-6B1E8049D404}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2388	4248	msedge.exe	86
PID 4248 wrote to memory of 1520	4248	msedge.exe	87
PID 4248 wrote to memory of 4824	4248	msedge.exe	88
PID 4248 wrote to memory of 4824	4248	msedge.exe	88
PID 4248 wrote to memory of 1460	4248	msedge.exe	89
PID 4248 wrote to memory of 1460	4248	msedge.exe	89
PID 4248 wrote to memory of 1460	4248	msedge.exe	89
PID 4248 wrote to memory of 2232	4248	msedge.exe	91
PID 4248 wrote to memory of 2232	4248	msedge.exe	91
PID 4248 wrote to memory of 2100	4248	msedge.exe	92
PID 4248 wrote to memory of 2232	4248	msedge.exe	91
PID 4248 wrote to memory of 2100	4248	msedge.exe	92
PID 4248 wrote to memory of 2100	4248	msedge.exe	92
PID 4248 wrote to memory of 2912	4248	msedge.exe	93
PID 4248 wrote to memory of 4556	4248	msedge.exe	94
PID 4248 wrote to memory of 2912	4248	msedge.exe	93
PID 4248 wrote to memory of 2912	4248	msedge.exe	93
PID 4248 wrote to memory of 4556	4248	msedge.exe	94
PID 4248 wrote to memory of 4556	4248	msedge.exe	94
PID 4248 wrote to memory of 64	4248	msedge.exe	98
PID 4248 wrote to memory of 2096	4248	msedge.exe	99
PID 4248 wrote to memory of 64	4248	msedge.exe	98
PID 4248 wrote to memory of 2096	4248	msedge.exe	99
PID 4248 wrote to memory of 1348	4248	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www2.desotec.com/listUnsubscribeHeader/u/851593/82c45b71954014ed845fb3a9574be9b8c6ada762838c3f1d8f629a3c0b659b64/1251842826
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff4d27c188,0x7fff4d27c194,0x7fff4d27c1a0
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,8579384286671349868,17706512029907248234,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,3443827464311203691,13967474205761898220,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,17358343858011464837,10131080307477971115,262144 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14897972083356377896,16306273638633963681,2097152 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2612497793428702057,15884476893916123525,2097152 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,10639499963039283776,12051051489175179464,2097152 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,18424705569792196955,17532845356139700891,2097152 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,6182130106582363040,9142318282054681227,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,10426413548231565687,16349296051035119729,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17365962721680552960,2608116580716626946,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17365962721680552960,2608116580716626946,524288 --field-trial-handle=2592,i,673132111622932181,11342783619453480108,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d70fa33ad685c1f344201af33e4cf13e954af029d6f1ec9c44fd28c4f8896b4
MD5 b0bd9b0820d75dd38f4067f4b0f74b20
SHA1 4c0b6de70bef4da3f4c3f264ac1cd912abb44bc1
SHA512 2b6f895e9fdaea4b3551922d1a92960760f0b890d989bc831417c188b74c6df7e96105883aecdd69dd5d167a5bf3f27e7540f0db5ba27d1bf2b486958dd80d2d
TLSH
T1EA719158126BCA8AD7210331E4E33174FCF28FA90EDFFE8511855BBE19D0F6D6126408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f817.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f817.TMP
Size 3KB
SHA256 031498564d814da097d7d85b17c5e90817c07597ed56c215083489c1c8daafa7
MD5 487d7584baceae8e4cd839733b6444e1
SHA1 ca4cb430618efbc8ccac81f5494b6d1abd9fa603
SHA512 4615ceb51a95df1d12e52a5f1ad22d96729cd88cfaf337600ca2894405f85d8aadadd966966f9f1f3e2ed6a75b7e4665219ab71dfcb056e0dd31230f6df80b44
TLSH
