hxxps://aitzkin[.]com/nug/11[.]php

Analysis

user interaction
yes
max time kernel
88s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20260130-de
resource tags

arch:x64arch:x86image:win11-20260130-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aitzkin.com/nug/11.php
Sample260331-rmhwmaes7w

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
135	1180	msedge.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Dictionaries\en-US-10-1.bdic	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5372_1364098380\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_102_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_855741141\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1180	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134194403251082621"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{A843506B-41BF-49AE-9402-4310F63D4B34}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 4476	5372	msedge.exe	78
PID 5372 wrote to memory of 1180	5372	msedge.exe	81
PID 5372 wrote to memory of 660	5372	msedge.exe	82
PID 5372 wrote to memory of 1084	5372	msedge.exe	83
PID 5372 wrote to memory of 2188	5372	msedge.exe	84
PID 5372 wrote to memory of 660	5372	msedge.exe	82
PID 5372 wrote to memory of 660	5372	msedge.exe	82
PID 5372 wrote to memory of 1084	5372	msedge.exe	83
PID 5372 wrote to memory of 3480	5372	msedge.exe	85
PID 5372 wrote to memory of 2188	5372	msedge.exe	84
PID 5372 wrote to memory of 2188	5372	msedge.exe	84
PID 5372 wrote to memory of 3480	5372	msedge.exe	85
PID 5372 wrote to memory of 3480	5372	msedge.exe	85
PID 5372 wrote to memory of 1652	5372	msedge.exe	86
PID 5372 wrote to memory of 2592	5372	msedge.exe	87
PID 5372 wrote to memory of 1652	5372	msedge.exe	86
PID 5372 wrote to memory of 2592	5372	msedge.exe	87
PID 5372 wrote to memory of 844	5372	msedge.exe	88
PID 5372 wrote to memory of 3388	5372	msedge.exe	90
PID 844 wrote to memory of 1880	844	msedge.exe	91
PID 5372 wrote to memory of 4728	5372	msedge.exe	94
PID 5372 wrote to memory of 5632	5372	msedge.exe	95
PID 5372 wrote to memory of 3744	5372	msedge.exe	96
PID 5372 wrote to memory of 4884	5372	msedge.exe	97
PID 5372 wrote to memory of 4884	5372	msedge.exe	97
PID 5372 wrote to memory of 5916	5372	msedge.exe	98
PID 5372 wrote to memory of 5916	5372	msedge.exe	98
PID 5372 wrote to memory of 5808	5372	msedge.exe	99
PID 5372 wrote to memory of 5808	5372	msedge.exe	99
PID 5372 wrote to memory of 5808	5372	msedge.exe	99
PID 5372 wrote to memory of 2532	5372	msedge.exe	100
PID 5372 wrote to memory of 2532	5372	msedge.exe	100
PID 5372 wrote to memory of 2532	5372	msedge.exe	100
PID 5372 wrote to memory of 872	5372	msedge.exe	101
PID 5372 wrote to memory of 872	5372	msedge.exe	101
PID 5372 wrote to memory of 872	5372	msedge.exe	101
PID 5372 wrote to memory of 3964	5372	msedge.exe	102
PID 5372 wrote to memory of 3964	5372	msedge.exe	102
PID 5372 wrote to memory of 3964	5372	msedge.exe	102
PID 5372 wrote to memory of 5504	5372	msedge.exe	103
PID 5372 wrote to memory of 5504	5372	msedge.exe	103
PID 5372 wrote to memory of 2396	5372	msedge.exe	107
PID 5372 wrote to memory of 2396	5372	msedge.exe	107
PID 5372 wrote to memory of 4908	5372	msedge.exe	108
PID 5372 wrote to memory of 4908	5372	msedge.exe	108
PID 5372 wrote to memory of 4908	5372	msedge.exe	108
PID 5372 wrote to memory of 5144	5372	msedge.exe	109
PID 5372 wrote to memory of 5144	5372	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aitzkin.com/nug/11.php
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fff44b0c188,0x7fff44b0c194,0x7fff44b0c1a0
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,3147522287095496069,8190767835412473405,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:11
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,18411680337853931999,9783981569441556905,262144 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:2
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,14575908979469798683,8988631675329355956,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:13
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3036,i,2755814794573761953,14219858738097580038,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3040,i,12349407606066384193,3840178142108226914,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,2391608631231075460,4061285046713971906,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,176392806731861696,5447017460894200178,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,12515868652970463401,12976359838118114348,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,7992949088383250679,2264728094886365643,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,7992949088383250679,2264728094886365643,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,8108976500621425453,8398702739836829597,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,9319464787423346160,6597796864211232701,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17415313622529035849,15251996302475668040,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,17622126358030358733,7123884631091103831,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,6688592737812603452,6184655642734737664,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5084,i,16955958944197791761,3119087737502567557,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4800,i,6813702608140078492,11100413261517172189,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6284,i,11988531626820777908,4113178700429075470,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5560,i,447478675024832190,8613770727114679640,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,1773366171118338880,790478828436440391,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=de --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,7884432711745533856,4614449442851009000,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5980,i,16031161048655945753,5172243053877246680,2097152 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,5173504843528765429,14444677512668155728,524288 --field-trial-handle=3668,i,8268756465839860017,11391137175534409734,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:14
  2⤵
  PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a67530703c53458c9f8facc22bec3fe1fa29031470fa0a1bc4472eff03fb4e2a
MD5 8c50dcab6e83fcd2f9c91ac8185c2219
SHA1 661a4b8acdc70edc799cc5ce7e30cbdebabfc1d9
SHA512 a67070ee5bb2cbdd9c50723c49c7f67b23eab9c1771f9c216eb7367776246ae9c0bfed11a8f3a7dff7c1a05dcabf64d874d4d780e3224df070c6c37a95649918
TLSH
T1F2D08C4821F26CBAD08ACA7219457B0A2959E6A79E93AB2E39B36C786C4302115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

864e0a2f-9c50-4dca-911a-5769b9fed46a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\864e0a2f-9c50-4dca-911a-5769b9fed46a.tmp
Size 107KB
SHA256 2d15d1a30785666c49831a5f576a862cbcf96e20e769a85459f93b023a1fb8d0
MD5 8b81c51427788daa7c346b9f7679e4c1
SHA1 b466666ca62f4102f15a65b4b84907a97b184028
SHA512 170baf598b42456ff411222239f85c936c74e063f1b5677f763c9d2eb99ce633d4ec96e49eacf6a0981bb5447433c3c030c17b43ca40ca5aba08d9a798b5051f
SSDEEP 1536:RfEE4+V7loQNNGZqW3w5PDuVjbpBuW8vRZsM62UhPq:qSVOZi7ZU0
TLSH
T1DFB35227D6A64C6B01F16264EC754382F325436F9282A82F3A3C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 46892bfc797194eb02ca545fc9b149a78cd227f713c7efe1d29a7ae753b85753
MD5 19773e2b75335ff0d277bafe6aca227d
SHA1 294baf26c1801bd3782da5370497255dd3d617b7
SHA512 e59f5351dbd3e7d45f5e467031bafab8b3026ef7826676cd1660aa19ca8d90e93f24013f62bae28afc7afe634c6cb6615a16bb7cae9766dd0bdeb67c818b9151
TLSH
T136E02B6ADC259C3709F90B1971100786FA6513271A40951F3E3C920C8FB0A3A45DAD1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 34KB
SHA256 d40c4a58d7adb9ae6abc39d96c656373d4f1524d126540419e1277bb24156f11
MD5 96f324e0e7eb100dd151933cbcf7675a
SHA1 32f137b29c1b690969e1334015b62486e928e154
SHA512 58049e5da9caa2c969b9e4b0517f66080a955ef975a8fec0f4d43b9a9d9cd630b715e31882fefe1d0c19a2442b5be0157ce5e85a911e182abfb021536d9fce6c
SSDEEP 768:XwYF5G8ocg1blR0zwgF8tbd3tBQQaYdML8SRMoyLf6TfrRu:gYF5G8E1xR0zNS3teQOL8zoCf6rr8
TLSH
T1E7F2F146D41F876A4F55CAC8D2C8C21A16B36AC15D303B471ABE5633738D6E89CD770B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 99KB
SHA256 281b893e75496de203b9a1950afc4e961317df2028829adcfe570716b3f2fc26
MD5 066fa25fb8faad3bbb4b495603fa48b5
SHA1 77a2d254c4fcf4923e6bbe13e57a5e3c0648299b
SHA512 482031f99e9c31733c73281644292422e3a06c8e360b23d5054e04a0ef0e4bb1cce5bc3a68187f9b56bc3752e68dce1f07f404f11e8d008931726482196b9bbe
SSDEEP 3072:nXRistX+12oS74RcKkkltibc0+Fe9az0LOH5BgugY8:nX4s8C74RcultibhPE0LO0uJ8
TLSH
T168A31290F5C63AA30D8C36C03DB385772DEA1ED9482C7936D724809B875FA54ADE86B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 66KB
SHA256 3238a9d048a837c1d0cbfaea02886768a5ce12d7bfb43e8c1acdf6b89acbf01a
MD5 3879556362356d373f139f6f68937060
SHA1 6ecac4cc882ca89940dc2dfa92534e2d4583af85
SHA512 3cce42ac79adc236b63d66380d31d468326fb6adeacacafe3e40d794ce0693e60eef77aa2014bdffaf0d7e0b6ec886e828f0c12afb56abb8c7def8c8c9f01bf3
SSDEEP 1536:9Y8QGq/s4DH2Qr0t62G9o9zboKBCa85Yj1ZfbMMK8/TN5/:G8QdE9t67G9fjEa8iGTwhl
TLSH
T1B76302B1C50E0CE42C86E94B96F563DBC2D722AE6DB07B0670D74CD2994E8F511F868C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 404KB
SHA256 6725537c27eb5740e191765f1b955aabcbdeaa945c5c3e308d66402b8ed7a1a5
MD5 4d2c31b7dc532af0729be70346ddbfd0
SHA1 f8031aa0fa614ecd10a376bbf8c36b1717b4e17d
SHA512 2a134b2be8232197304f621bce080a59dc55c34ee2afa90852c95e6f7cfd8e0c44722cde4fe094df89002b2e0932fa81eed19b7051554a63d41b5f14780c153c
SSDEEP 12288:G+7rxByzdkQ49wEEaV4pjN9t+ETxRb4Njh:BBByGV3EI4f9tU
TLSH
T1849423634CA60DC96383965D3940C1602CE63FAC6BA3792F0CF766AC1C56EE267874C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 16KB
SHA256 752c02081cc5cef32186b55de3dfc46b42c063219740a541ca50f9c490d4c560
MD5 ddfc9fd76d1d0983d4899f9cbac997af
SHA1 754ada8ab97ad733c3632dc3993d4aa3fd791533
SHA512 49fcdd280a266c6bc683dc7304c14677ea0c2b23d1c782327b036e987b2dda34d7f07370b97ccbcea4f0917eb4261b18f40515bbbbfae4a6006604143add3762
SSDEEP 384:HDA3GB9nc5qCukfTRy+WCAnCv2y+PhBeju2bsKTTMKg9AsVq:jfXnc5q5krR5BH+yTjhbsP70
TLSH
T1F672E1E6071A10A5B7171D5BF9C4330C06BF6C7F136D1CE7BA96BE145926AC80DC1DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 28KB
SHA256 acf8759c42025dfc9a1eccef575096cc66449287c1c2733177c5c37ae21ea44e
MD5 a633ffb262ce47f0df9d92f0c459c6c2
SHA1 45daba392d2d6f991a7b63e846a17d3560add78c
SHA512 921a34c7129dcd19039d00b8b00bbd29b85a4a4157952aac1fa753b6f2e7cf2e0dfe1e2ff6b9e24da77610168875e224f78513007edce3c12a5492e05b5ac6a0
SSDEEP 768:HxgsZc/kCuuUc3k+Hhb0FOGuohjWCzVzhV:R/Zc/kDakyQFOHohfVz7
TLSH
T127D2F1CD67DEA817632FE204682417118928BD19AC42F5008DF6DBFE476F25BDC85D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 77KB
SHA256 90e7b18567ccbf71c400ea1e99e09dbe3dc02490d6e74061b19c76a72bd899e6
MD5 e70ccdc02870f893154dcb81170cf453
SHA1 0e20a2dc33d72415c39d2541b9e7a944f729ca3a
SHA512 c55ef8532368ebdd4c10eeaf6689ae7342518f997a2a6003ce3832a41c60fb17ca046e6830070592cabeee41d30892dd9641ffc1d69088bab61892339a42af07
SSDEEP 1536:3JrHanykZQh6LuzHKpjQgGuAqRcxW6XPMznEf/KwA84et1cCwIvTuQEunWt:ZTanykZQh6hp/RMW60zno/rA8LkX0nWt
TLSH
T1907312927CF2A330ECD12AF7A1673DF4253E8815674B5225DE2DD1C1B31B9D93782A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ac52c5272dba6169839e191a338840a2c1427f403dc15995742a2c2c882b2b87
MD5 5406ea699195f2761a9856f2c04a92fa
SHA1 8da592b39e5c14e6d7e760ac72542c8f9334d29b
SHA512 d96278150f6f9e41bb552fe6ec3dac9478b411e2b062f595d69bad6335da16e9bc3c0ad9a2b4537f30cd6b03399dfa50795517e7695f5dc96168c8248e451086
SSDEEP 192:DW/rb/uh7a1gqJiIuj691xakc7HE/5jozaverJUL:DW/rb/uh7a1gqJiIuG91xakc7HE/5joq
TLSH
T12CE1DBF7C7E8826DDA1251F0AA186F1FCE1D0955436C3C1A89E4AF4BA3F2471E141A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 985f037309d689cc683154667d9838d8e75ee24a4decad6ad500d74334798875
MD5 67f6cdeda4bcbb5c8b2d5c81b72c6b4f
SHA1 1786f7035f5b79eed4eb1ec98e2ba6abb9890717
SHA512 7797b85bc5b2b80a2fd3fd261ab313caff9efd4cb990693994e2276cd2ae21f4f624cdeaa152ce5a680120019235d6c8889229169ce8ab7ec03e1341e867488d
TLSH
T1E9D02267130230B6E57E6E8260AABD8FC72B10200CC3E9E511E2A89C463A4BC851B686
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e5763c40b8cee3857bd3e5d34973176aa59a13380585238cad9a2db919f561e5
MD5 42c91cd7d04ffb93c5dc4ef1ddfffdb7
SHA1 eb97c203bd7f3023016cbee2d228bebca1b1e625
SHA512 5fed625131961d6013621ca190d0956927372647d91fb8939ebafa5e342604b36fa3fd624e0ab1d4ae9212ba300c4e28f202e68c677929b4fc161577ad781e8e
SSDEEP 192:sxZIRTyijBKOMl8MFE/fOsffnpCEgqbTP6OpzodpPF/W6+WNhO7/egD0r5Hvim+m:sxZIsdE/fOsHpPg6TO9/bG/ehximvjJ
TLSH
T19372D8156A78A977CCCBD219FA45BB53D7F9156391804E48EAFC9B0C00E67ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 1e127aecf4bc05d9dea88b4666aae1729fefca335b45f95deaeedab29264d65b
MD5 2c0c0166da7a3ffb88a841c310e0b80e
SHA1 d61b70a0ee7d72f62767fddd1f2208feb8731bba
SHA512 3a73384c95009fbbd5cb1d02d7e0085ea1fa9966446613944cb1bbf06866ddecadb5262f72435ce498889600248aed82ca4ed3dce02e7c3e20a2d3c37ed48cbb
SSDEEP 384:sxZqsBm1E/fOspVPg6TnnZ/bB14f/eh8imyt3X8DH:sCIm1E/f3VPgq/bBIeh8imokH
TLSH
T1A592181665249977CDDBD519F924BF52E7F90423C9804E8CAEFCCA0C04DA6EE6203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 5259827437ca802ee313af3b96e09920c8d2fe2f20036c50516726bbd07b3df3
MD5 8e44f4bf2d8777d86769668d2cac5a3a
SHA1 a4beb4cca02ef4e8a29c247a589ee452c4df9758
SHA512 9e23384813f4efc58b5ae01421fb575280d6783510fce0c4e86ea14bbf7601849ad4b37ee8e7895472e8e8cf39e617a2cebb154e4665a5102a796ae35ab5ddf0
SSDEEP 768:kA4so86s2+q7pLkdL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3JU3SLU:kA4so86s2+CkJ/HzWRmH9QYRu1jaKJUv
TLSH
T17D031C3B684CCB7E4F804E9CEC2ABE8A6DE8018F96988D5447FA444C03C67EB55165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index
Size 2KB
SHA256 336b065f0fa128968fe72e9d46c94fe66ef3b7ab567675a5e5759d1b9c4e3d63
MD5 e7fd2e831cb1b654db15d5e917397b14
SHA1 a403ea9a652a76e18723e7744ff5308e2fddd426
SHA512 3cd19234bc4f5e12e3c7ecb8326e55378b12f1a173eb38695af0645dceb5765c879dd7e59f742e7abf25b7a73520e197911cfaf9ecad7ff2b7c4d33bab4e5ddc
TLSH
T1AF41C55C9C4A4F1BC87916B148FA1429337498FD1A585B0B7CFD5A3A7C9B7612CD3104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ebf1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index~RFe58ebf1.TMP
Size 2KB
SHA256 7b17dc2405139ddf75dcebf54dd842d5c8d31f95f30fa325fa78f05bac553b70
MD5 685b32c621c3757d277b3f9748560534
SHA1 8a02028121ad0686f41b5add871be9e71568b463
SHA512 bbc848df03d46e1fd9d0276b1ad01a8316db21e46bc8d7f4d60d2f51a8469c29d2268fd541610c0995788f1eb0e9105f3f29c9659c27024208a2af9026b95d1d
TLSH
T1A541C99A6C864A23CD7184B249C92469333DA8954D44AF0B38FCC633ACD76A83E53254
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a50ac8d0badf5b2d1d6e858681ec6a597c4761e14eae83e2606d3e852862bad8
MD5 399793cb9f66528e0229933ed1490abf
SHA1 98a94d59d353002606d92e0213885e8f66e12e0b
SHA512 9cee06990281a37c51a1ef3f265f09d9dee5c25f029fc5da2b2a0a0375a22843a653ce34dd2f3a19b9438accfaa79da4bf61112c0f5223a31869273765791815
TLSH
T187E0D8F73EEB5924EDAB8BD5647180A45042B8688948EC4E642A739B10B22493446CA1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 cf1c478d36ee1d4968a6e2665a33ba0d76aa2d0563b281566de67e27955d6ad2
MD5 5cd013b1f4f4bcd39ff10cb8bef2f884
SHA1 2dc9f075f565b29ffaf6aad41cd5f7acaa6f90bf
SHA512 8c5242fbaee6845ec0b09cfd6916edff0f53d967efdfb9b7dfa96d47652c0c8ee065ede3a4fce7d39e7e546272b4e66ae26ab28747d0c2572667fba83d581a1e
SSDEEP 192:ubB91NPhfYXHkvl7X3S9rYBxTutBDR1itgB5b+Y3MrTI9rzHyPxf:ul9rPJYXkt7HShYZqDyZf
TLSH
T11CC27C91757A12907A3D298E85D5B83E52C230A37118E87B7BB900B64F67E20DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aa71502ad7730897de2ea356189beb9193ba5649f199ad35e0d5a6eeb7c53170
MD5 a129e189a497d044ca5c8a20679aeb3f
SHA1 f8d8ef6cc2e3e29a8a6ce633a61e6be7eefe596c
SHA512 427151de51be99bdf89c646f6f7a8eeca60ba3f597025d5875eb61dfb6f0988ab7ea39f34109419efd8fa30d9b9c48e51272101c0d6faf88e235a9068b95d2ee
SSDEEP 384:nPkiFJjccCs+Bt0S3K38NL18TUNTUlIR8zTLPSY5Eyr2V20fHYJD5Ys27z5HgVS7:nFJccQq3Q1wgWFPrR+YpgFAVtF81cK
TLSH
T139E2A2F198D78976E9AE4B87933D2E029AFCC153B5484994FBC84D1DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3c9d606fac6b6797f5d9bae734af13cb8f1a63c1b4087d1c1cebf98a1af499af
MD5 130c1d994f50ae575172fef18cb33fc0
SHA1 6f21809f32573fb41f724b2c45f5d5dcc187b054
SHA512 c885b71547ec255586301009653e1ace784984ff894fa88c3464080d383a05afa6b11c0058c694c06faf96b29ec428afcb7e941c2ac004aeff5591dbe77b734c
SSDEEP 384:nddiFavqMn38NL18TUNTUlIRggPSY5cfqV20fHYJD5Ys27z5HBV3Ra4j7rN1k+5Z:yFayo3Q1wgJoN+YpgFhV3Raex
TLSH
T1A8D24C32E868D9A7EDEA9FD9A70A7603EFE00153D98C4AD4DAD85D0D00971DD230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f9c4ab3ac2d78534882a2bea1ceed0e5c2473419aba9fb6b431775b4e35736e2
MD5 61f9777f9bbb2918410c008503caa9fd
SHA1 4714e2be2e75109404e011e703bd286bce389064
SHA512 f8ad6bdc4d3fb875f03e3bee5fed486acb14ee9e8c6881bef55708b65ea74a96addd65002ddf30e85713dfe20ef1c496e738091bff3a643aafae71f75dfe8047
SSDEEP 384:nPdiFavqMn38NL18TUNTUlIRggPSY5MfqV20fHYJD5Ys27z5HBV3Ra4j7rN1k+5Z:MFayo3Q1wgJAN+YpgFhV3Raex
TLSH
T1B6D24C31E868D9A7EDEA9FD9A70A7703EFE00153D98C4AD4DAD85D0D00971DD230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6327bfe1fafc30ab05c745444d5ccf3e4d4bcbc5b811063bbc84edbbc7691632
MD5 8617f1f787bb4d2c10a286dc1785e6f2
SHA1 555eac76656313bbafc3ab83e60dce9ea407ff53
SHA512 942783ff9034961f5025d64bba503b5f94a61f3aef0c3f05a1f7b7719095153e742021cede262cdab22478dda18504bc5e0cc05d1aa4ff077658aff1f369b747
SSDEEP 384:nKdiFavqMg38NnH8TUNTUlIxBgPSY5oauOV20fHYJD5Ys2ex3Ra4j7rN1k+5vI+I:pFayv3AHwgG7u5+YpLx3RaeE
TLSH
T186C23B35EC58DAABEDEA4FD9A70A7603EFE00167D94C4AD8DAC81D0D00D719D230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4023984bf58ac4640e9d8b5d679437e6305c6ac50fed9ceaa8f1c21232010563
MD5 f1ce0668569f0fe8e2ba5cc82ba86b4b
SHA1 6d3422efa91738e54ac4375c6b7ca0c39928dd8f
SHA512 67fd0a3e57110144a2135c12a2a0f5e36a594c3c75f1c56d424c01ab685fc5ab720e9538c51386166129fbdbf737e49db861a3d67691edff3b353ddb42cd3036
SSDEEP 384:nPkiFavqMm38NL18TUNTUlIRPTLPSY5E3r2V20fHYJD5Ys27z5HgVCRrN1k+5vI3:nFayb3Q1wg3qrR+YpgFAVcQ
TLSH
T19BE27EF198D78976E9AE4B87973D6E029AFCC153B5884994FBC40D0DCC861BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 44b85f63bed985c65718d3d8563d75561f71b711133008f2d40f16a0b7e70519
MD5 85f425654738b32d58e152e2c29895b9
SHA1 2a909c0b42a9345e2467f52f9be643488c8f6eb2
SHA512 f74dce274328abd5b5c380feb8dc3c24cf1d6a4f101b5481e27db2b067863c8d84778313711556cc05473e41cd3258afd5792b95083e5245b4368de7fb598638
SSDEEP 384:n5diFavqMg38Nn18TUNTUlIxBgPSY5YYrV20fHYJD5Ys27z5HlV3Ra4j7rN1k+5s:WFayv3A1wgGfg+YpgFFV3RaeE
TLSH
T1CDC24B32E858D9A7EDEA8FD9A74A7603EFE00257D98C4AD4DAC81D0D00D71DD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f34bf8d3770044ca732607e6529b3cb384091d0ba6e1b1198caf557cebe74500
MD5 39c24bddead8fb6f2140413d06dca6ed
SHA1 68095b1d56a3cc4783dcc44e49e640c6c6270eac
SHA512 f74d21857acbb561961713d3ceb4f4c234cdc33cef1735ff60cb8b5772a40ca7a15906a7adc9016d009b1e80092d7e4c004bacf66752d6b9ac16bc5881e5f49d
TLSH
T149E00103E74441EFC038037444C7173027D2C02141B1030B589062A53C172001F24FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594397.TMP
Size 392B
SHA256 2b41f839e04574c055c49fa9fa4741fdef88c0cf32d0f69f45c5ce3c570c90d1
MD5 2ec47e67bbdf6437ec74b6784bfa45df
SHA1 b7e140ae721a2633e762efc60560c8bc97e00fb6
SHA512 507bab28ecfd59d202c371fbfcb8d2dc8ee6dbb01e839d1a0f383ec3359f7538957a194d0407cda1ed700a93247344f21e42125ef0a6a21f86450bd3df35b00a
TLSH
T135E00203E740419BC038037404C7123013D2C01141B1030B588062B13C071000F14FD0
MD5 SHA1 SHA512 TLSH

Submit Download

ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 49dee4519296cfe64f14418c408fb1e26710c833bfdd59a67e61c6f0c8461eca
MD5 4253fdd629204a9f147b4a12aaf2b5fd
SHA1 1048580ca1f0a5a753787848b82bc8c165fd4d8f
SHA512 67a37d1b7f80d171c80e8e8ada648bc184f7dc4e44c8ace55a38fd45c368efc17ee3f0838d824e1cb0507033f5a43c5808dd629c852a03551216d1b122603c37
TLSH
T18BC09B47695E1EC54E58067D45054D368AD6574563655175380B7904047431D435145F
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1437538193\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads