hxxps://form[.]jotform[.]com/200427473739964

Analysis

user interaction
yes
max time kernel
86s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://form.jotform.com/200427473739964
Sample261030-wzw18sev21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{B764CA78-45AF-4149-9E30-73552FA741A1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 892	624	msedge.exe	86
PID 624 wrote to memory of 3692	624	msedge.exe	87
PID 624 wrote to memory of 5548	624	msedge.exe	88
PID 624 wrote to memory of 3692	624	msedge.exe	87
PID 624 wrote to memory of 3692	624	msedge.exe	87
PID 624 wrote to memory of 5140	624	msedge.exe	89
PID 624 wrote to memory of 5140	624	msedge.exe	89
PID 624 wrote to memory of 5088	624	msedge.exe	90
PID 624 wrote to memory of 1888	624	msedge.exe	91
PID 624 wrote to memory of 5088	624	msedge.exe	90
PID 624 wrote to memory of 5088	624	msedge.exe	90
PID 624 wrote to memory of 1888	624	msedge.exe	91
PID 624 wrote to memory of 1888	624	msedge.exe	91
PID 624 wrote to memory of 2428	624	msedge.exe	96
PID 624 wrote to memory of 2428	624	msedge.exe	96
PID 624 wrote to memory of 2672	624	msedge.exe	97
PID 624 wrote to memory of 2672	624	msedge.exe	97
PID 624 wrote to memory of 2672	624	msedge.exe	97
PID 624 wrote to memory of 2432	624	msedge.exe	100
PID 624 wrote to memory of 2432	624	msedge.exe	100
PID 624 wrote to memory of 4320	624	msedge.exe	101
PID 624 wrote to memory of 4320	624	msedge.exe	101
PID 624 wrote to memory of 5524	624	msedge.exe	104
PID 624 wrote to memory of 1204	624	msedge.exe	114
PID 624 wrote to memory of 2456	624	msedge.exe	115
PID 624 wrote to memory of 2812	624	msedge.exe	116
PID 624 wrote to memory of 4300	624	msedge.exe	118
PID 624 wrote to memory of 4300	624	msedge.exe	118
PID 624 wrote to memory of 3772	624	msedge.exe	119
PID 624 wrote to memory of 3772	624	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://form.jotform.com/200427473739964
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff868a4c188,0x7ff868a4c194,0x7ff868a4c1a0
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,11949881160997447183,4939864669085708178,262144 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,5257534862131865957,1500509998170715417,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9916093389377684402,14978179247441074230,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,5882803525382520929,926113419259508611,2097152 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,8311615685411311931,14849853853980954628,2097152 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5298434632286372996,7832160776983292477,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4632,i,6381957324074681083,18444788298836488785,2097152 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14488598035311896685,4540404348947098570,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,5385616519074644371,5805732349207631552,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,17374457251562685613,13623856898171138800,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,17374457251562685613,13623856898171138800,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,8287498789673594813,3390385962611082979,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,13195070964585024800,13966005781106559134,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10618212572249754351,30331247606649155,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,46454149135735300,16605245895158774573,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,14041001946495048327,16459445095329955830,524288 --field-trial-handle=2260,i,16417929795919351188,16508739407578305295,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a560f50-e4b5-4a00-a72f-df0da375f330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a560f50-e4b5-4a00-a72f-df0da375f330.tmp
Size 26KB
SHA256 178247fdcfb8219501af0fb6c1806df277a9bd0b35759e3d572c04dec62d9f1f
MD5 9eeb627565dde5561ae12905354960fb
SHA1 0c65d9fead3b3019f9808b651e19cddaa80ef186
SHA512 581f1381966c81a1e8d82f28b2efdcb513ecdfd2361c2455330c9e7fb391f2c02d0cc2706b957bbc8b63d8820a1852f1c22d638e141e4f2b65fa368b48239705
SSDEEP 384:nfiFzQkUSve3sN68TUNTUlI4o5mgMgq4zf8BWFAnLtt7uy2ICgL/7IzTIIlV:qFde3bwgGQcBWFi5tKy5iL7
TLSH
T17EC23A36EC94DEBBDCEB8A91A74A3643DEE04153D6DC5AD4DAC91D1C00CB19D134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55ca6cd9-f38f-4fbf-af8a-24b601e472c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55ca6cd9-f38f-4fbf-af8a-24b601e472c6.tmp
Size 25KB
SHA256 91bbfd2329dc6efa0eb87099c1908c7112cea8c684b603ca01db3cfa0287a5c8
MD5 e424e52a45ebbb635b887c8682471c1a
SHA1 0d77cabb2f6d7b7ff88c5394956d6f0561741652
SHA512 36c23d25d03f4c62eab0a76328192e165f6129972b739636c2a2f8b548ba9fa2c8ec7473bd817d6b4abcc72c37cacdacb768a0b9ad6131f956e8492e9c6d1338
SSDEEP 384:noiFiZcI63sNT8TUNTUlIm25mg5Cn4zf8BWFAnLtt4Asa+VYqgL/7IzNo5:zFQ632wgS5JBWFi5t4AhgVO
TLSH
T170C24936EC98CABBECEB8FD5AB4A7A07DEF40163959C59C4DAD85D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6668ef8d-5a27-41f2-aa9e-3497a7bcc429.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6668ef8d-5a27-41f2-aa9e-3497a7bcc429.tmp
Size 26KB
SHA256 0e369da2f22561b24a913f12085a8fb632d2300c40642a2cfc233b4d77b901b0
MD5 177c39d846ea5aaca67f75d20663023f
SHA1 05ac980fee0b665cc5737c61191a8e0c2aace63e
SHA512 1986a1cb92e91036cd4b1ec500756fcaf796dda85ca0b524fbf8e75f473ab3bcfd9932c70a68382d77f6d19479fd9feccd26e6a7126665c91f27e1f28736db2c
SSDEEP 384:nyiFzQkUSve3sN68TUNTUlI4o5mgbgq4zf8BWFAnLtt7uy2ICgL/7IzTIIlV:5Fde3bwgG7cBWFi5tKy5iL7
TLSH
T1E1C23936EC94DEBBDCEB8A91A74A3643DEE04153C6DC5AD4DAC91D2C00CB19D134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71670545-7eeb-490a-b3bf-e8def6f37076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71670545-7eeb-490a-b3bf-e8def6f37076.tmp
Size 31KB
SHA256 d6aafb39890692aa9ef7789655b328848cb9e35726ff5b9b96faa1bbaefd4bde
MD5 9986fb6a7ccbbc2eb20e0b8e0ed908d8
SHA1 4b886f184f62b95dad20564cc89ab3e7af5e76aa
SHA512 c0ddb86e26bca9bac8622fee4bf966d0865bd3422b1da32801fe42edb0ce78cec8b7e5ef120c397528aafff5bf2d3abef3c447aabd52a07623ff6911a0d814b8
SSDEEP 384:njiFzQkUSvmr3sN68TUNTUlI4o5mgMmq4zf8BWFAnLtt7ly2ICgL/7IzTIIlV:OFdw3bwgGWcBWFi5t5y5iL7
TLSH
T176E2B2F598D79977D8AE8B93A33D2E4299BCC113B5885984B7C81D1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

0da38fc3-bdb4-45a6-b958-b847ad194867.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0da38fc3-bdb4-45a6-b958-b847ad194867.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

803ed04f-5a34-4045-87aa-36e437b76d40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\803ed04f-5a34-4045-87aa-36e437b76d40.tmp
Size 12KB
SHA256 60266862f0a0fd001717154d22519cc513bbb463b48e0bfd34884527d2f4521a
MD5 3d65b0f9c9c16b2acf58c72ad838cabb
SHA1 9f7d5238bfd936ac86ccac98d4cb592ff8183efa
SHA512 736981a6331b6fe54aef3a96ca6b05d652a9f8560d3827224a0545aa52a45479d33970aafde327bcb50449a7b71a7e51b6a49952baca6ae05d49b2437a72c550
SSDEEP 192:sxZlRskE/f1sj0QZZwfzodph2HW6+WNIVC/YbIIPLcYG3uIgjoJ:sxZlZE/f1sAOZw0sHb3/F8cYGWjM
TLSH
T16142C7166D28A93B8CD7D209BA59BF53E7FD5033A1D45E84A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8342a723-3e36-4ca1-83df-c80a1ffa4201.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8342a723-3e36-4ca1-83df-c80a1ffa4201.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3c8d969c30ed6d28366d12b704f08eacd2693959bf8f418686ba61664c1e2a83
MD5 a1f5edbf93e7ddcaa9729e8b78016dd6
SHA1 e4ea9259a284feb10e5e78b49707b82c2132b0c0
SHA512 71fa69e5dcfb3eb0bad9b7b5dc4ec63538f30885242578b74686b37fd2491b0f24877b663b65e62a94e0334413f99844ecf901de32252552a07f18f9a35fd4fc
TLSH
T147E0DFC499CAC32EAA0864870268534CE3A0365AD3C0798A7704CAC974460C4FB8AA94
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6a75b105f45c7181bfcfe1a3ede3e0d8e8bcfb500ca819779b41d1e824f5d229
MD5 c6735de147fb199eab963ec5d4ef54b3
SHA1 e4523178f7730e94d3755f17dba6503a21031038
SHA512 a535b549b4bb7e1d300e26f4b63755916e130e38f38dd9edf2325c5d926475ff7355ac95ab9c2e8c620e6b09aa63ad35e6848dac3c88ee2b96206835734cf14e
TLSH
T1AC71A388E5E90496FF7568F4C7C614E33E3229FE494F2F528964DA78680B39B9D110CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54ee8bb491d8923c1ccf71accb92bb6885a50ff32b282ef4442a6befb4bb5662
MD5 bce36169e0729b6dce25b76bad48d07c
SHA1 08b3ec8bc32847a644cffbc78ad49920f4542945
SHA512 984753ed54ee3c8c39341e8443acce8d56859f822ce9a19653a2b935ecaf738125afa2347a9ef8d2449fd8e656b71159d81358859742f1af455d0bafde049e60
TLSH
T16361B54CE99941A0FFB894F4C6DA15C73E315EFE494F2E5286A4DAB8680B797CD100C7
MD5 SHA1 SHA512 TLSH

Submit Download

eb8c1338-1bab-440f-ab7b-6e602c25dd39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\eb8c1338-1bab-440f-ab7b-6e602c25dd39.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1dea069a-f8fe-4d4f-bcaf-56229407feb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1dea069a-f8fe-4d4f-bcaf-56229407feb4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7a37cde5-d858-4f0e-bbe8-87c5ceb83591.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7a37cde5-d858-4f0e-bbe8-87c5ceb83591.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e948c09e-31ea-44f3-98b5-ef9f8a5bc924.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e948c09e-31ea-44f3-98b5-ef9f8a5bc924.tmp
Size 7KB
SHA256 99d2c46b1f06f066202cc9b6bc43a1c3328f912024120ff55f5ea0ac35e56b5e
MD5 533cc6a8a632ff8d0157d9c204b516fb
SHA1 42fe151966659f4114d3b3928e2884cc8d70ed14
SHA512 8c6725e71f6d218a2ba98de5da745f65a0f60f6377cf87826a21d959ae2bb1b1fca66f142777cada9191594213742400c36cd9963ebccb25d9c5a386676d4ab7
SSDEEP 192:D1yCV9G/c5Daah2vS/Y6AlPCVDHJHAfGj4lzZtiFepGkil:D1yCV9G/c5Daah2vS/Y6AlPCVDHJHAf4
TLSH
T139F1ABF783EC966DC9515AF4AB182E1FCE191D3853583C2688E7AE0BA3F1471D181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 808478fc1f221ffe1dae638ac270d4cd4fe0c658fdc23b5bec966b3152d05a52
MD5 4e45af33d57cecd4e55f967ea2c16943
SHA1 3a83caba89a3b2cd4b289981733bf0bf8735362f
SHA512 4b07bfb7e13f9e71e84054e2fe3b7e926274b4d05b598e1c110e5f64bce3b2da89350371ef571d53a347b1ed483f79dc9a03e0c514f4aad857a8c9500b7eb91e
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX+A1E:OtfFvpopPxrB4Rhf+EE
TLSH
T1A6B2231471BB021138FE690881B6972F064232B33159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ac4b2026-4bef-4422-88b8-e4c279d870e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac4b2026-4bef-4422-88b8-e4c279d870e6.tmp
Size 12KB
SHA256 82fdf132b3e236edd1f5a47e66275f0fe50fd70c8b968a84efcfcf4b1c893884
MD5 c479ab95f6fc43e404dffb630a596479
SHA1 a6e2c870a55e9c65f9c8e7a4dc4623ba9fc8ce03
SHA512 f219aa66dd9f617c55bef45af6cacbbeb74a3c44084acc8e4ac7207de5789228892dbf82ee128f17fbe21fa2e3582bda5efc3a15d68506fbf56e4c445f791733
SSDEEP 192:sxZlRskE/f1smDQZZwfzodph2HW6+WNIVC/YbIuPLcYG3uIg5/oJ:sxZlZE/f1sMOZw0sHb3/FmcYGWZM
TLSH
T10742C7166D28A93B8CCBD209BA55BF52E7FD5033A1D45E84B6FC8A1C04E76DD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c19ad7f9-ada1-4dfd-be69-1951178c7d15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c19ad7f9-ada1-4dfd-be69-1951178c7d15.tmp
Size 414B
SHA256 95e3fc18fed2cc6d74f8fa3d1c44a71dec54ec044c3dbccc15106a7ff2a0ac94
MD5 213310a1e493c7ee73833b50d06aba14
SHA1 0710aedd0713799a28faec4f8dd7717e2907442d
SHA512 66c0c82bf94f7d1e08dba9e0108e9e6fe9709a8c22b91d64073b706cbed6b6c931d504445e9254ee2ad0e66f7beb18d1cde5d3821938519df3398b5f3a83d50e
TLSH
T149E02BE5CC16FC3719FD572850540646EA5103572E808C8B373C901D8FF66364186D6C
MD5 SHA1 SHA512 TLSH

Submit Download

ea4e59b0-6c3c-4cad-a082-79a800a56748.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea4e59b0-6c3c-4cad-a082-79a800a56748.tmp
Size 12KB
SHA256 ec5f1e1373afb5b72c44d0a7b9340bd3063c49974140f39520c9416c8de03a92
MD5 e60e1571c63baefd466be44160131b02
SHA1 928bdf274da98bf06eb9c86a5d7c49a537f80350
SHA512 5f316bca562749204a803d00e1af7f035a0197805ab497869303e518902708334e79b6fa0659fc372f0a520d5440fa2dac2030e68ec9b824f71cc2f75f10a249
SSDEEP 192:sxZlRzkE/f1smDQZZwfzodph2HW6+WNI7ZdYbI0PLrYG3uIg5/oJ:sxZlKE/f1sMOZw0sHbadFgrYGWZM
TLSH
T10A42D8166D38A93B8CC7D209BA55BF52E7FD5033A1945E84B6FC8A1C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec8153c0-4ca8-4b83-8461-33b94644a968.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec8153c0-4ca8-4b83-8461-33b94644a968.tmp
Size 12KB
SHA256 620604d55d150b32c5cd6610f972c3de46963651aaae7a2c2284860f2230aebb
MD5 73ea22259b66d887ee4969938c0ca3e4
SHA1 a1b07cf9360cfa12727103ad86a34fe167dee5c6
SHA512 4d232661dfda9cb6a5b429fe4d6dd0e787d2a990ea3ccbfe97cfc0b97dbbbb6cdc7aa13f45dcc8f97a5d4ea6c2410bae26047fc12cc4412f66ce897410ed4234
SSDEEP 192:sxZlRskE/f1sm0QZZwfzodph2HW6+WNIVC/YbIIPLcYG3uIg5/oJ:sxZlZE/f1s3OZw0sHb3/F8cYGWZM
TLSH
T13C42C7166D28A93B8CDBD209BA55BF53E7FD5033A1945E84B6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beee567f-21d0-480e-b4c4-bfe0232b3ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\beee567f-21d0-480e-b4c4-bfe0232b3ff9.tmp
Size 26KB
SHA256 17aaa71d7b074ceb382fbbebc454a56a930e1ee6225367a635e095892b33dc7a
MD5 fbbc65c7a5a25800902d9c86379885b9
SHA1 29cb5f154f3587c0e670ed35827afb129b23a16f
SHA512 b1b5830b82477b8bcf8916005f9cef561957b2f7a90db15bc16a404db4928fd512fc8a8a5077ecbf680f6078cf43e5e361db1151e2d4724a49e29f3a137d4337
SSDEEP 384:nfiFiZcI63sNG8TUNTUlIm25mgxbr4zf8BWFAnLtt7Iysa+VYqgL/7IzNo5:qFQ63rwgS+1BWFi5tUyhgVO
TLSH
T1B6C23936EC94C9BBACEA8BD5AB4A3647DEF44163D6CC5AC4DAD85D1C00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4dc0f9be8b7910f8184291dcae99364085c57f1cb0451ef33472e303d8382227
MD5 a19d0b6b02fded5ae297f4dbd91596c8
SHA1 a0a4b1f6adc946091aedca811fcd4f022a266afd
SHA512 eaedf79827a641dfd242624a5bb2d1e98237615413d6feec236d125434cc84e136fe0c3efe972d97d6713c8e2f4e406b8f13c69a5f3a0c0bf2c88ec68e86823f
TLSH
T13F412858B6E9114CB3B36E56ABF6A86E587B7D732F07D45D00010E4F0A26B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads