hxxp://trojan[.]russia[.]io[.]ru

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://trojan.russia.io.ru
Sample261012-zza1jsfs3v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{03B2AA02-A85A-461F-A706-9B90B9A346CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2224	3684	msedge.exe	88
PID 3684 wrote to memory of 3244	3684	msedge.exe	89
PID 3684 wrote to memory of 4816	3684	msedge.exe	90
PID 3684 wrote to memory of 1000	3684	msedge.exe	91
PID 3684 wrote to memory of 4816	3684	msedge.exe	90
PID 3684 wrote to memory of 4816	3684	msedge.exe	90
PID 3684 wrote to memory of 1000	3684	msedge.exe	91
PID 3684 wrote to memory of 4012	3684	msedge.exe	92
PID 3684 wrote to memory of 3000	3684	msedge.exe	93
PID 3684 wrote to memory of 4012	3684	msedge.exe	92
PID 3684 wrote to memory of 4012	3684	msedge.exe	92
PID 3684 wrote to memory of 3000	3684	msedge.exe	93
PID 3684 wrote to memory of 3000	3684	msedge.exe	93
PID 3684 wrote to memory of 2736	3684	msedge.exe	94
PID 3684 wrote to memory of 2736	3684	msedge.exe	94
PID 3684 wrote to memory of 2736	3684	msedge.exe	94
PID 3684 wrote to memory of 3744	3684	msedge.exe	95
PID 3684 wrote to memory of 3744	3684	msedge.exe	95
PID 3684 wrote to memory of 3744	3684	msedge.exe	95
PID 3684 wrote to memory of 4320	3684	msedge.exe	102
PID 3684 wrote to memory of 4724	3684	msedge.exe	103
PID 3684 wrote to memory of 4320	3684	msedge.exe	102
PID 3684 wrote to memory of 4724	3684	msedge.exe	103
PID 3684 wrote to memory of 2108	3684	msedge.exe	105
PID 3684 wrote to memory of 3324	3684	msedge.exe	120
PID 3684 wrote to memory of 5112	3684	msedge.exe	121
PID 3684 wrote to memory of 3828	3684	msedge.exe	122
PID 3684 wrote to memory of 3324	3684	msedge.exe	125
PID 3684 wrote to memory of 3324	3684	msedge.exe	125
PID 3684 wrote to memory of 4248	3684	msedge.exe	128
PID 3684 wrote to memory of 4248	3684	msedge.exe	128
PID 3684 wrote to memory of 2472	3684	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://trojan.russia.io.ru
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffcd1a9c188,0x7ffcd1a9c194,0x7ffcd1a9c1a0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,4530243403502995757,13425086031052835794,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1755022162314815967,2007819715909245601,262144 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,14132362488441579561,15704448049992065855,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,6596712567102609990,8692072322417994865,2097152 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,11103515858624285985,15328344844913514935,2097152 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,15401727171322769353,724785828718373933,2097152 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4068,i,7158571581959907618,10353663466420816314,2097152 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,5712188363403670960,2477390527467219080,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,11999828764454683888,8710878909164595785,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,5485528763273290649,5846324405560834525,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,5485528763273290649,5846324405560834525,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,12847197502366386321,14083140530742170368,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,11485072506912853989,2096999189411547389,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16656080532884919602,2829035446406615326,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7408107926987602408,16309442783782265584,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=764,i,4473441638160053652,6202690484808199552,524288 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,10936953872017557546,7329347175914360010,262144 --field-trial-handle=2604,i,3962314119798392577,15590067151337211681,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2659edaa-5b1d-44b4-922b-c915503107e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2659edaa-5b1d-44b4-922b-c915503107e3.tmp
Size 8KB
SHA256 b8640a4d1f122b875aa9176970cc7f903d3b5afa51a3f78976750eeb526da331
MD5 95652198a9ae886fb02cb1a848fc9956
SHA1 b83d5c256d56483372fb124f7cd6d641368b8a88
SHA512 1489dfb4e9dbfd32cf0d7c35e0dca57e626e70ff0a9c0eec712f05c791792bf300519169443f88d7144a4f3e2405cdf407c5618c24673f4a21a5885291a6190b
SSDEEP 192:tONK76AmwpGQmiUyWMigZsiX5FlS82PwoylRxrqtU6:tONU6ipidZasiX5FlS82Yow0U6
TLSH
T164121B36B868AC7B4DD3A594F08736235EA55127EB486F84D9EC2B2C01DE1AC530BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37d895e1-7bbb-446d-969b-f249cbd644be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37d895e1-7bbb-446d-969b-f249cbd644be.tmp
Size 20KB
SHA256 c0b0a963fa1455688c85c9f2965780896224ece353f8b22a09ed25894cbdc0c2
MD5 ef2262e71803659dfb1c403124ca30a5
SHA1 3d3b66a7557cce53096ebb1b0c9405e1f20b084d
SHA512 bd41a7002fa65b3d1e9a7fdcbe97eec4761a5e19ad3e23c9cdd7f48cf2e6e85f714089e2dd0a48f089018a5ba3167f6b07b391e14912513fb2a3d46a85d2d152
SSDEEP 384:OiFiZcIYzsNr8TUNTUlIlnIpuEsEy1du9iX5FlS82YoJ0iW/9iA:lFQkqwgmS18aYR0F9l
TLSH
T1E7A27E335CA8D93BADE6EB84F48A32138EB45167D6D4AF84E6DD9B1C01DA1EC030BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c9c7e3a-ae9b-4bcf-875e-c253624405e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9c9c7e3a-ae9b-4bcf-875e-c253624405e9.tmp
Size 18KB
SHA256 57253f5bba96accc1896a17ce775a1717acae45cce59a892a603be80ae1d40a6
MD5 9fcff603f062df86876e32e26bbcdb44
SHA1 692079995fda999438d0530060d140a006f1bfb9
SHA512 e3d155d78c1008f50d91beb2961a8bb96d399b1d7cb23b63c1d4f31441f6effd0c83193171c6a91a1a535ad42a191335d82dd8526f5030088d132a11ca622a34
SSDEEP 384:CZcIhsNJqIpuEsEy1du9iX5FlS82YoI0iW/9iA:whcS18aYw0F9l
TLSH
T13E829E31AC78AC3B99E6E594F4C636235EB49167E7C86F84D8ED672C02D91F8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9db99b8f-777f-469c-969f-7ac0e8e4cc30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9db99b8f-777f-469c-969f-7ac0e8e4cc30.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

0c00c8b6-2fcb-4312-ac63-3c272528da0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c00c8b6-2fcb-4312-ac63-3c272528da0d.tmp
Size 10KB
SHA256 b25a6bc99958fdd0bf266992c4fca0235802fcf3543d47bb26d75bccac7d2b26
MD5 53a8682da983cc35706c3909036fc066
SHA1 b15f3af53a275c1810f3c297e177353c4e522852
SHA512 1945093f7c28914c504aeaf0964d6ce5e37b66078dd643657ad88525c6fca287ad28c8539ed25dee4afd12852afb9450c3efb813a33e94b46db3ea77a212087d
SSDEEP 192:sxZbRPWS/fnsguR6IdpdcH6U6+WNSn0/Y3v0w9eIg5+J:sxZboS/fns7VWHQt/gww
TLSH
T17C32B951AE68AA778CC7E21DBB65BF53E6F9503261901E48BAFC861C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a42781a-922c-4d9c-8496-03292ff30f1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a42781a-922c-4d9c-8496-03292ff30f1e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3074d470-2e9d-45d7-827b-7bbfc129e054.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3074d470-2e9d-45d7-827b-7bbfc129e054.tmp
Size 10KB
SHA256 a6cb028f5be2586628fd1b770927bd758786e0d39bb703b85d8b4099f6f05f77
MD5 7f09f3a3ac757863c8ce3d829933a0b1
SHA1 f4d61355883889500767992b13214cb4c8869376
SHA512 64a576d98a430da555e20b272ad413b40522213440e1553bddcc3146e93a3d113e25c3ba523b7b96d1dad8ba859dc28dcad56e7f6b2fc6479c2368a9af3f6c08
SSDEEP 192:sxZbRPWS/fnsg7R6IdpbcH6U6+WNSn0/Y3pvmeIg5MJ:sxZboS/fnsOVgHQt/Qy
TLSH
T1DF22A951AE78AA7B8CC7D21DBB65BF53E6F95031A1901E58AAFC851C04E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5941daad-6e44-4fdb-a25a-8565cbc3566c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5941daad-6e44-4fdb-a25a-8565cbc3566c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7a260240-da84-48ee-a20a-7452ba34f4fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a260240-da84-48ee-a20a-7452ba34f4fc.tmp
Size 10KB
SHA256 65481be9b31ae3b1507e70f0102c6c5fc3a930885e075ffe6ae0dbfbee1b87b2
MD5 355b1239ca5fc7cbf5f9d17b0fc274f1
SHA1 1086ad7fcc9c5b17b571d3d5802721adc70728bb
SHA512 70a8029b070049312fc948e2fc035cac9308bd5b783d73f0bd66057dc939d4ea0a61354af064e9f1fdd2e7547e0111a6b3d34f0cee8d0f561028c7e1a7323055
SSDEEP 192:sxZbRPWS/fnsguR6IdpbcH6U6+WNSn0/Y3HLmeIg5+J:sxZboS/fns7VgHQt/Qw
TLSH
T14822CA516E28AA778CC7E21DBB65BF53E6F9503261901E48BAFC8A1C04E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83dc090a-b785-46bf-8e73-caf5c4f73d7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83dc090a-b785-46bf-8e73-caf5c4f73d7b.tmp
Size 27KB
SHA256 a6b92bd7c4b2bc0254d1bd8ce035a54507e0c95e1d7df4ea4466ba297174f532
MD5 d4aae2a72e6c8aea27d3c826df86f497
SHA1 58650ac84e6b2e0b7d8fb9849521b93bf8807cb7
SHA512 19bd2ff660dadfb69d237c7b376d7e1d7e7e6c967c29609c20819f2a8889faae55abfeadfeea25df2ecbeb16a5d92fbeb0e2d5d2a40a35a12f6ac682164d3972
SSDEEP 768:yi30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72RrolZMF:yi30AbSWvS2l9u1jaLmLZ12qm
TLSH
T170C2DB3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87573bab-e15b-4391-9aec-21be439d6ac7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87573bab-e15b-4391-9aec-21be439d6ac7.tmp
Size 10KB
SHA256 10df986a2bdb144ca97822fba0bdd121b8e89bdcbe776ae05b6afd9d5c2b7890
MD5 ef2ee6a5b4e4be0c7e625305d3707e64
SHA1 c6e42a45f871f3e6aa58d612a356f16a5ef6cdbb
SHA512 7a6dac49aa8fb86b65c07e7a1fbdf236e1ee2480083f1ab0c62bf38e3556674e0622f5352679fc9795fd4a8c3afef60478b081e27525592722adea0c2c12a3e1
SSDEEP 192:sxZbRPWS/fnsa7R6IdpbcH6U6+WNSn0/Y3pvmeIgrJ:sxZboS/fns0VgHQt/Q9
TLSH
T1B422A851AE68A67B8CC7E21DBB65BF53E6F95032A1901E58EAFC851C04E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 62aabb698c968ad69f2c42c415128eeee867685e98ffc08c16882c9f246e8743
MD5 e8b183e7438508b9185bb7db1173cee7
SHA1 7cbb2628c25872ffb0b61383634b59246326c1e5
SHA512 b3f5c012bd09703e9eee6d1c201d045d169081e55032c4ae2353d6582ed12f5092b33de913e332fc7975ab2f0f272bdd57a897e6e361fe98e0b056b2ad9d54ea
TLSH
T176E026E404C8C32EB318B9C701BD638D8BA03F5FA3C46D4E2700C5C4701AA40BBA36B0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 dce4a6675b815f895ff6a208bcc9c68b4fe0ee54a98b3b902e54f1911ceb0082
MD5 e4dd4e6aa4144c8a26452c7731d5c339
SHA1 ab2535658f96fa6ef3224bcd5511e9df2aeee47c
SHA512 e669808f0ca4c234d5358dc7937a4ca066491998e820f85aaa2269b9f0761b487f2b0741ac3d11eb90b68b1784c5976c516ac621eb9803c235c5e4c51beda5ee
TLSH
T1BD613ACDD142848AF7980075D2DAE4E732B26CA169B39FD338E4E3FD9C07F40A918408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c5b730785a9bb14d66d9e564265a2fa4a1f16ef2a9dae406c1d3d9730fb914b
MD5 0f0870ada016a8c18653659e99848eb1
SHA1 d34f2da37a3c0af9d8cb9c204d9528638512a1e6
SHA512 2c33d415e96f38e21b282bb47db79beffab314ec1aec794e03408303015674f09cdc56e23f98c62822a895e1cf504b1196594abbe1b889bf33061d8278ef4bdd
TLSH
T174613ACDD1428499F7980075D2DAE4E736B25CA168B39FD338E4E3FD9C07F00A918008
MD5 SHA1 SHA512 TLSH

Submit Download

6c3bfbed-63bb-48ed-8a78-a8f05f8ddc21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6c3bfbed-63bb-48ed-8a78-a8f05f8ddc21.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

61f879ba-8ab4-4e14-86fb-25c769c98b0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\61f879ba-8ab4-4e14-86fb-25c769c98b0c.tmp
Size 949B
SHA256 467fc3b258743b41d65b579ac79fbce2bb2f6904d13efaa910ba4eee287919f4
MD5 b6b39a6da9e1b77a1b01616a6014a3cf
SHA1 a1b6d7a601b3499b2019f4270302cebd659c8e7c
SHA512 d843066796650f0bff9dc840f2e4af2544ad03ad9d167a5677f59dde772b59315babb6998e2766aa9dc5a86b8063180d458e38babbb6dd5d6fffa12a33d8eaf0
TLSH
T152119BF3C7D5966E890116F06A24AE2BDE1D060642187C1985D4EF2B93E30A5E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

714902f2-1cfe-4e8f-bf0d-0d75d657f04c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\714902f2-1cfe-4e8f-bf0d-0d75d657f04c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f81002f6-29eb-4b54-a016-392905d50f99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f81002f6-29eb-4b54-a016-392905d50f99.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 81b2adcfc53c159825ace22a35222e9d36b9d2084c705ddf45e467986db043cf
MD5 11cb296bf0602b61989ad6b57415fb5c
SHA1 b60162a3adfbd48017c869c8c887b260980afd34
SHA512 5ea0fca4fa0dc307065d3a2aa806db3c9d4ad08d4e16dbf44d7f207959930b33bacb6273d9aaefeeed3f777f0030182eea4712cf9120d9d8e5f3c82549d71c3b
SSDEEP 96:Kwj2KcQey+0K7CAnqKgsWph87PhLrBuvuc0nBKco0hBI5Rmna:wNHiJph87PhLr4vubnFo0h25Rmna
TLSH
T167B19844767B521138BD394890ADC7AB068236B33125E5AF7BAC80A34F6FE110DFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46f8bd4c-2db2-4854-af3d-1230d04d05b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46f8bd4c-2db2-4854-af3d-1230d04d05b6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1de7329-da48-425d-b929-d0da061b7297.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1de7329-da48-425d-b929-d0da061b7297.tmp
Size 18KB
SHA256 86e3f782b60e3b43e9fd7e7a6e347a145aef372754489ca5e301b5cd06cf5657
MD5 07606fb5eb38c9766a93c9094d064a27
SHA1 ef8b1c8a4f4bbb7e14268bd11e5c8ba5ff46241d
SHA512 f799a12a7cb0e34817edeff0009cbdab37f15d02cf260f488dd3c19ff93c6dba11e576dbb0e61f0081ee22ce4a286a82b13c8f710cd9c1e3b55c878f850663e5
SSDEEP 384:ZZcIhsNJnIpuEsEy1du9iX5FlS82YoI0iW/9iA:xhJS18aYw0F9l
TLSH
T159829E31AC78AC3799E6E584F4C636235EB4A167E7C85F84D8EDA72D01D91F8030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3139ec6f-556c-4385-8194-9d2f1e0cf1dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3139ec6f-556c-4385-8194-9d2f1e0cf1dc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8f5fd1a-de2f-4b6e-a49b-3272353d397a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8f5fd1a-de2f-4b6e-a49b-3272353d397a.tmp
Size 8KB
SHA256 ac1e8826c8834334d0a3b70507112c336eb1a39afbba1bde574b06e51cab915c
MD5 0ced1f75c2ef4ac80a51177f2e9b4f8a
SHA1 da8adf2d29cec089237fc965caf892d4cc9c577c
SHA512 e21dcce918fc9c624652d49e295ead14e2ab3bb3e982e9d80a5549f884a3eda2113a41d79c4799ba7b205fe6f0e6ee74c9417f7814af4a22818c14031989a888
SSDEEP 96:gqONkoQsjpfuMVwptaL5ih/cIPURHl8h4otop5uiCDiBIPuva6zx8X5Fx+xKYv6u:LONU6AmwprQmiUy2i6siX5FliJiqJU6
TLSH
T1B902E935AD686C7B8DE3AE45B58B37239FA5117BE6942F44CEE81B2C01D769C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b12bd86b9aa8913bb1a9632ed6176f723ba095cb2ee692a4c6c93d5e5972c892
MD5 8c91e5959b2ea0156c47a21269cf069b
SHA1 ecfb49d97620f23c34092657a9ff388d782def9b
SHA512 2bdca2fbd829112615f862b9d507f9365ddd5de2f3418476288a8cb4168ea9c1d38bd75b92f1882bc5e15a42c4b0a224c6a0912286ed7d87f686f50c7c9337f7
TLSH
T1D1414958B6FA1144F3B73E5AABF6A86D487B7C772F0BD59D00010D8E0662A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download