9afadba0006723439d704c1bf3af6cb9e3b3e0d4796dd2fe89d8fbcc7d25c7af

Analysis

max time kernel
144s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2025, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qs.html
Size

1KB
MD5

da9de559f7a4f35fe72c9b6d115e017c
SHA1

34a2fd2290a6bdaaf08495f9c89ca66489828510
SHA256

c40c04a36754e564213ba5f0fc09379806de17d45dca95038876ecc144695a5e
SHA512

91259ac8fca0c115b5193892d097098ca74684dc29943ee38cbe4ac79e3a917a524b8fe54723080ef21938f3730b812b33645b6da385a5b1ad9a74a0117a5ba0

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1412	msedge.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1056820804\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1056820804\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1056820804\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_829146930\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_829146930\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_829146930\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133894249904511430"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-599783296-1627459723-2423478968-1000\{C387E232-90D1-48ED-BB19-B9C2958C32D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 984	1412	msedge.exe	82
PID 1412 wrote to memory of 984	1412	msedge.exe	82
PID 1412 wrote to memory of 4972	1412	msedge.exe	83
PID 1412 wrote to memory of 4972	1412	msedge.exe	83
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 2256	1412	msedge.exe	84
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85
PID 1412 wrote to memory of 4936	1412	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\qs.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffd4a9ff208,0x7ffd4a9ff214,0x7ffd4a9ff220
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2624,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2316,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4704,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4676,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5744,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1096
    3⤵
    PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5736,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5736,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4140,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6124,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6120,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5252,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,9504604744863802303,15239418122255179234,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a809995-da69-4524-ac2c-d2c11b01dadf.tmp

Filesize
40KB

MD5
7b088d841a8c3b4f3e4a4474f82dfcf5

SHA1
a4cce6347a431ca98597fc5410b534e2b51fb451

SHA256
4bec431365d12cedf8e764556b58e77d37327b6d0931471de1e84643e64fbac9

SHA512
8ee53ee672ba157264f36ec8fbd878fcbd2059c764c7ba3b721157c4c8636dc0e508593787d44a23c3e1b5bed0bd5fd3f11feaa15fe1ff949f0c4dd659cc7ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1781354d27507643c155a786707c38a7

SHA1
2640329f5fa81556f623a621d593cf34ac7c4aec

SHA256
53facdb807aa83e6148a7c9aa06da7783307ee5012b638eb05210554f85cde80

SHA512
abfe8088d4714d74d0011578f8964a74c7d79362cb5b54e1742ac5b0b5cfae4d108d8a11843121bcb4d96f3c693c02a7c02164edf5157f21e51355e23721c37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e461aa7fdbe04bc94875fd7c2aecea9c

SHA1
9b633238fb5f1ac1388b308d32f435e6a33899fd

SHA256
654751ee4e42c47d7fdd67aafb87b84b2f759b03a7f7e092d9831218e26410d6

SHA512
07f8cc60d687dcb857a15e4a82aa94738d8ef616eee44538cea719de2fe5a2d1669806d9f6e2a9773dbc85085a1edc8d313be4c33ca54a11cbd1e214313d65fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
41a6a1b3fe6092acb8ffd2544293092e

SHA1
329117e5bcfd39cc8e3be2e7c535f9a7ea7f699a

SHA256
676f1c99b2b7fd5285dcf498d02a36f9ada77fd894d999ddc4b94434e9507d46

SHA512
5814433fb8fe182b4b74b753a6b453ee3ee81c5c3395d8d0fe9f2515fa3072f0f05e51af66da7ef68673081c67b73b759e1a01f08f31112267761df888578677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
afb43bd7aeb53f96ff419a7d30ac4f3a

SHA1
792eb2f8955ca75388e5a29ad9176e2513ee857f

SHA256
57f3b2bd3520a17f8c23efd52d74287fc00664da9aa28f8d3c9b94c1e9606175

SHA512
1fc37a7719a304f3869dd5354c8e5703aeda3a467f85cb70c26d6f37e6c02aa226d0830ce1b6bb6d3b248cbe6ef68825b30dac385f703819252bf626d34c9f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
9ac506cb9848a42008676097a9636fd6

SHA1
693de86938bf85755acfed417bd685d08b287bd1

SHA256
88769b5c88c9b31827a891e98284baf67e879ce6e1ca1b84696026378069ed53

SHA512
9fb9418fa87bd3d1120e13233f4d973a8307055260437dd418f1e3813d4a6b4d7dbb13abd02fed01537c02bd3bb8b7cf5a08254d0fdc1e24f0fcf7aa76785fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
0d1459ded2a1329340d1d7002c726004

SHA1
6201b5db7849f509ed62756eae02d996fbebc82e

SHA256
9ad63e94b12af6ea2b889bb220bb9c0d6dd7933fd037767f455d93e8df688c78

SHA512
8d17b6b6c515f1184f966a16c2ad5599086d0de597e4687f808c8008382f09502476637933beffa811c71152c5e5657339ae0a6b5e52ee17fd17a888304a1f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
d06d95e0a740c5771f076682967d894b

SHA1
cda13d9ec184ce9c505d94acc4fa9174b2da55a9

SHA256
76ed07e72aeb6976fd3f266149591887cd8e2a7d6059104f0b5a518ef37b4341

SHA512
07c269229bbc897b4f9c2caa4694123734041b92ecadfffbd30af4bd6d8aec52f59c6cab2582c6c6fec5f6de781de6ee2cdb71cb4509713d14b255024f3edb33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
d97bcb4c36f117bef77f8779c215b79d

SHA1
5dc4c829208eff7ed9e761c81fe40f71c614261e

SHA256
82861f7009647de18c7e07d45e2691c7c9404e26a85c38532117daaed38b1d99

SHA512
250348ce8721847c77eea5a59e35863753c1ac32a65c839497a27c3bb8e89f702d4522752098cc98dabf28332c0fbb0f04179d7a90334e91254dcf70ff41d337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
6b70d0c59bf5c540bb509c4fa254261e

SHA1
0fef12ffee16853e32b49d44ee99635dd107a0ff

SHA256
f77337b45f0d2936555dbf0f35cf649e39daf625b13d3eb8a83861d817a02e5f

SHA512
7f89f640be4ecafc074233a2b986c055b029d83536d86e5b2a9cd41a62e4af32516795780f85624b0eb7768fbcd0eaf54a9f5f41b0c29977e6b77735d61fbb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2024.8.10.0\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
e0d1f420049f930028f7ab809ebd2d03

SHA1
6a1399844030b340b9c3574283bc7f7cc3e3c411

SHA256
a889147273131848cb5ca958fba7acdc970ec2a167c420df57f63ef14368213f

SHA512
909307cae8d6eee5ecabc53ed4e295ffffc1b1b9851039328a1df20a66ec4c40c8b3a091563768c80841a8e02c3dc23398ec612feca324152241c1dca0b695f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3b13c582b91bc16a3aecf0329d7f4ee9

SHA1
c1a285ba5a25dc240cd799789881bdac69219fe5

SHA256
5a0a7c32523980f12a4e0f363a3a59de94c9fdf2f64950c597a23d95644be4c3

SHA512
aac753868f4880a335a5fc1e0891d10e12867c828318b9cb6f6fa9b8281c64e4c5de554ab752f7cd3ff43acae06128a40ffee1d095bb4b4c684fe70889b4b18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b1890fc30d475f9062d46dc34689d863

SHA1
11b14889e3120131abe7e09c8ff1ccd0e4000764

SHA256
05022da94765b4d698e05488b196309aaa115a88219763e924206ebd01fbf210

SHA512
69b6593c70a8bc4f936724a8a5c949a7cef4b647209fe625d08034f9bb9023383ffc2179f5ca4d6a5857416209d5688b942ffb5fef4e5f4dc19abc3fa4dfead5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.17.1\typosquatting_list.pb

Filesize
623KB

MD5
5ab9b7f0cc325613a81d9ebcd04aaf2f

SHA1
c7599611befa76f7897067fe24dabb823762d1e8

SHA256
578117941516ab6624486eec10922aa8fa56526e45fab4422c722784654eb8d0

SHA512
fd20a7a9a4f83211edba010a3dd4c372b0d74e5e9a7c62978fa471e3dfa671beab8c379b6f74a13c2d38b40b4ac95c68544e4128f6b2a50bd383c1a5f1d97ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1056820804\manifest.json

Filesize
118B

MD5
b6c3a53fb568b72d31dec81b067c9ff0

SHA1
77728097bac348a4717aa95d4e8009d225482293

SHA256
602e1e0e0c8d630ec9f04f3f70b54ab0281942f4107e77047774fbdfa2d1acab

SHA512
b4d2204d7d30f7e09dd41bfcfe1ed4bfbee28357b49caf26d2a58f3c8346196f153616758eb86b1f03eabf02180506cbc36b23156fc47ce1c0b6922a7a4f718a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_1325164683\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_157096008\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1412_829146930\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit