896608e54883504d4d0033e3f7c264004d21ce803498ab209c66970d4005894e

Resubmissions

18/04/2025, 21:39

250418-1h4f7swsaz 4

18/04/2025, 21:31

250418-1c8tqsynv2 10

Analysis

max time kernel
143s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Murder Myster 2 Hub.html
Size

12KB
MD5

7e8785b112a2ce7261eff35b26ac0e92
SHA1

b570b0ebe790f82aeb6127e891b0e7657d49db77
SHA256

896608e54883504d4d0033e3f7c264004d21ce803498ab209c66970d4005894e
SHA512

e2935257e3c2fb75bf5ff799e5721a60febcd921684d905c1a8e5c0c8f60a0d8db4c3a7045608cf022408bb67b7683bc2420bd4eb4fc92d254a6b4420608b687
SSDEEP

384:OpRilUshGGzUeUIOUeUmSEi/Li01UOUTVxWApJWDWigqWia03StSimSiYSi/43R5:OpRilUOGCfvOflS5/u01/8xWApJingq1

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
800	msedge.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1040444201\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1311960301\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1040444201\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1311960301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1311960301\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\crs.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1040444201\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894855572721399"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2787523927-1212474705-3964982594-1000\{C2740F76-333A-4540-945B-C60861A77A66}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5428	msedge.exe
5428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3944	800	msedge.exe	79
PID 800 wrote to memory of 3944	800	msedge.exe	79
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 3384	800	msedge.exe	81
PID 800 wrote to memory of 3384	800	msedge.exe	81
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5332	800	msedge.exe	80
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82
PID 800 wrote to memory of 5024	800	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Murder Myster 2 Hub.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ff98919f208,0x7ff98919f214,0x7ff98919f220
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2472,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:13
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3392,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5020,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5036,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5788,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6216,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6216,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6236,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,5761026799305653365,8280018196446230712,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:352

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
34d09b852bf4a5ef1d936591501926ca

SHA1
88ff0b1c2a5664765e11e47843a5ac8e1782ed0c

SHA256
52bd897dfdfca849d627b36a49b976eef861b1a7af075527c8f247adb862dc20

SHA512
dc63eebf94384dc9580f5e3c9291047e8d410f8fc1f746d180673f445a9bbe746608c01cbf10a38f2f935cfa5c8bb89864f87cabd8fece809dcaa1fa137f71d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
04b404a7f221a2eb5e87aee4d9c32589

SHA1
f5ed9a9c4661c6483a36671e4868cb05292a4fb4

SHA256
2a3288e7bf25e3dc2cf4cba4f17cdc4765f6c9c4fa26f904f4aa369829e5d3d1

SHA512
0a5eaf49af1b6cd1dead6f8cced094e1132a834ff0d3e7fb4cddb3c6fa313594f908b47ab394ec6aabba57228db8af61eedbb21ecd0e2a9eea791c8c57548473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
01b3f1c9a2f0738de963d5a10edcfb72

SHA1
e6e1489802028c1d64b03d49884fdd6a58a857e5

SHA256
cc8f8dcde06899342eecebac0646ecca356ba02a76b69984ea0e61d1e97550fb

SHA512
0abdf4dc00dd3466d4a2742dbbb0b34f3de9b246f8fa0bb5a9f476b42d51ed4916c3c7271e75288adfac5be7bf6a7f19ebba973e427a5be148906add5dc3be45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1032a404ec587b1d6e5d3d32bdb538f3

SHA1
b82fb72899048d7fcbed5fa3cdbe5c277b3406ea

SHA256
653e5124856fb9eaf8668049b3b478f6fe5457d436f61b854a7f6d98f512dcf6

SHA512
de901fd7b6d4528dd0412e4ef809fd256155b3b33c607b1c5cb0b62f1f4f313b1b0e9a01e5f529929d01c180d0b0d76c637d76d0a0cce99fc84264bb6d8bd6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
a5231bd1afc2f42b2e26f1ab10e61922

SHA1
e362c52738543c3dfba324409367077a75c5c6a7

SHA256
1e819d0458bd3c15d2f9e8403e32026e78cebb3c277ac91921005a2c5a0d3ad5

SHA512
807f2b0a3ecc4963cd928adf5295f72c9a45484ac29a35619ea64a5abd89d30d0e5cd044ea14578211aa1d213dfca5231193313521670b93115ca05efe493435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ab5be4e5a1fed73c2a607566e9e71d78

SHA1
fc81ea7b90b866bc654088caf6f5c056b0ece684

SHA256
1e5dc414069e9744c0270c67f65b12f6321eaf017448546d46569b83445972e3

SHA512
2e0cb23c944171a09ad3067353a492fb2ee4b78fef961110469d99820b4f3df0cf06ae40dc6be19ed397b5d3210a5e4ae63888331470cb611999a50283b5e6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
ee3a9f6ddf9089f12cb110a744ad7c55

SHA1
ac8c82e80fb19a698f31682c4e34a20e2dd01515

SHA256
25695dca390264c060670cc6882eb58cb3764ead0abf2f2222ef52237e441015

SHA512
f2ad306ab0bc2192f50e82a0d9b1cfe7ac2f71f926ee2d69bb4a4d99cca5411ca6180990a59e0f3ed0437515d1d1c43bd224a42e055562feffe28a345b6a6db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
7040295bb270b17dd24d0fd77383d2cf

SHA1
78602d0e35e6f357803b4784bfa6502ea157448c

SHA256
68094368dce31a04fe088e61f08eb75d28e2b346c4534a24fdb1d08eded7d309

SHA512
da9ba989f0efe0795c048e5655dabf73e423ade5990f54e5104d66370fac3c232f3495ee742b455b72822168e82f797def585d1e34de4c11e87eb7fdc5b2ce30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
7d24a8c019c5fcc56dd86e415e65b42f

SHA1
53c0951268fbd0c5b01e9dc51e82a4250bc0830a

SHA256
85401b6698641c684eda1425104941c51b3807ba3d43efb1e5eb56bcb79dc0f5

SHA512
e656f6faebe5e2bf29fb1e7a879053960ce8d0a4f59e9b7414d4a1d6ac10fa4f03788d9ad0490c71384fd4a2656ad92f521179ed28b4e4330bf0262fe5ce7275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
4efc9bd383c37c51374bd3c331249982

SHA1
78c0ea4b32bbfb0f2ea590d2d62f9e7dc48e617e

SHA256
0077126ba79cdc4c72284cfa069531cd34de96a5eb3674162636ebe68e84e5ff

SHA512
83857f20fef1eb3ad74c6d1186c8ce6b83d961aaef0174ab9ce86c912ac16a8e3780d71379108dabcff72258a0c90fc0f77d23a2a7c938600c267ee7451d2396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
2af0fdf41393964614f5dbc83f8a5d24

SHA1
299f8af0c1d04834270d51ac8cf67dd66c8d03c6

SHA256
6c5f950f87bf14ae987ff6bb37e742b6ebfb801f8e10deb8288894543576914b

SHA512
1b6439591f329dcb87ee69ec45a2908c44201885a54d5abddd1fbcc3d606d03e1bfb70d60335b9d7ba272d6a929494313eb54fb3239d28b8ef8d44a755f5c919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b32d46f413eb84c4413ff42f2b4ee9ea

SHA1
898dc8495ac1741134448cd1ef8f2e578fda27a9

SHA256
a0d97812add963f6ceb145ca05c749f10ad1b3136635ff5db015295bd18fe16d

SHA512
49eb506e8442ba10a2ff72ef6dcb275a63367f26db9249f4d552b1623c674d6241c54535eed7126a322c28a1b976596593c9de58ab16d72ca7a8bd50618bdcbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
91d3d4c40c96687a526a247fa3ea5f35

SHA1
4e3b9786aa55a5143416cc26d17ae100734e2dcd

SHA256
73727efd887c2c02d03a318f2743734bdf1280ab61830a74b28883d95c6023de

SHA512
89b5221ce9eff0dec010e7673b4fbf6b4cf73c82972003c9dac45cffe2bc02b04a9972243dfb91875db48a56de7d2d66956ac44efd11264a34b77e2b98aefd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
b7835fdea78aec028b9e3a46a001dbd2

SHA1
ebbc0846e8be280b698e7efd38ffd8237632b894

SHA256
d1fbc643ce2590fd63265c2b3331692616bc7ffb1028ee809ce91f9b0c735fe7

SHA512
9082aae51e370621723a3d8dd625f95d69e3ccb19699f0f68f2f361dc387703a4cbd433eaea8d8040500adc267a91969ab77312f3512efe66ac0dad0aeda38e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
61f1500424ab700e1d3f1b836d84cc0a

SHA1
c10c58221a151cee77aeb4269087b3e562ef70cc

SHA256
4eee792788e5268cee753e6b47b8b90af9c7b67e25304d8139bd7ef4521c78bf

SHA512
391f6524c759557e3bce822551cd18b6b5383ee27dfb984aaf46ce05a0735f6032de7bd6ae8d18f70af8f09ecf0a8509d01a2feac1a94c649872a21a585915b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
5598037354019f4510bf069dd614aba6

SHA1
aa57ff24cb2e26fb6ca7f3b8fade03c3df97aa92

SHA256
2a0a05be9bea83fa200dee703205c1f1cbdd7a57100e84b8861425ba3f7253a1

SHA512
4fedb514a8baa211ca1d2bd1f10584a9d9e786e550a0def5df4a12e9dd935b60ad0065bc411d4545a725bca064e503b1423d7bbdfb83014305017f7d35e23d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.18.1\typosquatting_list.pb

Filesize
623KB

MD5
9cc0b895391b57b727aa33c9726290fc

SHA1
5d0e6946979b7cae22fd9a02e1df69e1fdb73624

SHA256
ee177ed63dc6421b74f786428dce7ab84f06e2d565399f96fc8c5a2186f6a9ef

SHA512
af3137e5b62e207616c441425cdfa22d5bcb9e195ab2d59dba43b39f857e8ecd85b30aec9e45f5a7b6dc6470f073c1e0c2203dc8e3b384eebdeaf44d84f2e8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1040444201\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1311960301\manifest.json

Filesize
118B

MD5
95be3969ec6c6f9649430a301555a1f7

SHA1
49e369ec2e3b392879d6fbeaaa6752705044bf50

SHA256
e00d423af4689db6f1b2efbd5e338f260bf1ed6799746855471e6006464a2216

SHA512
ccf958beaf2890e878aa927ceec5dc78a680317662398c7e450f707b7f6403f44eaf1dc757692c02f09c590d5800c33c6963f60c3bfa02ae7844d66080418e29

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_1671170715\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping800_406431650\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit