hxxp://surl[.]li/tsihvk

Analysis

max time kernel
99s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://surl.li/tsihvk

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_215598001\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_215598001\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_215598001\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133867822156803367"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{FA59EE63-683D-4AF0-BF27-F6BC6B6A2692}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3976	1156	msedge.exe	85
PID 1156 wrote to memory of 3976	1156	msedge.exe	85
PID 1156 wrote to memory of 5368	1156	msedge.exe	86
PID 1156 wrote to memory of 5368	1156	msedge.exe	86
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 3500	1156	msedge.exe	87
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88
PID 1156 wrote to memory of 4392	1156	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://surl.li/tsihvk
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffed83df208,0x7ffed83df214,0x7ffed83df220
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1884,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2080,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2632,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4328,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3824,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5832,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5948,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5948,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6468,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6332,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5860,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5600,i,11462627814553991105,18055217008830147590,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1156_1877596724\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1156_215598001\manifest.json

Filesize
118B

MD5
9191c4202582ea72903a86ce4e48a007

SHA1
91377355303e460951f8d4af612f80d86e5071fd

SHA256
945cd01c82a269c67b1bd6b76dda407b9c4289e4dfbb4a5d07e4a6b389430b93

SHA512
c4784538afdc8c3de223d187001c13a7b6c0309feffbcb88ecc689357ea04252e0521a5319f7b28b208df9e6b3880f54ef7b08b0ba33ce458f1277b3afcbff7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
e2a3a34ff9098824f155a8824211d2ec

SHA1
fed3483c06eca7db56f37d35309b389453ef2378

SHA256
85268bd2bde6a2f559d37527092a567ffb4aa01a7ca973dd0bb94f89bdc365a4

SHA512
f7c40ff1dbe20926ede8141dc1a2a978a01d4ca749a0195d018e9d61e3a7c2e4d5b8420b33d9bc18e7b0c7ac533033cff5c599898b7a7681321792855e91900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580990.TMP

Filesize
3KB

MD5
1b48f65358dbf4468ba2fe21c9ebb0a5

SHA1
e1f6356389f5efbbebaeb5d1221a442a7f7e55f6

SHA256
512837881083c43fad877169765efe637f292af870edd0eb778d2b2a90176677

SHA512
db5337fac2afed41f0b9219836bc11fd0a16cfa9e8e3c32fa5922a62df3a190f73bc1d17abc0bb67972c73d075745c5897310d03f4a99b422baf2629af6ba698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
25e340206595c496a71adf79ba7bf333

SHA1
20d38b310efe544f95cc2778ccaaa21e7ca8de48

SHA256
9d2b287f6173842a07c6df3f1b3f69c4e3f630c9f04c2f09391399814eedb5e4

SHA512
9ecfec3fd2eee3284d81d90df6346d6f89d5a2080d012072386ab666f3abe1b6625061dc56fbc92527b3e2ea2835161cd13bf20319726fe980610a85caeffcdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
85a6edf7673f309086bfc19664a2ff04

SHA1
12cd8d398ead732d0b3addd59a06b62b1ffed1e4

SHA256
a5afccae729df9ca15d3b752b7e9978cb5313b8b78de7d42bc94f0ff544c5088

SHA512
9e0f6b67c293e2bdc25d15a04dcac8867c0077d0780de63247a17cda2a20f59ee723c8049503efe00d19687a6dff2af2371090e3ea1c094c4d71089015081d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
772369b147b3b21db6147738344feafd

SHA1
d14735a137926b5f62f3bee238d9d78467e628d9

SHA256
4ea8200b6ab81760af8cf18793a0c6d33dc947a02b55af0fd811e03d25ccaa10

SHA512
986d689dede53c7e150a6951a3bcf615903970631973e2a6b851d9fdc12e53fd6acff3461a0e9f364bd037bda24d2dab6e67399e42ced4f2176a788c6d19b131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
484540e254837a111c6cd08bf93dd253

SHA1
34447b85b799d5e7ddbdb16b8ef726f47a63d128

SHA256
ae590c6cc23092ae1350bfab1a876840f835ebce6541db14965bdff1fe812494

SHA512
5a05e649726ed6224fa8c7a324f9f7e1ab8f3415057c7bac49aeae46042b5d746aff2a2d3988422c407743f881ab3e611a17a11c9dd007684620b0ce39ea8785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ee29.TMP

Filesize
72B

MD5
3577644f7ff2a06c4dcf69ddf6ac2d2b

SHA1
f358cda65c290d7ac8ce1cc5f10786c0acdfce3e

SHA256
f4ba4031ddad9db6c88ed12c1838d6c888b51ce97d040b3b1b03c78c8997d99c

SHA512
15c29b7642f70e5cd0b10822019e6b36bb17bb6e1ecaf968180c09edcc6dc4a3887e8b38f68fad41e415c3ca134a2be163939fb9a48621ba1b8a5749bb1f4c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
fe93d0023a360c293d694a79ca0f1fef

SHA1
2d76d598f2be8f432898d84ab23e82fe26af2766

SHA256
07c76df7380ae913f1837a55ba6371e162af3b274f2f61db1eee3cd93f5c1e2a

SHA512
64dff5d093d52d47b4073a05c4779eed77ed4627655762af2eeeff59441bf90a95175ca4f556763980e32bcb5919e85380b6c6ff5fbd0160880ee344b86f58da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
98fe3b033835685baacebd3a239befa8

SHA1
3948d9a3673fe172e26b0adf37c1803b73bfecff

SHA256
83f2cb39ce87d868e15ddc83aeebb5ef499b6ce1e6291727e13df704edd77f3a

SHA512
4b1ffd6050ffd97a95b2aa986d43b133aee9434ad6bfc60d0858053243e9fed6bebbb2bb3335a1ace5ef68df68f82bc2fd3b7b46769ca5e8990221973de38b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
f682b91fad76eea1b32cd1e207707803

SHA1
a5c5097c3f4e9a861063f0faa586693968672534

SHA256
4336fe5882d289e5bd744fbd12e56ce040fd414df6f192a35d1c159c4ff6c4b3

SHA512
a45438cf9c16eedb171d14aac5ec5a11a9ab211bc12a5d4c21fe89187b97f23dc10277571cf0d3cedd6416740653f78ffc7cd0a9f6ae3516eb441b901485c6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
902B

MD5
2e606b5646fa5762b2991c635bd58c49

SHA1
f57270ea1bed9bc7064b43ec6fca3f56c6fb049c

SHA256
0dde88336b4dd54c6f6bdbde88476f166bf951031b97a7440e092f3ce3c074d2

SHA512
2afc10645dcd403434df5c960cfc4d6cfec94728b57012ee3e2183dc9c6d83b4ae247af264f12249d24e7e5e6e98558c23c6f91a99fba7d9e1149e86db458c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
ae18e0282ae28ed80d05699abfd5e72d

SHA1
8a2236ff83594997aab5448287bce72826929fe0

SHA256
e4b6b573b2e9f646109fc2bd57f431c76104bc401a084829a9aa2d0fe176b6c6

SHA512
769816ed1329cf517929eefb3a72b1e15d21dd62c0a11e822faebdfd74caf55b392db7ef983262adecccc31187acd417325ba63be0f53612acc8e3f34cf09367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
57087404c3b9d6825918d9b4f36ca91a

SHA1
a51269c9ce1af875d30241c1c6ba972d9393db87

SHA256
996a5e4a5854495fe0387ccea31cbac87018fa09532bc439d608ae1edc9bdf31

SHA512
7cc83eea1c1bda2cec16be120ddf37f3a60bd24e3b7b52f7f6c1b458a9140ac62e56f56b8b7186a45d8ea1281253748695eb8411359e20517ebcc92a8c1d7863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5a205014dd55a1d2acdc90f413cf90db

SHA1
43a2262b07b11ac2e2ebce0173488841c16be993

SHA256
3ac168193c87b20664c65d7bfbb4519f2a776c9bf3a9116a373dc8c57f7af926

SHA512
f09518394cf2c366c82df238c3ad7c21f51f10819bf88f8f70da60b8d5d59a490ab435ff1bbc0756b1de060257cbfe3529593b45f59295075cf6ab03d335602c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
6427a294dccf66469ab742feef667659

SHA1
bc08bd24038790a51b274c67389c4ab099d411a3

SHA256
e73d6f8cf11af186a0216acd2d695238b04b28e277e37cbfb5922d60e30bdc88

SHA512
1dc9fd32777eac7512f9414191004d8a30cc5c0e3ab80c7ca026d6d75a3988fcdfdc9e94730d66e092f6cdc95aa162b59c379d6561afbc031515d9e92b82b3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.18.1\typosquatting_list.pb

Filesize
635KB

MD5
9bd22564aa3ca907ecb09074d0f011b8

SHA1
1f15761be36f2fd400e6ce7f9fbc1d613be8b81a

SHA256
a295e802149a6350aea7d9e132e5bf99c36085bb18ed5654b501a9c1d24dc4df

SHA512
47b17689549f292e34957c2a89dd273ace59a69975c0450cc9a88ee3cb5c2fe72543c370d858bb15e14002fc387d3ecdc1fb2eada53497ecd9fec8e0d6b2aa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
424dbbfb7206f9e5fac41ce7df5ffbc3

SHA1
c6cd8f74a054cea70a92c63cd92712724c56c00e

SHA256
f3dcab1dc1fcb86b547b718fd9ae7d419e00cb37334fabf3e72200b262e87872

SHA512
c69a97f0ff5c531d0f4c890524cb0b5cb1497d5b2806c561d0233dba46b98c803e9e409b76bbf136256ce240d8b1e994692c8b658e47d29f9ad30fdc46fa768c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads