hxxps://russia34link[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://russia34link.com/
Sample260717-tmp12se18r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287782517647444"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A2477605-638C-4CD3-933F-814B4411E7A8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2120	1876	msedge.exe	87
PID 1876 wrote to memory of 2256	1876	msedge.exe	88
PID 1876 wrote to memory of 3384	1876	msedge.exe	89
PID 1876 wrote to memory of 3384	1876	msedge.exe	89
PID 1876 wrote to memory of 3384	1876	msedge.exe	89
PID 1876 wrote to memory of 3160	1876	msedge.exe	90
PID 1876 wrote to memory of 3160	1876	msedge.exe	90
PID 1876 wrote to memory of 1012	1876	msedge.exe	91
PID 1876 wrote to memory of 2244	1876	msedge.exe	92
PID 1876 wrote to memory of 1012	1876	msedge.exe	91
PID 1876 wrote to memory of 1012	1876	msedge.exe	91
PID 1876 wrote to memory of 2244	1876	msedge.exe	92
PID 1876 wrote to memory of 2244	1876	msedge.exe	92
PID 1876 wrote to memory of 1716	1876	msedge.exe	93
PID 1876 wrote to memory of 1716	1876	msedge.exe	93
PID 1876 wrote to memory of 1716	1876	msedge.exe	93
PID 1876 wrote to memory of 1612	1876	msedge.exe	94
PID 1876 wrote to memory of 1612	1876	msedge.exe	94
PID 1876 wrote to memory of 1612	1876	msedge.exe	94
PID 1876 wrote to memory of 2108	1876	msedge.exe	99
PID 1876 wrote to memory of 4892	1876	msedge.exe	100
PID 1876 wrote to memory of 2108	1876	msedge.exe	99
PID 1876 wrote to memory of 4892	1876	msedge.exe	100
PID 1876 wrote to memory of 3240	1876	msedge.exe	102
PID 1876 wrote to memory of 3684	1876	msedge.exe	113
PID 1876 wrote to memory of 540	1876	msedge.exe	114
PID 1876 wrote to memory of 2836	1876	msedge.exe	115
PID 1876 wrote to memory of 4844	1876	msedge.exe	117
PID 1876 wrote to memory of 4844	1876	msedge.exe	117
PID 1876 wrote to memory of 4716	1876	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://russia34link.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x24c,0x7ffd9b02c188,0x7ffd9b02c194,0x7ffd9b02c1a0
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,12047411368645831919,12950155164451259774,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,1953832206191717499,4991070061565590904,262144 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6394694437034917253,7477918635581550136,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9567952997334074084,9594676450227558914,2097152 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,4702719282116873148,7187660792231056037,2097152 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4975278514085853165,2551684867960986186,2097152 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8851164069677873018,9993318235896657609,2097152 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16917903092758044733,9026006989063883471,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11134056443208456813,12035001823852673154,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14749819994304104068,11467484218042244238,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14749819994304104068,11467484218042244238,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,8781665018826001776,15356253226079451719,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,11541131863497960532,6237255551685203084,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,12910759702986323993,1926998382894135916,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,8037720129093121113,12731481756676519837,524288 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,12377650014743837670,13856954081350408362,262144 --field-trial-handle=2136,i,7253064660791891477,5463293357452520083,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 724KB
SHA256 1e3cdbfc648464b42ab5572e8e5b1684448808a671aa5fd79767428361f6e9b5
MD5 095d444d618f077bf296ae09b0cea1bd
SHA1 edb381636bccbed418f2b40469a28d532029eab9
SHA512 aa21817607501ccfe3d69a7bb00d5167ccf2d9acd933bf23ecf1d88581ad1d717de583c7b53fd60c5785da4af112a97211c56a33d1df25e1965cfcb561cfc255
SSDEEP 12288:YyPi2R8ryRyOcYHL2KEXNb3zzf5+MGdUSakZAg/DSW8E3fNzbpxq8tUeJeZ/H5dv:Yy62ROWyOcKczT5+bdUSTTDSEXpxNTiT
TLSH
T191F4234B9BD26B08CCBE9677F0C190D07822E201631613FF6B683576E68592C9D4BF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e7bb9b746c60097160396d2d06bb40a32ac921f67495d24555d092441876759
MD5 1b200715aa12a45e5a965c9da928771c
SHA1 079841d73363511e400905d01db6cd6422f81467
SHA512 a778be6e81b471c21e310e8467b090ee52ac56a69fca3e956e72d823beaaedda7db12bcd5805a2959f525561ece1f4040da913f7fac528e990df0d417e71cf35
TLSH
T11871803A101009B1F3A442B353C259C5BCB1F7FBFA23FE46E169ADB94F02741CA19188
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 10f489988f9ff207207683656333171765d070280ecd5c01a3c82f819d2c9b64
MD5 2a3dd3998bdd5bd8cf6387fec5354e90
SHA1 89f676ef024971bbbb0d9fb835e1fb71c07a8057
SHA512 6059e5c150e08fa4b4ae88abe9571f53a5f63061f0ca682e9e72e8f38bd06d95b3526160b48ed192345e91611f6307df21f487731ad52e48a4f2d4bdc11ef176
TLSH
T1FB319BA2C6D5869D881156F06B14BE2BCE6C0A1847283D9AC9D4FF5F93E2471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8f3deb6c801eb28d3955ac3b153e385f77ceb3affddd6578fff9746e64d4638a
MD5 6f8dd14076068ab5f06ac9171ada892a
SHA1 9f0708fb74025a3418a8d270a2b267a737c0b632
SHA512 1fa69fc10a6a8297f9faaf65b8d4ab54073f357031631a4fa7a9ba4ba2a9af917e705ce00cb33500a9fdbe969f01769d92e6a7a7e952ac3b022bda604755199a
SSDEEP 192:sxZXReky/fos20t5LIdp4UyHW6+WNZ2o/YzG5uaIgrJ:sxZXry/fos20tyuHbt/V9
TLSH
T1EC22C7536E38A93B8CC7D219FE15BB53D6F9143292D15E48A6FC860C04E67CD620B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f1cb9974865bdf23a23e6a81def235cf4ff6e22f571bcb1f79ff7ca948893370
MD5 3742e30a5d2c46a5371f9568aaa41111
SHA1 4833b56389a5fb58b510338cf831a525a4acd302
SHA512 35229f764084669cd7af2c605b872d0438be5e3ec4f5d4f5b0f4c4bc9b182196a9695aeee9bef580f7117417379df8aae274ccd33a18c2042c8e8f2fac804a98
SSDEEP 192:sxZXReky/fosx0t5LIdp4UyHW6+WNZrQVYzP5uaIg50J:sxZXry/fosx0tyuHbeVs2
TLSH
T11832B7537E38A97B8CC7D219FE15BB53D6F9142292D15E58A6FC860C05E67CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1667797f0bcde569b01d7e57d69f9ce5509c805d1ea3cbaba052da5c6cc0c4c7
MD5 01a14bbb8c3a2558572390144aadf96b
SHA1 7f131dbc76f1f14c238ee93c4a2bc5ba68908e2b
SHA512 da75ffea39b2308988adcb035b604b088b9ff6f85845d783ff9282e6bc9474e92966e417ea94d4103cecf741336b4de2986688d0deda7289020bf41ac85e3dca
SSDEEP 192:sxZXReky/fosx0O5LIdp4UyHW6+WNZyZ9YzSDuaIg5WJ:sxZXry/fosx0OyuHbm9X0
TLSH
T1FE32B7536E28A97B9CC7D219FE15BB53E6F5142293D15E48A6FC860C05E7BCD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 781ce5d5a8d4b805d8dc1ceb2dadb7f1bd46a83e8ffef0c1dbfaa1d2be175da6
MD5 6ed0e8b07b7c58fba7a870d7302e4662
SHA1 04024cf1e362a82f7475d1dae1713f8fcaa71e62
SHA512 603a00e9a8f6525cbf7f589cd6a90efb8c73e5c1b94d621f06e43f047e0ab32f29f02ded7de4379ac33357eabad02c632b63e21009d75d5d8659d00168fd6d2b
SSDEEP 768:0Sk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBfroydYY:0Sk7u70WvqiEau1jai5LA3BM1Y
TLSH
T123C2E93B740CCB7E4F801E9DEC566F976E9802C7A6948D4087FA994C02C77EA61264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 22b23d1134969aeba5c552b74e92e08e632de120740b79e02437b9a8aa8b1c49
MD5 65b87d5b66f0a238f3e56c53c2db54b2
SHA1 e5eb4ca70bd978d7a5a8bf55da92a7e7e00257f5
SHA512 f3bb09c4ca3f17c2605888bfaa8a1de9e2777db89dd9b438e94d921ff5abc61c02bd2be45fdf5eac4e68c441a605968a8479e659577c2e8090e1c227c711dd58
SSDEEP 96:KIbCKc3/WKQouWF8BVr/7gfH6z99gKV19jgxN9qDjuQKF:sSdWF8BVr/72H6B9J19juN9qDu
TLSH
T107916756303B06413CBE6988929586364E4231E73859746F7FB804A25E2BE279FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593cff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593cff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 121c72de1557df8e410e35123d97f9e3e7832a4e10ffa3dc8f758c0bc3c1e025
MD5 19f11ef740a37e75a99509c1b57d77a9
SHA1 24e4f39516510394522bdfe6a188aa4f47ec1fbe
SHA512 53e8652085cdba8d2a634acc5bdc4897ebbdf8dc772d6cb7df93577a306c8929337c48ecaa00b1261371ccc3a2f17f4408568b51c195c4290ada1a965449ec8a
SSDEEP 384:BtNn/s3n9SfsN4unbGzSsEddm1Q8hZOObjI9G6w7+X:Bj+9U0USxmQ8hZ29M6
TLSH
T18392AF325C796D779DA29156F44B3A175FF4427B97C42E48E6ECAF0C05EF6AC430280A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9fb7623e1a3c583e058676d46a943d1cc4b458f2ab8056c39e24e9ca02261192
MD5 bc714f3ba7547c34d48873a72fdb7d63
SHA1 f27b66700e187e039c18b1fc48c89ea2825de80e
SHA512 3124fd4ae6f5fac371782fe34e0fead87dec9fa9c750c7033b328d50f7ae260793d979ca8aadf8a3c7e9bb9bd93fadc0073dcfd49c9a6cf1fabe291fa227ae1f
SSDEEP 384:utNn/s3n9SfsN4xnbGzSsEddm1Q8hZOObjI9G6w7+X:uj+9UNUSxmQ8hZ29M6
TLSH
T1AE929E325C396D779DA29156F44B3A176FF4817B97C42E48E6ECAF0C05EF6AC430280A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 41062dfa5f737d9bdc9eebfbb5a7213356f8d422f1135d4bfbde186aae4b6710
MD5 19553b144b3aa62580b09fde109e0e81
SHA1 3ea7a93a03510bb00b25c570832ed1a6cfe4c38b
SHA512 2c745e6bf3d7e8d678141910802e0e06a17c9548848d046dd5bf65f7f6d2aaefe33266aed005884a74468e3bbe25df6f15be2e042d18bdaf90f5cff80a167670
SSDEEP 384:MiF1tNn/s3n9SozsNo8TUNTUlIlxnbGESsEddm1Q8kZOObjI9G6w7+X:3F1j+9rhwgvDSxmQ8kZ29M6
TLSH
T1FBC218F248D7997AD99D4743B77E2E035EBCC167B6846944B3D85A0CCC9A1BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 910dfc9075a58db69fc1b3b5d7056746b5f2851d2e1b54c98eae609d2d37f01e
MD5 d43b6ab4933f320ced5722936d6d5c16
SHA1 af4e25ebd5d33ed00fa6b641c329f24d7bb29ed3
SHA512 7e12d36592769d164b257529b48628bb5a8aadb67774a796dace66410b76ddbe3578590f994b94a8b7b28a76ef28982212d313de94663ce125f916dba0835e6b
SSDEEP 192:RON564ByQmiUynS4S85GBPKrs+FdGGm1pFE8iWwXqqU6:RON56eugS8Dddm1Q8AZU6
TLSH
T1ED120C316C78AC6B5D92B545F48736035EE5422BEBC46F44E7DC6B1C01EF7AC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0ffa498576ed62f546f2cdda708b4a9090d00a9caf1e01a5884f6a57efc96a3
MD5 22c21916f290f3035d7cd2ca26d6f22c
SHA1 68c307e1b4ae991335dcbe7dab88a4f526c0889c
SHA512 87a8018c78db4499eb92cced9b8a735a7ecfa378a633d7fe98b00775d694850c7b023a23f20e5c91f6b255a48f3fde3ca7dcf0a4832b0f564b5d4df9b675ec4c
SSDEEP 192:MONE64BAQmiUyh14W5GBPKrs+FdGGm1/aDTV9U6:MONE6eAmGWDddm18rU6
TLSH
T17A02F934AC786C7B9EB2AE45F48737175FE8113BA6905F44EBE82B1C009774C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92532a6b-2ee2-4186-8bf1-720bc08beb11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\92532a6b-2ee2-4186-8bf1-720bc08beb11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bca2df4f7ba27906c4a54a8d1b74b6b46534d91a01b7293579eea84a47be64a8
MD5 77a6efcabbb068c5b60e2f9dddf2aa46
SHA1 f3727c1f184e2cbe8c98664cfe1737dc8afdf106
SHA512 97b7b3dfda5a7d7b899559253a0a8c007a3b368f5c79f5f810e8bcadd5dcbe2c6bf5aaef91aaaae188a8b2e891ffcaefc4c8b4a14e457731bd4e241200a13f3b
TLSH
T1C141375CB6FA1148B3B76E469BF7A96D487FB8372E0AD45E10110E4F0A22B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download