hxxp://russia34[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://russia34.com
Sample260916-vbddjsxv9q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340509242264278"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{4D4B5049-654B-48D9-AB37-43844E3040D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4556	5044	msedge.exe	84
PID 5044 wrote to memory of 2860	5044	msedge.exe	86
PID 5044 wrote to memory of 4560	5044	msedge.exe	87
PID 5044 wrote to memory of 4560	5044	msedge.exe	87
PID 5044 wrote to memory of 4560	5044	msedge.exe	87
PID 5044 wrote to memory of 3088	5044	msedge.exe	88
PID 5044 wrote to memory of 3088	5044	msedge.exe	88
PID 5044 wrote to memory of 536	5044	msedge.exe	90
PID 5044 wrote to memory of 3188	5044	msedge.exe	89
PID 5044 wrote to memory of 536	5044	msedge.exe	90
PID 5044 wrote to memory of 536	5044	msedge.exe	90
PID 5044 wrote to memory of 3188	5044	msedge.exe	89
PID 5044 wrote to memory of 3188	5044	msedge.exe	89
PID 5044 wrote to memory of 3408	5044	msedge.exe	91
PID 5044 wrote to memory of 3408	5044	msedge.exe	91
PID 5044 wrote to memory of 3408	5044	msedge.exe	91
PID 5044 wrote to memory of 864	5044	msedge.exe	92
PID 5044 wrote to memory of 864	5044	msedge.exe	92
PID 5044 wrote to memory of 864	5044	msedge.exe	92
PID 5044 wrote to memory of 1020	5044	msedge.exe	96
PID 5044 wrote to memory of 1020	5044	msedge.exe	96
PID 5044 wrote to memory of 1020	5044	msedge.exe	96
PID 5044 wrote to memory of 3552	5044	msedge.exe	97
PID 5044 wrote to memory of 3552	5044	msedge.exe	97
PID 5044 wrote to memory of 3876	5044	msedge.exe	98
PID 5044 wrote to memory of 3876	5044	msedge.exe	98
PID 5044 wrote to memory of 392	5044	msedge.exe	101
PID 5044 wrote to memory of 1656	5044	msedge.exe	110
PID 5044 wrote to memory of 1656	5044	msedge.exe	110
PID 5044 wrote to memory of 1656	5044	msedge.exe	110
PID 5044 wrote to memory of 4748	5044	msedge.exe	111
PID 5044 wrote to memory of 4748	5044	msedge.exe	111
PID 5044 wrote to memory of 4748	5044	msedge.exe	111
PID 5044 wrote to memory of 1504	5044	msedge.exe	114
PID 5044 wrote to memory of 3920	5044	msedge.exe	115
PID 5044 wrote to memory of 1172	5044	msedge.exe	116
PID 5044 wrote to memory of 1140	5044	msedge.exe	118
PID 5044 wrote to memory of 1140	5044	msedge.exe	118
PID 5044 wrote to memory of 2908	5044	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://russia34.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff90580c188,0x7ff90580c194,0x7ff90580c1a0
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2745205071744849772,2460570723001849923,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,13784569369537477355,3369242255625201479,262144 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,2080800824566802047,5233621025884549401,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,563593349169832202,15188833820767611270,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10535291403575792079,6099803529779642796,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7212830385709375718,14789186120597693246,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6001769070164943115,14987936008360187245,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3700,i,547779128370100075,4768901352970632829,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,4378321930166519343,7753775250083490197,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,7481246178849455391,18052555960728835087,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7003883772232576719,5266072656376316364,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7003883772232576719,5266072656376316364,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4776,i,16211842382144816150,3278030104358259801,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6540,i,11342448062913008614,7089284604931998055,2097152 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,12837621142172784146,16949748582193651054,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9111572712510834215,16070177262700712024,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,409337562158358079,384236166690300379,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,17630407266819993062,16106216855690608259,524288 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5924,i,2271097232062031649,3710858841066482152,262144 --field-trial-handle=2884,i,13245621634319042696,4481744205344794162,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

8c22053b-3230-49f2-8a10-cdc39005fd09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c22053b-3230-49f2-8a10-cdc39005fd09.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 1024KB
SHA256 d7fef6c6ec5c7ec949fc4e963f6152c8072e83f6f0c65e4f88230d25719de918
MD5 3ce2faf412442a35effe4fff95b9b5a8
SHA1 d7fc95a099a7ef15493c1d93b5899384fc7fa2d6
SHA512 4ee621656db86708907ed2a9e39dd7d59597bcfa4b2ebf76e768ae1f201bcd86456c7a242b5f191c6e85de81ec32788d942eb1a064ed342b5a467510060c81f8
SSDEEP 24576:V2Y0bBSCiLPuaqYZkdTTxdmhh/3+0D2+VYpZc08EifYMO1fLq03I38ae:N0bxijuZYZkdTTxK3+0D2QK20QfYdLqa
TLSH
T18C2533E7E5C46D06DDB8873C875A9A39B09C8250950457C3D87CA04F3B8A9D9288FFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 933b81effaa074e3987944cf4f7950eb91dbd17dc2021d8b479e0163cdd0c5ad
MD5 a82e09efd2fc16815e44ffd26c17a67e
SHA1 66dbf4c88afe153c19839b53d23ade135cc50f32
SHA512 7bc834f82963b3d24252efbc94664868a641fad8f139f4e330a79bcf796596191f2dc9d8829da9c1b37c685d261ee6536e939531c4bc00c9305fcde3d8183dae
TLSH
T16C6141BA21728C96FF995670DDC9254BB87C948005DF5FD64FA2D0389C0233B5ADC09C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eec0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eec0.TMP
Size 3KB
SHA256 c53af73080772e238ae3a51051e5a693830c84c58d39db00066f795328b70cd1
MD5 a3a7fadacdb43de58318f744797c4b75
SHA1 79a7dc1c993ac61225cb7ab4516b846f7b6c0bfe
SHA512 37b8cbb8ceb115169ce7753cd347ebc6b0dc7bf533d8cdc72f3bfd2dc9e9d17e3a16b0d6ee2552b98d86920a42d5371b4bac453f4a7b6f485527f4b0ce20302d
TLSH
T16E6140BA21729C96FF994570DDC9228BB9BC948015DF5FD65FA6C0385C0233B5ADC04C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c7b67ef9be64fec0996631f51d70e47b3acf522690dc5d874f51f0433a46ccbd
MD5 4e3c5ddb964553efcc9bd08b52613e98
SHA1 99e642a6a455f5044543534cd3831ff4f5257a4f
SHA512 59074e139b208104cd7f0f731a9f08732a117905f86a1cb36ccba9771891c378813cd518ff2c3e0f30310af574e4d89090712509df3d9d6193994234edb9732d
TLSH
T11F41CCF7C3F5866DCC1296F06A15AE2BCE9D091542183D1A89E4BF5B93E3470E101E5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1b592466b0400b08bf0c5c86187a7c58de0714b5d1742bcbdc57a79499799cee
MD5 8a791cbf739f9331f6a22f49c66d479d
SHA1 24949ee7d62bda6ba4e0edb3d0725a23a0914176
SHA512 0b74dfe4aca6e388e73b7cab94cb6b533ba63a39e240efa22d9e78be3e348ca08957a811c82156599e5a9811ca586a06cda2aa1d8a7e09169f07156f32aa8f4a
SSDEEP 192:sxZAR+Wl/fHsl1BIdpgc0HW6+WNxIudYapPdDIg5kJ:sxZAbl/fHslo8Hbjdf6
TLSH
T1F522C8567E68A97B8CC7E21DBB55BF53E6F9103291D11E48BAFC861C04E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0f25e91778c039ea71abc125f85ddbe93bc26fa8f11383ab8b532551b4ae2f2c
MD5 52f486321e93a3c70cf01f4c5fd2a362
SHA1 06aff53a5dce6f71ffae558b3bf0426cfa6291c3
SHA512 9b12874ac93dc4870fb50758dec899d3e7d63d5b398849764be0d3683708631c1f47bb144f5105ceb00f22142e17beacaec95d7c8fd36440af67a285f572036f
SSDEEP 192:sxZAR+Wl/fHsl1BIdpCc0HW6+WNxIudYapqdDIg5kJ:sxZAbl/fHsloGHbjd+6
TLSH
T12522C8567E68A97B8CC6E20DBB15BF53E6F9103291D11E48BAFC871C04E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 29f1e5a20a33615e2c07dfd8fdbefe952b6aa9ab45d9d879e0ef400dafb75a28
MD5 71b0944b639c86b7491d7bb93815619d
SHA1 967452f10f9bb12f33ecaf97985653491278e3c7
SHA512 60e5966527167af819e80f5dc86ca99996abe8fa9ff48d65a0cf3fdf9d89cc557da2c36afa3a2262c2bd75d24f8998ca7bc32ec3a7b7e0cdc1019eea1ff3b7d9
SSDEEP 192:sxZAR+Wl/fHsz1BIdpCKHW6+WNxNC/YapPdDIgrJ:sxZAbl/fHszoZHbq/n9
TLSH
T12022B8167E28AA7B8CC7E21DBB25BF53D6F9103291D51E48EAFC961C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3e15f57ba7787d6acffe7de4bd370d34851620e8521cc1f2e51628c081fa53ca
MD5 7c73484beb424b0007a20caf19cacdd0
SHA1 4912f875b0ac6e2f647500fcc8a84f3178940001
SHA512 f29c91eaa7f23c7698c5b9a4f58330aff1eae1d9694b4cb68f0167d9388f730f5e692476a4113f193626fcb9d7e5e27982fd580fcd4cd06a5e5554c5bec3ae43
SSDEEP 192:sxZAR+Wl/fHst1BIdpCc0HW6+WNxIudYapAdDIg5OJ:sxZAbl/fHstoGHbjd0g
TLSH
T1E222C756BE68A97B8CC6D21DBB55BF53D6F9103291D11E48BAFC861C08E66CD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fb87104964a6d4f1843ca70c7a56ab249b436f4165ae8fff0cb9a01ff0a853fe
MD5 0ee543f4ea74cd1138e072f8ccab0e13
SHA1 784fce5540859b04b285334f17903eab8bdba987
SHA512 81f6c71bb452782a547e0304aa4a149693bfd684f762a95c273d02b91bc2d1014d10886597476f32bb6cda57bcdf8e163331ca71ab95dda03254b64b6193c169
SSDEEP 768:LpWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Mro47fepmRgx:LpWPcLKWvKeEeu1jaClLiF7X47WpmRgx
TLSH
T1BDC2FA3B644CCB7E4FC01A9DDC5A6FA77E9802C79A648D4047FE944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 af7dd2767c0d8f8d7f00c70e9b97127956ecfffe289bf5125fad0314883e93e6
MD5 382de2feeb83c1536e7333a10b5c98f6
SHA1 d6ea81c098bf741a57e470c2148a0105aa4e03cd
SHA512 ad4d486bc5c69bcf55a6c801adff7a4819bd1879f6990f3cc5946fc6c1cbe9d608477e95df1c55fc75129d32e63086ea2b8aee9713c669f0ff19dd2906c860c4
TLSH
T19B216E1072B7260038BEBD98C1789B9A528135733096F52A7F688056992BE0C5EFF8CD
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig~RFe5944b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5944b0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b25a9f48-b5d9-4d8d-ba85-5565c2951991.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b25a9f48-b5d9-4d8d-ba85-5565c2951991.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 01899f6c6d8b76bd9802399b4fd7b75b0d8d623a8f4a49d8600acb0c5f2e5761
MD5 0fcb6001786124743a7a127ea9b0021a
SHA1 1abaf55fa7a616c8eed635e485250bc05defcb09
SHA512 59f1ccc8a38f3dc4565abc9eb095e26dbce5649624e318321e8e40a84f8b8da5fe74f8acaf1514e8ba050779c291be1994aec70914e86848c4bec715b5777185
SSDEEP 384:p5iFiZcIKvsNe8TUNTUlIlWl1Sd++tv2zIGmUkOA+PW0siasa+VYKlNoU:pQFQafwg0o++tvALkOAEW0siahgln
TLSH
T175C228F259E7983AD9AE4743AB7D2D138EBCC063B1849A54B3C85A0CCC9A17FD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 5da0dec1c72bab9318ae2754fe8bd17397d4c8c279c93a41cc2977ef324795d1
MD5 54e67db921f8632e6a9599601c472093
SHA1 a99d168ea2fff102138d197fc4b830e24c14d8db
SHA512 79520f9925fe7f43a0f08f7355b9637dfdd2da7c7f029b6bfec3bc3f428b2398a5b2c588cd7009144d917b7efa798669bb7f9940bdbb73388bf31c9664d60e52
SSDEEP 192:uGXHsNOpQmaygE1edQmiU1eDh4zIGmUkOA+PWX97i//qqva+4LcYLWAdKltZ:DsNOpl1KCOzIGmUkOA+PWZiasa+VYKlb
TLSH
T147624B31BE78AC375EA39685F9473E239EB4506792C92F98D5DC5F0C04DE25C230AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f966361c03e32703bc07de70ea56d66fb81e96aa243a75c0ae7696bb25e8ac9e
MD5 55d944d71b58f394161e573c5bcf38cc
SHA1 c8920f4aee0fc9e3c0f1f0b8d09c16d0c4d83347
SHA512 ca1c130b05f7cddcbf04efd71268747f6ae9ca0c5ee3b6ede744507de6c4adb4ff09b19f66895c69562f8ae58b9265a7966d6be1d9eb58c50888bc5149da38d2
SSDEEP 384:RhZcIJsNOWl1S1v2zIGmUkOA+PWWiasa+VYKlNoU:RpJ0svALkOAEWWiahgln
TLSH
T146828E726E78AC775DE39285F9463E138EB8802792C96F94D5ECAB0D04D9358230AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffd7ae23455e954a40197da264e8fb323168945536b94d0efc47f78835aa0c04
MD5 d73fcd970cd20fb0f4609676b5024c7c
SHA1 943fb32c67052acbec4fed4c0d0c0995f03d6194
SHA512 8d1c2ab9880046db4f26bfaad3d1dd3c77afe08caaac620a12844933d057278ce3b0996749d09d2fec92ef39c1675db69e54e3721b48d4ed192ce12fcf91b181
SSDEEP 192:aONx6IE7QmiUyDcTPuIGmUkOA+kC7sx5U6:aONx6DtbPuIGmUkOA+RsfU6
TLSH
T13B02F835AC78BCAB8EF36E49F4873B239EA5112BE5856F84D9D81B1D00DB25C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3fb9af157f334030dd4c98120a95d114fb76007e92cfce1101669ff15fb7d051
MD5 7bf5e671459f473b27e4e0ff32df6653
SHA1 273942b9938873a12b7f2140962cc4e2f927fc2f
SHA512 87677e993ba52d8c56cae2be079b0fb2d4041de934836b5839bb4b652bd4ee6c13553549a9969212e3889cc87f7113dc2dceaa34fda278b8d2ea28ed8ae20c25
SSDEEP 384:oZcIJsNOpl1S1v2zIGmUkOA+PWWiasa+VYKlNoU:WJVsvALkOAEWWiahgln
TLSH
T11C827D726E78AC775DE39285F9473E134EB8802792C96F94D5DCAB0D04D9358230AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 337cee601f6b2a51834b0aa84738b8747643cf5accec76f61b554ef00ee43d1d
MD5 30f0e6a01ef0f4d54d7a37742af00db4
SHA1 3d54bb9eba0c6e44b64781f2e3dde0b9cbcb0b1f
SHA512 351e7ed390d79a602c6bf33a0202e42f4be34723fef3e59ffebe5d9ef23b0fc18d75e5604a9ceaa8e46663f50a68cc4295a5ebf4e34a871d48546e46d7e409a3
SSDEEP 192:uGXHsNOpQmaygE1eVQmiU1eFh4zIGmUkOA+PWe97i//qqva+4LcYLWAdKltZ:DsNOpl1SeOzIGmUkOA+PWWiasa+VYKlb
TLSH
T183623B35BD78AC375EA39685F9473E239EB4406792C92F98D6DC5F0C04DE25C230AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 355660078853fcf6a16db1064bbb126a37664f03678f14688410df551daf6aeb
MD5 19d742a111e60c3df93f05e77eb53547
SHA1 271bf8e4086ec699d8c555919d205aa99b95ff1f
SHA512 f4a706013f9f4b2210a730e189fec4353e554b8bc4f02c4b59e85936db313fbc38c4d26e7184a6a3b7d5aad21af967722b0ce9e1855ab8ca56a88645536ca77d
SSDEEP 192:aONv6IEgQmiUytcTquIGmUkOA+PWc27H//qU6:aONv6DgPquIGmUkOA+PWVHaU6
TLSH
T17F122932ADB8FC7B5EA36944F4473E239EA54127D6896F90D5DC2A0C05EF25C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

392d873f-b287-4712-b20c-bd8c49206e63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\392d873f-b287-4712-b20c-bd8c49206e63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 89e203132b5bd5b4b0fcfe4c306b42b5dba4b5ebbdaf6691624ed6802b19bec8
MD5 dfa53e7fc0e17afb431f9c84caab8e90
SHA1 7f5d5f9b3553c0ad3d6ad3163515865e23d9191a
SHA512 449204972d7f996eb119d29f09f303e6d47b9779f09fe24eddba162480092c388fbb7e6e465b39e5af58cb3f4e703ec6f14ef61e761e2b9af490e962154435b2
TLSH
T16B412B6876E91148B3B76E46ABF2B96D487FB9332E46949D10010E4F0967B40C97173B
MD5 SHA1 SHA512 TLSH

Submit Download