44f5f1ebe981c5ebbb31e1ea17f04e9ebb96bcfa7de4759af864024ab16c00e4

Analysis

max time kernel
148s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hrss.henan.gov.html
Size 851B
Sample260523-wsbrqagt2n
SHA256 44f5f1ebe981c5ebbb31e1ea17f04e9ebb96bcfa7de4759af864024ab16c00e4
MD5 681c413fa7635bd0095c9cff431d116f
SHA1 80c9f16d4c24b7fdff695ef2bb307f9ac106b82a
SHA512 0b809024f5fe62c8f20e7bfe833de107d724af128d39093fc5cce3c57475a94cac405cadac81e242d0b3f952a43be9ce83aad8fcc0a397d49601e5c9e3f56d41
TLSH
T18101BD2434A00C4496B276326EF7F26AD56630632A959610398C3A13EF366205EA3FC9
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_835729365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1074106241\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1074106241\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_835729365\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134240334451369970"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{73405732-AF7E-48C1-8965-46C53EFBF36A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 5140	2096	msedge.exe	80
PID 2096 wrote to memory of 640	2096	msedge.exe	81
PID 2096 wrote to memory of 5216	2096	msedge.exe	82
PID 2096 wrote to memory of 5216	2096	msedge.exe	82
PID 2096 wrote to memory of 5216	2096	msedge.exe	82
PID 2096 wrote to memory of 1876	2096	msedge.exe	83
PID 2096 wrote to memory of 1876	2096	msedge.exe	83
PID 2096 wrote to memory of 3148	2096	msedge.exe	84
PID 2096 wrote to memory of 3148	2096	msedge.exe	84
PID 2096 wrote to memory of 3148	2096	msedge.exe	84
PID 2096 wrote to memory of 5648	2096	msedge.exe	86
PID 2096 wrote to memory of 5648	2096	msedge.exe	86
PID 2096 wrote to memory of 5648	2096	msedge.exe	86
PID 2096 wrote to memory of 752	2096	msedge.exe	88
PID 2096 wrote to memory of 752	2096	msedge.exe	88
PID 2096 wrote to memory of 752	2096	msedge.exe	88
PID 2096 wrote to memory of 2016	2096	msedge.exe	89
PID 2096 wrote to memory of 2016	2096	msedge.exe	89
PID 2096 wrote to memory of 4408	2096	msedge.exe	90
PID 2096 wrote to memory of 4408	2096	msedge.exe	90
PID 2096 wrote to memory of 2336	2096	msedge.exe	91
PID 2096 wrote to memory of 4876	2096	msedge.exe	93
PID 2336 wrote to memory of 1404	2336	msedge.exe	94
PID 2096 wrote to memory of 5072	2096	msedge.exe	97
PID 2096 wrote to memory of 1288	2096	msedge.exe	98
PID 2096 wrote to memory of 4492	2096	msedge.exe	99
PID 2096 wrote to memory of 4756	2096	msedge.exe	100
PID 2096 wrote to memory of 4756	2096	msedge.exe	100
PID 2096 wrote to memory of 4524	2096	msedge.exe	103
PID 2096 wrote to memory of 4524	2096	msedge.exe	103
PID 2096 wrote to memory of 2996	2096	msedge.exe	104
PID 2096 wrote to memory of 2996	2096	msedge.exe	104
PID 2096 wrote to memory of 5156	2096	msedge.exe	105
PID 2096 wrote to memory of 4060	2096	msedge.exe	106
PID 2096 wrote to memory of 4060	2096	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\hrss.henan.gov.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffdcee7c188,0x7ffdcee7c194,0x7ffdcee7c1a0
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,13978900471328351735,12642493943486411216,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,5821277629907816128,11125521972651939768,262144 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,8200532242525755529,11844274005590813487,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3961326139387456901,1285107470880406558,2097152 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1959031923225027280,5117893312601050727,2097152 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,7268625662891899398,15581334410604504341,2097152 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,11370864379556253591,7990420425351852240,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,18261322842373887593,5679246260230398410,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15496512181362864014,16218163446966626585,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3679730148274195883,11354815491806365144,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3679730148274195883,11354815491806365144,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5047299461712102,4957634880200082111,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10757346379329184105,10640386414663678736,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18187360775552622909,5338389873573156168,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,7875577204767079641,6321976939611716781,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10634901716398684566,10450306356043365918,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,12093807370216059461,17737546024778236726,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,9017903642246227242,2395343999498342867,262144 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=764,i,16786733476572176571,6790517740092601986,524288 --field-trial-handle=2196,i,11167309373065444590,5192465946800510410,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b7645c05b1722bdd29390cfee1bede621a986da9986fa15cda4281aafebbc32b
MD5 7d0637bc4f36cc0f3b2b89f1560c5aad
SHA1 7c24fd5c1ad90a47228398036d44b78c3adb4ddb
SHA512 f29ca31eac69e23c4dc84f0a53d808ed08465b3bbee3089d993d2d6f6ced5c62993661c0e99d0830289627aae51fa4540523bbbaac9071eb7960f272a01439d8
TLSH
T1DAF028B6C821EC2B18FD0B2934941B4AE755136B2B40885F3B3C830D8FF463F499A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 40a8b551f1e5b57e1f4ccf377c907565578d20fd49dd7ad513cb489dcd7df1fd
MD5 6589950c380c414b4c0b627b1d32ceec
SHA1 8aeb31a989be660def4dd01aade4337ec64d5090
SHA512 c4f08168a8102957a8e17c35c896e2e7e1181113af5fb0fed815da14c5f222a2f615e9046872384e9728508839ce39c6cd1b2d9c7e094b09c582298d7c514a52
TLSH
T1C441BFF3C3E8856D891195F0AA18BE2FCE1D0914436C3D5A88E4AF5B93E2470E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6fd786bcecd98e9efac2b127dc96d7ad8d7e87a2bdc2edb38be7d17e8aba6ee3
MD5 2011789bb36e14d54854a0613f56a17f
SHA1 18fd83dbbce686eaeb2946837d52b9892d6ea34d
SHA512 44991b6c843eee5b7311d05281d96cff85f916773f1c023cfc29b1606c0fdea4493a0603c467fc26ebf6ddb764592f1815a7a76fda062d06cca0f37d97bd61ea
SSDEEP 192:sxZeRWyMqZjK1Ml8MF9/f8s3+jKQ7PgYss0XzodpEI/W6+WNGY0ZkVgIgjJ7J:sxZeHd9/f8s3+jV7ors08Z/bG5ZjJN
TLSH
T17462E8166A385D778CDBD319FA857B93D7F9152391900E44AAFCCB1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 03a4489d137afcef41c8439584cbe60276b26f826035e28f49f77d762f4ba967
MD5 6ea5f7cb1e76f98e77394f47120f4b0d
SHA1 2cc410c5465d355e9a6c69c00844f157fe3ef284
SHA512 8d9e535f5d4d5484af467ca983666666f8523b52a26d19006848da40a132744002a91f60a484366c24838c2be7979ec7221b98a095de38bcc57e1173a488f19d
SSDEEP 192:sxZeRWyMqZjK1Ml8UQpF9/f8s3+/KQ7PgYss0XzodpEI/W6+WNGY0ZIVgIg5suFh:sxZeHqv9/f8s3+/V7ors08Z/bG5R7Fc8
TLSH
T1BB72F816A63859778CDBD319FA857B93D7F9156391900E44AAFCCB0C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8db2624b77b6e1c17fc4bbb3962c2b2567a4465cd87394ef6fdc1e3c216130ab
MD5 7a68a07f5480e5427ab5cf9964c483eb
SHA1 b41c84147a73355631f8a29d0e20927ee13ea324
SHA512 d1ced24abce6bccd8fc6fb7e5e45ecb9ca1141f1d4b27879ed78ea5e02559d596c7baf2c70449d2a7120e9ba9df231c45ca2b8ab41336442510bee380f9da830
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XGq9LlS:XwZh38Dv2SkEnZFWRm6GQFmu1jaKXGqy
TLSH
T186030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 5e2315e6652f75251660ed26441d1e0e96c35e047718201871f829542a31e279
MD5 9cdc827deee0f1ede6b4731008ed915f
SHA1 19b4f60c80f8c168d0335446b733f09242ad57e9
SHA512 0fa9118d4e5dc850e90d877d92b0aac19f34e425b9cdd993588fe2c3e14f5f4d65e2117d9fdc22039bc7db1d4c89dff06cb1403b616730acfea27b3ad23b1f62
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjl5tj4V/KNg:ctGj+BCNC5qFVpKx554tK+
TLSH
T14AC2871632BA02023C3D791C87A597371A42B1B33428E93B7BE854B65E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4c691dca1d562f5b9b88cb3066fb1043b8db6bdf78dac24d72d3a5d1c14ddfcb
MD5 47ff8a02e95c4e59269ffa9301b169d4
SHA1 94196c6de74e1c55f54b756dc7169c0fef968373
SHA512 838fecfd449d5567f7ba2a0d273f7dfc016cb8fff325ce4504a38682c7401b8e68a0335d9d69ff33798f1e7b1c1edd6c5a3e3bfe6455748bfc83aef1a07d61cc
SSDEEP 384:nWiFRtNnNnb9F38Nt8TUNTUlIR5rk6i6Q1zCfbLoAjFQXOy0bPfjFc+7ydgxwJ7i:9FRjZbD3awgscSOoAGl0bPbFcTgfX
TLSH
T1D8F2B3F298E799B7E99E0B97A33E2D029ABCD153B5481994FBC40D0DCC8617FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 22429902f197b182c72d5f177c87ec6d9c9097c0accf1fb48c340f63dbee35b1
MD5 4b767247d35393fed8e30b4298a61792
SHA1 26a70619bb8a98b48df7fb2de76d144ac0b1ed97
SHA512 66eccb2ec8357fcfdce181763da9ddc10cc64b6e285d901504b94ab2cbe024b05572e57e873a777e53db391b50af2d20b65f13cb318665bda4314a76a1a4a3e5
SSDEEP 384:n5iF9CcmyWCs38Nm8TUNTUlIxBrk6ooZF1zCfbLoAjFISEe4KV8p0CPty/7Igr:QFccps39wg4kZzOoA6SEI8p0R
TLSH
T1E8B25C32EC68CAB7ECD74F99E74E6A07DEE0616385885AD4DAD81E0D10C71AC170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b3ece74fe6fcb47cf7767154e2c21fb0312dddc84d989f503d8f20276fdf0b44
MD5 9ba26d2f741e287a83b5d2cfa24ddc7a
SHA1 b3ba24bb2915bb55c826678c7c4b864825c75d0c
SHA512 788414c6e300da30582ab22b48461e6a0792cc9391a47494d55da0f08797a4d0d09d489636fc3ae88671e7b7c028997442ccceaa0b2aa0ac954ffa1526abe59a
SSDEEP 384:nriF9CcmyWCA38Nt8TUNTUlIRYrk6uzQ1zCfbLoAjFQXOyUvPfjFc+7ydgxwJ7tg:GFccpA3awgthSOoAGlUvPbFcTgn
TLSH
T1C5D26C32E8A8DAB7FDE74F99E74A3603DEE41163858C5AD4DAC40E1D00CB19D174BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0cc18e011a72285ecc4a3e3baff2b5507510d58b371454815d8a946550e52482
MD5 6eb5c6849ea823335129fec8a967131c
SHA1 7d9844cceb7741351882ea4a48187e0956cf2757
SHA512 23682511954a81b72a84f348b7f29cf452394f366cabb992c9bec725a07147e2a7fbadb4b350193fdc1a834a7b3b02050b24a202911b34cf2968b0b949a9c39f
SSDEEP 384:nriFRtNnNnb9938Nt8TUNTUlIR0rk6izQ1zCfbLoAjFQXOyUvPfjFc+7ydgxwJ7i:GFRjZbH3awghRSOoAGlUvPbFcTgfX
TLSH
T1FED24B32E865DAB7FDE74F99A74A3603EFE411A3858C19D4DAC80E0D00CB69D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2e144d36d780ff134be129682f8ee12b984b813ce81f5f5848c40efcb9726f15
MD5 e8916bae7f37ab3ab58f2e0533dbe4bc
SHA1 4527278690a2bd7acf306eb74335dd4f339ca715
SHA512 2f4f645ece8b26a00a1532068dcdb9f8c3f4726dfba6c4b8c6af518abd68d03b5ae1802a99f95dfab225d47653ff3bb03b91656fb4f7fc5126deb851ed0a5539
SSDEEP 384:niiFRtNnNnb9938Nt8TUNTUlIR5rk6izQ1zCfbLoAjFQXOyUvPfjFc+7ydgxwJ7i:pFRjZbH3awgsRSOoAGlUvPbFcTgfX
TLSH
T177D24B32E865DAB7FDE74F99A74A3613EFE411A3858C19D4DAC80E0D00CB69D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a90ec4ed152aeaa174481d94c9457fcd21570847ec3e3ad66f3371d5eab940a
MD5 34b6be95ff56a411fa320e2420de87e9
SHA1 f7c0b65415e0c01942e8f4bc78dc1d844ccfc8b3
SHA512 2732f213244de82f4cb461cb6d36343b133d3a888b5a0403ba3e975bef99666c48e1ed40fa87286956e247bdd702d6f75c078a8a23e77b302c8e3a3a16b780c8
TLSH
T1A4412EE15C7C1AC1D4BD0EAE608B34FC82D8D725F5A4357D6864EA940A7961D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26fe0b81d0cde50b4c8bdc630da16835d42785a06fad47fcc37543b11cecb2b1
MD5 9c37af3d82f4a1923356bd4115c93dfc
SHA1 551bbb8b986e535a2b33c5041982cc6eda944969
SHA512 d4c94bef4880a3b8ae21c8cbc121830f8d3b9b2caa4c563e34d0bb650cd3799e916b33f8f26045afbd5a36f7bc6f9dd281d4f14e57c3868b2c07af0e801c5062
TLSH
T1BA4130E15C7C1AC1D4BD0A7E70CB38EC81D8C725F5A435796C64EAC80A79A2D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d4be678cc35ec1b0974aeb342af3bac9ca766aac8415df61bee8ec55db8f36d9
MD5 1718915d66e86865eb54660ec9ab8879
SHA1 d6deb08788e95b68aea9d0ff2358cd2b0232648f
SHA512 da4c3c2672165a941adec5ee96ab9c05c058a965d31a803e0765cf1579ad00575f5d7cce251d666a2c21724cb32f9be13689905da9d8da6bf3588b00eac4ec53
TLSH
T1CF513FE14C791AC0D4BD0ABE609B38FC85E8C725F56435792854EAC80A79A2D688483F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1074106241\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_1837573602\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_835729365\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2096_835729365\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4876-166-0x0000020A39B00000-0x0000020A3AB00000-memory.dmp

Download