hxxps://manage[.]kmail-lists[.]com/subscriptions/unsubscribe?a=KXbYHF&c=01M0FTNAG1XBE27PTJECJEVNED&k=5e9482fabf23ffa924e78ca4378b1b05&se=bourquin[.]t[.]ipes1com%40gmail[.]com&m=01M20M7XN0SWWBTF1RM61Q6QFS&r=01M211Z7ZVVQWRB1JZ9G0J12FE

Analysis

user interaction
yes
max time kernel
20s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://manage.kmail-lists.com/subscriptions/unsubscribe?a=KXbYHF&c=01M0FTNAG1XBE27PTJECJEVNED&k=5e9482fabf23ffa924e78ca4378b1b05&se=bourquin.t.ipes1com%40gmail.com&m=01M20M7XN0SWWBTF1RM61Q6QFS&r=01M211Z7ZVVQWRB1JZ9G0J12FE
Sample260910-xerfpavanc

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 4 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	27	[email protected]	3996	msedge.exe	3
Email address	72	[email protected]	3996	msedge.exe	1
Email address	72	[email protected]	3996	msedge.exe	3
Email address	21	[email protected]	3996	msedge.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335395877629527"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{93E6EBF1-A99E-4F5D-A489-C537DA57808C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 864	4460	msedge.exe	86
PID 4460 wrote to memory of 3996	4460	msedge.exe	87
PID 4460 wrote to memory of 4012	4460	msedge.exe	88
PID 4460 wrote to memory of 4012	4460	msedge.exe	88
PID 4460 wrote to memory of 4012	4460	msedge.exe	88
PID 4460 wrote to memory of 2944	4460	msedge.exe	89
PID 4460 wrote to memory of 2944	4460	msedge.exe	89
PID 4460 wrote to memory of 4192	4460	msedge.exe	92
PID 4460 wrote to memory of 4192	4460	msedge.exe	92
PID 4460 wrote to memory of 4192	4460	msedge.exe	92
PID 4460 wrote to memory of 368	4460	msedge.exe	91
PID 4460 wrote to memory of 368	4460	msedge.exe	91
PID 4460 wrote to memory of 368	4460	msedge.exe	91
PID 4460 wrote to memory of 1544	4460	msedge.exe	93
PID 4460 wrote to memory of 1544	4460	msedge.exe	93
PID 4460 wrote to memory of 1544	4460	msedge.exe	93
PID 4460 wrote to memory of 3336	4460	msedge.exe	94
PID 4460 wrote to memory of 3336	4460	msedge.exe	94
PID 4460 wrote to memory of 3336	4460	msedge.exe	94
PID 4460 wrote to memory of 3404	4460	msedge.exe	99
PID 4460 wrote to memory of 3404	4460	msedge.exe	99
PID 4460 wrote to memory of 1288	4460	msedge.exe	98
PID 4460 wrote to memory of 1288	4460	msedge.exe	98
PID 4460 wrote to memory of 2316	4460	msedge.exe	101
PID 4460 wrote to memory of 1280	4460	msedge.exe	107
PID 4460 wrote to memory of 1280	4460	msedge.exe	107
PID 4460 wrote to memory of 1280	4460	msedge.exe	107
PID 4460 wrote to memory of 3144	4460	msedge.exe	110
PID 4460 wrote to memory of 3144	4460	msedge.exe	110
PID 4460 wrote to memory of 3144	4460	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://manage.kmail-lists.com/subscriptions/unsubscribe?a=KXbYHF&c=01M0FTNAG1XBE27PTJECJEVNED&k=5e9482fabf23ffa924e78ca4378b1b05&se=bourquin.t.ipes1com%40gmail.com&m=01M20M7XN0SWWBTF1RM61Q6QFS&r=01M211Z7ZVVQWRB1JZ9G0J12FE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff8d046c188,0x7ff8d046c194,0x7ff8d046c1a0