T141719254126BC99AD7200331E4E33175FCF28FA90EDFFE8511855BBE19D0F2D6126048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e33b911-7651-4846-b0f9-c5bea143e8e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e33b911-7651-4846-b0f9-c5bea143e8e7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a86758371886b1528c21c96ccf9cab67e98b740975d23474c9c279df066d29a
MD5 86c3bd529df5f2c5ccb81c77c024e852
SHA1 8bb11b022708d3728f7af55e9e3d1b3bd5cbb257
SHA512 bc67f22896ff8bf315bcebe1cd952a495be2c46d45d630ba65a49ad65e9b2c444e8c194b5218cf67ca0e25056afc7028405f698bbeba7ed895425c0596852341
SSDEEP 192:sxZCR8yM/jK1Ml8MkE/fHsDAp4Idp/lHW6+WNZ8y/YwkmtAZIgrJ:sxZC2ME/fHsDiJdHbL/e9
TLSH
T13C42E8126B385A7BCCDBD20DFA55BB53D6F9047292940E44A9FCCA0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8fe8fd4529249793508cbc6b02f838cd05fcb98262a6c38d17e35ffa0813e626
MD5 74312638a9da82929a383bc048f4e50e
SHA1 69a563d80a884fa2a78c86a4874b342a34ef854d
SHA512 b9eb374b31f597328fabdc36bcc69efdb32ab580208bb06358ec2f35a2030836681461db4fe8b5c93bff19b9cf8c8cbeac6f968d1e0d327de942becd346657c7
SSDEEP 768:ER4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dzrohKcfaJ:ER4jeXmWvmKLEu1jacPLZQdAbS
TLSH
T11DD20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c9343792c561dbe066cf04c5f24959a05d41f3216320df39b187eeff75defdfd
MD5 247acc72248543fc1024868a632aaf6c
SHA1 22b5f096a125ae98db2fe5fb652eac89e17df5d5
SHA512 0a884ec9430ca493e5afc966529c5f9a3b2dd64dec7e97c93920a01ec6fb50da98444484304a3a0d1c8855ada32bd5d17f6debac3bdce0c0791a3da32c174d20
SSDEEP 96:K88QKZi6mdKKGkawBUAyeSIWWLbgIIK4Ng6Icoob6AFHAxEwCuH:C351wBUAyeSfWLkIMNg6noob6AFHAxEQ
TLSH
T196914066377B43023D3D280897599E665682B1A33019A87B37F901F24E27E254EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c32600d45059a7767e20e74954f2626fb19ebf66646f357b124bf4542a1d09af
MD5 e9aed969160f2e98ae4d07e304d8f86b
SHA1 5fbbf13886c6a9c91b0333d074cea8039f941739
SHA512 30be4effc50bb68f9c376f45a56280660c967a05aa1eb6dbb899e0ba12fb0ce117d4b491c8da30bb26ba8b333ea54675318d954baf7c50d623aca5d2025cb28c
SSDEEP 192:EONu6hZ0QmiUyi0pc/+jVnjzorRUY5wOZ3zU6:EONu6ompu+98RUn2jU6
TLSH
T19602EA35A8786CB78EE2AE45F48727235FE5112BE9956F84DAE81F1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 391b4fdc3c48a846a319a9c2408c0fb28239d305574e0479de0c4364fe922440
MD5 bf8c1d37dbff4323060f298255025da4
SHA1 7f158f1fd3680bb8db35180e44dcd30cda008272
SHA512 a1822401d0a5ead153b80996fb347564299da10d2d582f5d70a5c3e7800f99d3bc89b2ea6b12dfa544632957c734dc166b6d62547e5ca3f577ea9fc1f0737a6d
SSDEEP 384:ttNn/s3n9SfsNxvF6wdLuf+98RUlXU+2mUFHOObjI9G6w7Bm:tj+9UeLKqlUlmyH29Mk
TLSH
T14D929D36A8399E778DD29695F04B36239FF8416B97C92F84D5ECAF0C01CB6AC0306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a0b106ed6455852a973b61076d13939f768ddcc7d4c295f2fd75a5552264502
MD5 f2c23fac75aac32f5c9b8c1b76a9ecce
SHA1 5ddfe011730f2d01c010e921a106571e51cd0c62
SHA512 8917f1105873189123eb45d2036ad82dfbf1b854aafdc0c53bb0077f1faf581a542dbde91a9cc240deaa2d1fa04a4587b3b3a23f3b9f24e7a8b436c0e8997396
SSDEEP 192:iONk6hZXQmiUyf0ec/+jVnjzorRUlXU+2mV5cOqkqZU6:iONk6FReu+98RUlXU+2mQ9HU6
TLSH
T119120B36A47CAC675DD2A695F48732239EE55217EAC97F80D5EC1F1C00DF6AC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dbeb4d2829b91fad23f93a8b173a8fe9a5b3938e94e5607540d26c7fc02e6aa4
MD5 81a0c5023eeaefd76f9f03282fc443b8
SHA1 027a815f478c71c699065c984bae2a6ae21dbe95
SHA512 4fc3fccc3b62b6c1de5b2f81a831bce0ac4e979365f030c6b4bf9f26fb10a4abb74d5ad267538cb49159d9e142f9cd2376efce97410e431c0cfecb84cd109cb0
TLSH
T19841F848B6FA1148B3776E5A9FF7986D587EB8772E06D85E10110D4F4A23B40C972B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads