hxxps://form[.]jotform[.]com/261976527011054

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://form.jotform.com/261976527011054
Sample260720-stbassev3j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290346824104188"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{8C1B6D95-ADE9-4C9D-87E5-F6FD5439CF31}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1192	1812	msedge.exe	83
PID 1812 wrote to memory of 1300	1812	msedge.exe	84
PID 1812 wrote to memory of 896	1812	msedge.exe	85
PID 1812 wrote to memory of 896	1812	msedge.exe	85
PID 1812 wrote to memory of 896	1812	msedge.exe	85
PID 1812 wrote to memory of 3640	1812	msedge.exe	86
PID 1812 wrote to memory of 3640	1812	msedge.exe	86
PID 1812 wrote to memory of 1200	1812	msedge.exe	87
PID 1812 wrote to memory of 1200	1812	msedge.exe	87
PID 1812 wrote to memory of 1200	1812	msedge.exe	87
PID 1812 wrote to memory of 2400	1812	msedge.exe	88
PID 1812 wrote to memory of 2400	1812	msedge.exe	88
PID 1812 wrote to memory of 2400	1812	msedge.exe	88
PID 1812 wrote to memory of 2848	1812	msedge.exe	90
PID 1812 wrote to memory of 2848	1812	msedge.exe	90
PID 1812 wrote to memory of 2848	1812	msedge.exe	90
PID 1812 wrote to memory of 728	1812	msedge.exe	91
PID 1812 wrote to memory of 728	1812	msedge.exe	91
PID 1812 wrote to memory of 728	1812	msedge.exe	91
PID 1812 wrote to memory of 5032	1812	msedge.exe	97
PID 1812 wrote to memory of 3884	1812	msedge.exe	98
PID 1812 wrote to memory of 5032	1812	msedge.exe	97
PID 1812 wrote to memory of 3884	1812	msedge.exe	98
PID 1812 wrote to memory of 3904	1812	msedge.exe	100
PID 1812 wrote to memory of 2668	1812	msedge.exe	112
PID 1812 wrote to memory of 3808	1812	msedge.exe	113
PID 1812 wrote to memory of 4832	1812	msedge.exe	114
PID 1812 wrote to memory of 4736	1812	msedge.exe	115
PID 1812 wrote to memory of 4736	1812	msedge.exe	115
PID 1812 wrote to memory of 4404	1812	msedge.exe	117
PID 1812 wrote to memory of 4404	1812	msedge.exe	117
PID 1812 wrote to memory of 4068	1812	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://form.jotform.com/261976527011054
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,14771912074018951049,17727632308291477240,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16957540029459336605,2825813191029108912,262144 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,16886055323597808102,9984372356351342999,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4869215753604151934,4815220526897520210,2097152 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,8980950164126719167,4145694193954091003,2097152 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10472160703069499921,8218844503175977357,2097152 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,6993363161885010699,2457914128131265942,2097152 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,7007202594336127586,17435112533621339746,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5552351370721222672,6306908743498387555,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,5483455982839879260,4581974893239418899,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,5483455982839879260,4581974893239418899,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5911081936193254782,13278117734160530044,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,8707867139961196248,8493958781987013322,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,17880826369602045003,11778217672302100963,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7912977783712672226,2886041408788865491,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8216869393545635039,18242100242777084361,524288 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,5561700198475268221,2083334676831490504,262144 --field-trial-handle=2304,i,60111158699339576,15107463467937433823,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba404f1c9e8784aa93a118b73f282ea560a7f41cfe85369f322d98c69e6123be
MD5 465e0e125fa0ffdb69aefd150111bd6e
SHA1 b85c34c9abaa2514cedc02319b72217a91f3537f
SHA512 4ba57d9f48cf701287432a7d766b9a5dd8063f8516f473ad4da7bb6c92c3ecaa7559c3fe634aa145e0782e56ef058d0f6f230054cf363849b5fb57cdae78c8c2
TLSH
T175718F7803010061EBF11171B7E128E9B870A9ECFE578D4A306C85F92AB832DD81DE2F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95307a1d17e03d73fdcd69516cd21165b5c022507fc7f57ed0bd0e671846a792
MD5 03960911bd2c2c9ad74bc27477e2f624
SHA1 65c76d0904da5a2e2e4851915a0d58dae8824fea
SHA512 8191467209f88c999affafb71aad7636709abb623c86fc7dd8f3d170a37ce109aa5e0ee3e301cb87ef7bfa95b2577ef55799c7c09849a7cd05a4eae477ed1379
TLSH
T13441CDB3C3D89A7DC9111AF4AB185F1FCE1D092443683D26C8D5AF1BA3E2474E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 38a13fa8f15a392016c794911bb236e6fc44722c085fbe0e4aff3b0b709e7eef
MD5 c3f1011141028bab3a5356949a8b2800
SHA1 2ffa1c79b927b98ef6181869e947bf7a04de4024
SHA512 225b93353939830842908cb972ebc23ccec9e7f479c00b40542916553eb84480b090cbfde65e5f2bcfddc16b990321e2aa981132457fc88b30057bd039276433
SSDEEP 192:sxZWRIkhj/fosBlE5V/IdpzXHW6+WNI+l/Yv/QRhXIgrJ:sxZWVt/fosBlEMrHbf/Np9
TLSH
T1E922C9566E38A9778CC7D20DBA15BF53E6F5503295D11E48AAFCDA0C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e5a825c070b6feaee503bb6635fd83bcd39a85c882e0f4e4eaf8c7b95c5f6ab6
MD5 74e51538736ad5a5cf6f00a0d47ff780
SHA1 45d8e5afb3fbc8d0950ff86ceaf8e103395eb8e6
SHA512 9b7579bd0767c959a03bde430ebf9f796c6924892c77885b2a4c88662e239708156e13ea96f7241327a486375b35ed3aca031da56cf982e6b19a1d686db4519a
SSDEEP 192:sxZWRIkhj/fosglw5V/IdpzXHW6+WNIPMXYvq4RhXIg5tJ:sxZWVt/fosglwMrHbbX+pZ
TLSH
T16032C6566E28997B8CC7D60DBA15BF53F6F5103296911E48AAFCDA0C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3a3efa9b10de71d2cf217b65d4f1fd95c9b3672b23835e38814de243e342f7ca
MD5 f0ccd5ddc150c5785400ec04d3b5b258
SHA1 577cafb3e7c51a6af292ca4af256765a570c8730
SHA512 c7f64894a30c377f1efd3405ff70d605a153ed09c636018952b8e907c101979737bcc7498a4e18b2247724a57fe8626cbcbe23a7b50035b732a9d5c4612eed6f
SSDEEP 192:sxZWRIkhj/fosglE5V/IdpzXHW6+WNIPMXYv+QRhXIg5PJ:sxZWVt/fosglEMrHbbX6pn
TLSH
T1DE22B7566E38997B8CC7D21DBA15BF53E6F5103296D11E48AAFCDA0C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 18bcbc59d914046191753a88cc0d8fc2bdf9a2dbaa97633cc0f0226df2c52476
MD5 2098a191bb29dc337fcbb44a9f9dc736
SHA1 6cfbd0242700fe5451273d4d8266d72b8d09f14b
SHA512 715ed2f4a69bc158486516b6509bffb7c201528e387b12517149af4ed4a521a6c87bd5f69bc9b66a1e30f3c09e28f8cb64afd24badbefcd20525d748fc98b93c
SSDEEP 768:NYee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbOro+:NYee3rxWvhffnu1jatcL88bF+
TLSH
T1A3C2EA2B640CCB7E5F800AADDC5A6F977FA802C7A7548D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 598cbb72768641daf2f7669076fa54e7a1b0cc1a8fccc0e014997828963da21c
MD5 880df2c17e1e853c4cfaeae30e0d6e2a
SHA1 0ef6df5ab2f1057cd38a6a021a0e6a1eeb6bf77e
SHA512 32f07aa6617b19290464ea47c7bd396167bc75f19537305e28cdc8e123d8b786ded0d66fa54ac9efcfd543f20e1cc8a8f49542506c8be4bf7c8818e96131ab33
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMPKRKAK1KxK3K/KB:KYH+Kggmy+cKnKqimYKbaWeNgkO08
TLSH
T116915616367B06423C7E2448B6A795378F4132A77458E8AF7FB850A10E26E212DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77d78cb6-1a18-406e-8d6a-95feeeb0918f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\77d78cb6-1a18-406e-8d6a-95feeeb0918f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5375b035f3be5f2bd060139d7e3b899a34f154e47bc4c4e0441f106613d65b02
MD5 ac12cf9e3bdcecdcd772bfaae5edb246
SHA1 4d2586e2e69a63c00d3decd02d82ca6c134c49d6
SHA512 beeeb1352478f4c719108df8b207d9efcc571d8f14fb1f8e460fcd9b0295ba139c42aee7232c271a28bae7ada5e733c62243c1ec8d5ba857fc94d90bae944f03
SSDEEP 192:1cLsNdsQZ89yM7T4xQmiU16p24MTwz+FdLD1WSJrO8z1S1qRQP:ssNdsPV7MPAZ0dbJrPSQQP
TLSH
T14E422A36A8749C7B99A3B585F04B3707AFB4816B9AC46F54E5EDAF0C01CE2AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cfcb41b4f89f883e18fe6b9439160b327004e573929f67d85c2b0bc276c5f8c9
MD5 9076c89005ea8c363be54998cb7af0db
SHA1 bee648daf8ee2752236a46b470f3d55ac1f0260a
SHA512 5d9f89cf07757b1b1484491aa2f6e3ca9c0d1aa6793b05baf1a9db6d92731c425ca59136884269d725189dba97cc364b70c9ddc19c32c43b2122076138f040eb
SSDEEP 384:XiFUzsNM8TUNTUlIl5PV7MPvZ0dbJrySQQP:SFoPwg7VSuVhySQQP
TLSH
T17A92C7F658D7883AD96E5B47E73D2E075EBCC067B5805A50B3985E0CCC8A1BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d7b21cf25801e3ecefffac7b6822d9eb1605719bbbd9a6a08be4d153cb9cbcb5
MD5 5a5007440544ec300233e21dd9aa5aa5
SHA1 80ddf9c97eaaafdc935ac886e6359cf5bbc48c5b
SHA512 453d3844b323782b5c574ce17a7d36cc4d198e88a64b9131eb89e1e17725cda41f6588706ef01f91214662b8748b50a41c27e1850398e325f6c42d84553b47b5
SSDEEP 384:XiFUzsNn8TUNTUlIl5PV7MPvZ0dbJrHSQQP:SFoKwg7VSuVhHSQQP
TLSH
T1A292C7F658D7883AD9AE5B47A73D2E075EBCC067B5805A50B3985E0CCC8A1BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6e3a29295fee315e4a2402e6e1a0564633c500ee226b0a150ae03a7ec0293c56
MD5 976b6aeb2b1385e2ef88d2e7952038c1
SHA1 f185b363da68e660ad44bfcbdebf99a72134c01f
SHA512 9334ca29dae0b2b73e277c8005fd9a9d60d5cbe0eaa1a37511d41de038e793acca6d6986855822bf1eb9220be2e29a0ef4545627e2bb5491db99004a179efa3a
SSDEEP 192:uYcLsNd5QZ89yM7T4xQmiU16p24MTwz+FdLD1WSJrO8z1S1qRQP:wsNd5PV7MPAZ0dbJrPSQQP
TLSH
T122422A35A8749C7799A3B585F04B3707AFB4916B9AC46F54E6EDAF0C01CE2AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 29c6141c54a2febccb1dbec9a2205b9cba628d402197bfcc02b9d69f3484a381
MD5 25e4e31218f2bebe7e8df04128c85eab
SHA1 8620888706920e4eb7c1dabe40a554a59fced9cb
SHA512 4aa3d47b7bd7859ff984f0ece28f3673807c5700f28d3644ae70f999a7a5c3b66af54cc9bdc459f2992c7cd773720c0628be074fa848df1ab0ef6b001abe6d9c
SSDEEP 192:lONr6vMtPQmiUyqMThTwz+FdLDf847Sq6U/u:lONr6UtRiTnd/SpU/u
TLSH
T134020935AC786C6BEAA3AD45F48A27175FA4517FAAD05B50EAE86F1C00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6d1dd824d87a1603918f7e1896d935fff34aec4bd6e83c7770a9aa6ee7b9d9bc
MD5 6b2c2883bf2124fc2a201674eb61cd2e
SHA1 73d71b5e01efd491423fdb47b7df70f1b0648efc
SHA512 c23718afc78ce1c83c46edae60669b95b18f6c51fd3f4a88c71a93d775ea039670e447db847f2af4abe314b464330623e77928bc7b16536d546ace6dadc5e087
SSDEEP 192:zONA6vMiPQmiUynMbhTwz+FdLD1WSJrr80IS1qRU/u:zONA6UiRzbndbJrcSQU/u
TLSH
T1D6121936A8649C6BAD93B485F08B32175EB0926BDFC4AB50EADC6F1C01DA66C1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f969619f-cf08-4c13-a0b3-2839b6f5cade.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f969619f-cf08-4c13-a0b3-2839b6f5cade.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 85a455515bb306c81931f9f3d92b6d3b8e6f56f90c14e39f3bfb67a41a6907f6
MD5 427c16634eff5b6068155233dee31c26
SHA1 378c1298fbb1d36185568ef05d804c9289eb0ce2
SHA512 c83e3769dda3f87c936bba35112acec51552fff768489d8125fe5314cb421568170b6d98775398247d1d6283b0107c275abb45a39cda3d031d9139e6108329a9
TLSH
T13A411C5CA6E91548B3B76E1A5BF6A86D487FB8772F4A949D10110E8F0A33A40CC72737
MD5 SHA1 SHA512 TLSH

Submit Download