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,12467921896310455525,16427096899439761692,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9253282749925288808,14157362612645530934,262144 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,13443827100360872050,3074444417817479633,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14889362349901183140,17458001238327356912,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4607443772995508665,3541982160713668744,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,6972285793462256581,11457068659846778492,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,9786099542175633724,3537832577964477909,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,4438197104993196109,17776079629036198024,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15746657468488506409,354097069943813258,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13469073533924925048,4684901513802805217,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13469073533924925048,4684901513802805217,524288 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,10613669519311971672,2081533386111082312,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5968,i,1940212907659822489,6586647370155275838,2097152 --field-trial-handle=2180,i,12870334094264302760,433888278544970750,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.makeship.com_0.indexeddb.leveldb\000003.log
Size 13KB
SHA256 b0868e9916afd8d46306ca7fb7bab7077874db9367342550b049eef3cfebe824
MD5 e2b44f77a90a9b76a10a22ce6ca940e9
SHA1 b034f4daeff48c10ea383dd8a739b630c1a06aa0
SHA512 4eabb2efb885aee55ba41430ff0f4dff19eb5b5f4c5feb1335c269c69f5e40d57638bdf4ff000f6e6e0b010024dd138c5b0346d06f34455db8aa3d618de4e490
SSDEEP 384:Sy1xDxnNP5XtEu9zh59/nuS5rK2DgNoDeYDhLDtVsDCH:ZxDxnNP5XtEu9zh59/uS5rK2DgNoDeY7
TLSH
T1E552F45F6AD58E27FD6E16725AA21FD807737E86BC81C25EF0C4F2BCC975A004A31162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.makeship.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.makeship.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 4c2684ffc715b691f062a143cbf00af808c75d4dbb050c2b1a313e98c0e40339
MD5 363f41d3b648b130ab2bf4892f315e3e
SHA1 2a2f98f3c362f06421a6ca7d4a23a440297ffca7
SHA512 20c90463c8da42c3f7115b444e56a9c636e1d2dddd3dcee6e85566ed5ae5a7465344a90fad5ef1f81f35521fb72eb1aa090562f93582cc5e29ac1a3c70cfc131
TLSH
T134E0686C82C9C5AF619014E621347B0E8AD3260F97CC6E814E42C860B883188986E251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.makeship.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7d017e35dc87ccdc41f47badf2ee9ac62272cd936ba140efe39bfb1a807185c5
MD5 8617ce50bad2cadbcafc98f7d0ee3126
SHA1 370c77026030a4390d949be844742cc2e05945b6
SHA512 c51ce5538d158a4990242da173e91c8b128f42a9d927b33a9008b91159e5f508aaca4970b43cc3b1d264c5f6f5368b75bf95e4df7d318d0cc3fb186931baecf2
SSDEEP 192:sxZRRVyM/jK1Ml8MW2/fhsVHIdpyoHW6+WN8bX/YIbysqYIgrJ:sxZRnu2/fhsVIbHbu/Y09
TLSH
T17242F9116A346977CCDBD209F955BF93D6F98472A2940E48A9FCC91C04E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3047e5e7b1b5a0667359e8767ee969c80fa427e2b396167ccf0d86f139e57bc7
MD5 8d0cf9fccc0e2a0977a1de102b87749f
SHA1 07041366b007e64a241726aa508acf685df20885
SHA512 75bd5b522767c202a6e9f9aacb1232d50f57c92fd20029879dfa915dbc5b15e718ed1ef8bf9479609a3b7ca5202982507a33cf2570521c390644a6a73ca08698
SSDEEP 768:g+sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR97roJbr:g+sqxXlWvJD6Tu1ja54LAs9IJf
TLSH
T156D21B3B694CC77E4F840E6CEC266FD76ED801CBA6988D5447FA880C03CB6EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\98d73b37-f562-4197-82c3-4901a4bf74c7\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 277B
SHA256 a472744cf70aae96d4378f1816d796abffb19e0005773da3c4e4f0fe04f83af1
MD5 2f920b7ef194b9dea7ba4180c11bdb03
SHA1 a9a8cf3fb320e7a57094de9b010717cd2219c903
SHA512 cec220afa1471f6c0b60b41f921f908c598d1b37b6ab096a84c12444e9c76954de2a60c7e7e6e716b658e84e556bc923eba65c2158d9ffe764a18d15d1c76f73
TLSH
T1D5D02B8E21D086ED367BCB8031B1B24F93037CC1BD84C9EC402431AA5830323021B972
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 418B
SHA256 c395d1f002cc47fc1c21a3078874d13d4a3c5b0e01d2a9d8b3121b60666ac864
MD5 d5cfab6aa530ff3801b645d480a2596e
SHA1 4ce117eef1fdd8165dc276fe7d9704c2f287104d
SHA512 db03ae24c45ed28dcce5952eeccf65d0aa8ebdb836eb661932e0297e3ab6f3ca2c8990bb82b7f694ffe49825a960187a6caf8a264c748ed6e099b6c55216e5c0
TLSH
T120E02B9A31D099EE767ECF8030F1A58B83077DC6AE88CEDC146470696C30713412A972
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 499B
SHA256 cf2ecf8aa26907770700e79bc32080647bf53ce3c2d46bc0faa92d9f63cfea15
MD5 11b00acbd54d6f50bc63004627c19779
SHA1 ae5a061f1b00ca84f7543021f9b35ee955aa0518
SHA512 2abe873a55fdaf476d75a004337323c9eca9b4739f29224dbb91c1b598f297d02821eda18ec85f7393f44163a0561b46c74cd7e7bc48feda36b6aefdde7a03f6
TLSH
T1A7F09E8631D089EA767D8F4030F0A18763077CCAAE84CDDC147060AA9C3071341269F2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 622B
SHA256 42064a1eccea3270837174d01ee7f66d09a1f8fdacfe8044170e756ae8908c0b
MD5 833d3deb2bddba3e9ae5927726b9028e
SHA1 fe867bc0f21f7ab6b95613d7a64399738c811702
SHA512 233277967bad6cbe13906be21d505161955c8ca10f43ba8f2fac36dc690e2a380d935871ea32c3c8bdbab38a93dae15cee1f1863b5e3b116125a3218edb3f282
TLSH
T106F0D88522C19ABA767E8F4030F0618752073CC72E84CEDC086160AAAC30706442AAF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 690B
SHA256 7869ebb9a1a1168c3da76867630ded717deef461c1fd1ddd73401566130320f1
MD5 0136ea913b03671313701f02f6f83da1
SHA1 a39a598c46718ecb27f99e5b38218a3ace72aa6c
SHA512 b6881c41e508ffc31aa2d0ee3d3d50e15839a7a547c1e3af0f6d2ebbbec70300a3921acff70868f831f51c693057fe06c6c1a16453a38edb03c44cc4a13a62e6
TLSH
T1AA01F98521D08BBAB57ECF8130F4619B5303BCC7BE44CD9C0834A2AA9C34B02452AAF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt
Size 786B
SHA256 ad4253afbbea0945c8e46ba2c36b7d598c6e971599fcbccea83020e8f627e5da
MD5 5f98b5a9c7de6b93ad7b68c5446ea2a2
SHA1 e7f94f48b18e9f3a4f062aa3b14e80a4c8bb825e
SHA512 4028785f672b1eaa5002e1f8aeb9f5da26fce9a060b6d6d53436a48128204ef7568b1113e0a46d5d3da05199b3daa5d8991984a1295fce445288753181ea12ef
TLSH
T1AC01BD4562D18ABAB57E8F8130F4654B1607BDC6BD44CD9C087561AE5C34702492AAF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584dec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\682f371a916d2b3d9bb2d102d1398822b8d647d5\index.txt~RFe584dec.TMP
Size 197B
SHA256 dc8ebc92dae2f25b0bad2924e169a558811b90440bef9ad56da5a46ded6df702
MD5 20a449fa546285d6e511e44f5a20fb8d
SHA1 41b5d73a0f06ae77530238f187d6eebf32fa9d0d
SHA512 96a3ba2223849d4ecdba6d319da815f4536f6893e36fd44b03b0101b6a51033b931a2fe591c28a3200b1a965afdd7efe7869ec6037ce25bacb105ac4d4f1f9d6
TLSH
T122D022DF22E086DC2B394E4070F0224B82073CC2EE84CDEC406031A05930723412EA32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 51506057c116cb36a46c23bf0d474573ddfa86f7f87a48bbd58e8ebb709d0783
MD5 0787cc44fc74068ee1ba5e944f1429ad
SHA1 47337e6337919762ff92da68d3713709f5dd141c
SHA512 e8203c7cfeed4a7ce51ffe8ee6862d8c2af9981fd18d49e2f9edc10922d609f9cd229a2b523c0b9886dbdf6e9bcc2b0eaf3ac12ef2a26d1365c49cf612f028ac
SSDEEP 96:KYbaKYIKeBOKy8CeH+KccvaMKvaO21KKGcm:ExBlRXTRn
TLSH
T1ACE14022367B424238BE3918E3AE86774E423163341C697F3B7864721D66E616DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4f6b1072e8512493a81a6c52258163a287978885d58ec7813cb48a58df9da5d3
MD5 4d29c39ae11f1d6ca37b6348405ad866
SHA1 7ed8b82f003a289e9e1bcb430579953d2bafde57
SHA512 02d44889b2a5fb88474397bae3cc2b260096a04245868361f2cb5d4ad3c2335ac719f121f33a0e3cb5afb631e00f3ec6b20349d85d4c417c9a089b3ab41c9050
SSDEEP 384:wZcIhsNDLDabQ/KVRN3Aa2VOHsa+VYtoV:OhYYH3ANVOHhg26
TLSH
T14E827C722C745CBA9DE7A681F88B36134EF4D167A6CD2E80D5ED5F0C00DB6981317D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9251e0a58722cef70b3f5564db075c56863baf05fb03e27c0301b4cad4717e7f
MD5 1cda007ffaf8697367358a98e707195a
SHA1 df01cf5715f8890007f2c82f40578c554d42878d
SHA512 fad126e472a4f4914656866cfdf4dd258f4f436c48a2560c192ea961b45e7e0f9ef7940b4a1a58bd01ff0eb82617489f597d5562777d1e8e522183e04f94951f
SSDEEP 192:tONt6JkRtQmiUyYuW+RNoCk1EoPh3ADVRgU6:tONt6UrKW+RN3ABO0U6
TLSH
T12202D8357C781CBB9EF36D0AB58736175FA4106BBA892B80E6E81A1C00D755C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 671b2117d90abcb0a279928fd10d34c5ee3dd9492253c018589a889780657b07
MD5 447a8a197bc3529d1855af3980ba515d
SHA1 1508e5098110c5b55971be1adf884f378904a7d8
SHA512 7d183a3f8891cbd270be009827c33581742a018df4ef49328106fc7bb3757060441f07c9d2bd6b686f3b4cfed541b24deb9afdfa01d84960ea00a866c1e91305
SSDEEP 192:uON26JkRyQmiUy/uW+RNoCk1EowFVjXVcADJqUZU6:uON26UufW+RN3AamOHU6
TLSH
T18812093278785C7B9EE3A845F48732135EA5916BEA8D2F40E5DC1E1C01EF99C134B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 73be27d2529a19814fcefb60183d47f87f115df21f47d3036eed03f5af78f581
MD5 689350979dcd3f3432090b0152d80ec3
SHA1 41a1d0c5b8289639dad1b0cc39b651bdeecebbca
SHA512 e01760480dc5d9947b22f86db02edfcd6d23052d199ada05bb447f88fec6bcd7c4033c97d7e0f7b60d15ba715486305aceb1206e7953d796925c3e77564aee7d
TLSH
T1F641269CA6ED104CB3B7AE669FF6A86D487FB8372E06C45E00110D4F0662B40D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads