hxxps://votva[.]vu/new/adobe[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://votva.vu/new/adobe.html
Sample260622-sshcqady5r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266153986418473"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{40CEBFD3-D08B-457B-B8E8-4463BDC7BA8B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2372	2816	msedge.exe	86
PID 2816 wrote to memory of 1052	2816	msedge.exe	87
PID 2816 wrote to memory of 4548	2816	msedge.exe	88
PID 2816 wrote to memory of 2180	2816	msedge.exe	89
PID 2816 wrote to memory of 4548	2816	msedge.exe	88
PID 2816 wrote to memory of 2180	2816	msedge.exe	89
PID 2816 wrote to memory of 2180	2816	msedge.exe	89
PID 2816 wrote to memory of 1620	2816	msedge.exe	91
PID 2816 wrote to memory of 1620	2816	msedge.exe	91
PID 2816 wrote to memory of 1620	2816	msedge.exe	91
PID 2816 wrote to memory of 2220	2816	msedge.exe	92
PID 2816 wrote to memory of 2220	2816	msedge.exe	92
PID 2816 wrote to memory of 2220	2816	msedge.exe	92
PID 2816 wrote to memory of 4736	2816	msedge.exe	93
PID 2816 wrote to memory of 4720	2816	msedge.exe	94
PID 2816 wrote to memory of 4736	2816	msedge.exe	93
PID 2816 wrote to memory of 4736	2816	msedge.exe	93
PID 2816 wrote to memory of 4720	2816	msedge.exe	94
PID 2816 wrote to memory of 4720	2816	msedge.exe	94
PID 2816 wrote to memory of 1736	2816	msedge.exe	100
PID 2816 wrote to memory of 1736	2816	msedge.exe	100
PID 2816 wrote to memory of 4116	2816	msedge.exe	101
PID 2816 wrote to memory of 4116	2816	msedge.exe	101
PID 2816 wrote to memory of 516	2816	msedge.exe	104
PID 2816 wrote to memory of 1832	2816	msedge.exe	113
PID 2816 wrote to memory of 4600	2816	msedge.exe	114
PID 2816 wrote to memory of 944	2816	msedge.exe	115
PID 2816 wrote to memory of 1248	2816	msedge.exe	116
PID 2816 wrote to memory of 1248	2816	msedge.exe	116
PID 2816 wrote to memory of 3560	2816	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://votva.vu/new/adobe.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc705dc188,0x7ffc705dc194,0x7ffc705dc1a0
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7452862838085031400,7250887936794818654,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,1988692967728614430,17510088581028703643,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2438963961357347186,16247120848421987201,262144 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,18194631173791773497,15953100046532078387,2097152 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8914556475676785416,7226805936734676170,2097152 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,2129757937718529772,13980490109806771672,2097152 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,12627082522889586352,1559904770732894658,2097152 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11690364105282728942,14520029271895374642,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,887045612239120841,13835617070812708980,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7442223322145962149,7954574387261844983,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,7442223322145962149,7954574387261844983,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14484122072469499138,10658652342152225347,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15757394986900443987,5272466857618808726,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10399724720083879939,14222127746048165139,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15753319553084636583,6681007201407551872,524288 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,785975609912487922,4030984176253651601,262144 --field-trial-handle=2224,i,8265686930131769505,1120344785911996485,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 368d26a5ed3d1750abfe326916f2fe15f377672f3cb6163e95de075c033df799
MD5 9b9e9b20d226a77ab90cae4830db66b7
SHA1 1fe2c61158f0d4fbf9fb1272ca332c539e70319b
SHA512 fed68636acfda8c044413c80b8a52cbe30d74b4a0bff59f647a22620eca3b618787f81646f329d4ea8d1d873ebad25badd1c6cbac02a1854e97316c8fb71fe36
TLSH
T1A4713C7402427282E7E21530D3CA160537B208BDBBDBDE1537B0B8BE7636F5A855943B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590555.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590555.TMP
Size 3KB
SHA256 f5de885510720f688a070caea11c7d989942b8ed7cc5a20d50fcc9a815364e18
MD5 f03991a190b1e5e10c6409cc252213cc
SHA1 bbceee22140609ea66dc5b9e99882d0d09f4fe7e
SHA512 3e2ba863b24dc12406e03d9d640c4e5033ba82e090275ec19f32b02aace0f21071a53b04749f27882c188d9f2e2665d520de5d6932a0a1a12dbf283018393dbf
TLSH
T19D613A7402427282E3E31530D3CA160537B209BDBBDBDE1923B0B87EB536F5A856953B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 95db2707a9dec4398b445334126d9edb6bb3c984e7fe324ef7bad60fc83addb9
MD5 235c8620064fc4bde74ae8eaea88fac6
SHA1 49c2456346f28f67f3e99ddc6991849bbf2f6911
SHA512 6e16b50f30be9b773474d41b159693d8b65793e2da4a618efc6a060b8e91ccc3340c779393b412d0cde4549028d2e7f915e2eaf20de8c2afdbd6ee6cb728019d
TLSH
T16F31CFB7C3D9826DDC6516F0AA147E27CE2D0945432C3C4AD9E4FF4BA3E2471E20195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b81b8659d979c7500f91f52c0ff971a7982d0262c48640428d3a62b66e5ba5e2
MD5 a6a1fa0fc08c6a475c6bd9a248c2132c
SHA1 a15b129b5e24d0dc926fad41c76f1c69b5a42a33
SHA512 a5f86f8421f0cde48e8e20e4fed2d5532e8f9596f8c956e3671efa1bdba5d03bfeb06e31e069144f1a4dd6c190eaa1f52cb82066e3664f1ba811a01b7cb55f1e
SSDEEP 192:sxZ3R/yM/jK1Ml8UQNkd/fcskwK5IdpmSHW6+WNv/0/Yw8P/JIg5IJ:sxZ3nqmd/fcskwKShHb0/oS
TLSH
T13C52D7526A345977CCDBD209FA45BB53D6F54463A2940E48AAFCCA1C04F6FDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2f174cfc23f24718fd553a5be812e1a50a354764b1f36d66246f5ace5eb8154c
MD5 79f27695ca5063286567e08eb4796494
SHA1 02e30edd0ad5e47cffcf9eb71e6b3c9c89b39b8a
SHA512 f79e5fe5e517ba71595c8e1127a8ef23ead66513ca836a3bee3ad06c858c68c5529d246d65dd06ddb4bc7a7090885b02e9a2ecd46bd33ad7115c13961f22b67d
SSDEEP 192:sxZ3R/yM/jK1Ml8Mkd/fcsMmK5IdpwSHW6+WNv/0/Ywna/JIgrJ:sxZ3nMd/fcsMmKSvHb0/W9
TLSH
T1E242DA526A34597BCCCBD209FA557B53D6F54563A2900E48AAFCCA1C04F6EED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb458239f654b1beedf56b3d20b5fac442311ff9f417a2289fca96af0d3c191b
MD5 d741ca8a11b5f913d449032c140459c7
SHA1 f1636e06a44113ea59751613318368f8e750f377
SHA512 f7180b67a595435404a822daf5be9e2a9a4939d4edc8a47d1abadfa9b84576b03bf437e344e6e15d7bbd16198bed2d587d125aa5251d08cb87e2bcdf7cbed8ed
SSDEEP 768:+P4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dNrohzlaH:+P4jeXmWvmKxEu1jacPLZQdmY
TLSH
T190E20A3B280CCF7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 765B
SHA256 9b810d060cd28346fb10f4561a792c477c512fe2be04dc71bedfca4f123da9a5
MD5 656944444c3b0a0ef881b8b3b8b73773
SHA1 2123fa93d02ad3655537fbf59b357818e995cc96
SHA512 496ae152c3c65336a0cbf2eb1ff5c686a09887c4c8bf9bc8230943fa97bf4fb282ed2b5146de7bb61e894dd1246caa613e483e973a2595853d2e0472e75995a2
TLSH
T1DC0144C092F821C56E4DA941C109A40BA0A13DA5127EA873131D60F01FC4C1C0BEEB54
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 154450020cf620e3ed220316a216e1674f51142e7178ce9d4acef83f4548ad18
MD5 7c19b4e2c1d0a5ea5f5e8cd6f9e31fea
SHA1 12085d1e02863c2a49deea95672dab867b2630cf
SHA512 e49c13cc8a309c7c7735bacb944e658348964b72e524dba072fb677c6a742a5737facf14a13e9465792f683c9674e0acd9df2407148644e19790e129438b74e7
TLSH
T12A2144C093F921D57E4DA941C109A80BA0E57D6511BEE9B3231D60F41FC4C1C1BEEB21
MD5 SHA1 SHA512 TLSH

Submit Download

7778f978-3987-44ed-8c0f-95c2afb47603.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7778f978-3987-44ed-8c0f-95c2afb47603.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b902af8a9ca38d82eef6788d577a0008e6c2a984e0bd60ba1d166acb4d470fdc
MD5 39bc4f799cbc4ad96fa5f1ed4da79a9e
SHA1 5b803bcedad17c70b3755580d616b9381eba2914
SHA512 79263ae8b9f57aba944beabd07058d473ee517ab3e5e6e80a2c1eecd7480b2c0e21e25e28ea5067336353cf8b985ca4aa2b0721794a61674c43c8d436305a5c8
SSDEEP 192:uiLsNbFQXyhWhZE92QmiU1CPb14H/+jV8jzorxonX685cFTzq+8SHZit0ednhjRU:vsNbFUbAQEqf+W86nX6/FJ82MbdbJw
TLSH
T18A724B726878AC274DE3A645F44B22234EB8A1679BC53F44E1EC6F1D05DE6EC231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b42eeaf434c28127b5498a906cff7c4f54469ac24e8919edcbc18ac0723df72e
MD5 8354f49af070ccf196b5f4410fafb6b4
SHA1 4241fe130586e085d496ca38f763fc72125ec5f4
SHA512 28b82bae284d87954ae83daa32ca135f43bc84a2221882455844e62216031acf56f645c5c2534d25173298ee40eb8a7c5f07e1733f98aee6975cc2f39d99935b
SSDEEP 384:wiFV6zsNl8TUNTUlIlKUbAQSqf+W86nX67FJ82MbdbJw:LFs8wg1buy3X6pJix2
TLSH
T167B2F7F254D79836D9AE5B43B77E2D134EBCD063B6806A40B3985A1CCC8A1BFD30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 8c886279c70c8083f15d5ee281d37fe4cbab03eec1c4119882115c1b064a62b1
MD5 5c46ac030c4675274061ae9293d2da9c
SHA1 6e956110463281313f6090e32124a3dd33ebe2dc
SHA512 5782e5a4a4c5aa1830d976e7ced7abe579f147b1de26828de6520dbd427b9a52c1967ebab7468c542d4763025224df76175a7d47a111b31ff861f1a2e48abf01
SSDEEP 384:wiFV6zsN+8TUNTUlIlKUbAQSqf+W86nX6aOFJ82MbdbJw:LFstwg1buy3X6aAJix2
TLSH
T193B2F7F254D79836D9AE5B43B77E2D134EBCD063B6806A40B3985A1DCC8A1BFD30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1dad7cec17598d68c70193caad4f0373c1761e34c09b13e3bac6d6e30d7dd99a
MD5 3aba3170112a27f6d585b92a257e8ec0
SHA1 e7c22d14c41580820682c782fd157aa1e23204c1
SHA512 eadb1925520b230713139ec92de3ffca26d3983e105447039e496ccb1d1d782804c4443f8061868fb6229ee00558ecb7e8bd2eaa8efdd70af8b699e31fd48eec
SSDEEP 192:EONz6hZ0QmiUylypc/+jV8jzorxoE5wOZktU6:EONz6orpu+W8672cU6
TLSH
T16302E9356C786C778EE26E45F48727235FE8112BEED56B84D6F81B1D00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cd46df2116bebab9d031e3a7be25e8834e2a08876cd8f8d62545129d80e241c3
MD5 7b9d493025a353072bffb67cdddfee91
SHA1 d9de1235b7871dd58a8604a47a500b7cc921753b
SHA512 17c5793f06fe97cdf1d227ff9c7c9407a1c83a7056a6c08dd64a83671ba25b3a174cff36c67846fc4b4409fbae31484757d3f2ecff4a865fdadeca5f15e8c9f3
SSDEEP 192:uWLsNbKQXyhWhZE92QmiU1CPb14H/+jV8jzorxonX685cFTzq+8SHZit0ednhjRU:vsNbKUbAQEqf+W86nX6/FJ82MbdbJw
TLSH
T19B724BB26878AC274DE3A645F54A32234EB8A06797C53F44E1EC6F1D05DE6EC231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 670b970f2a5836d62b21b001ebcf237f5c3b1308affe09e11648b33f5480a562
MD5 ef35ed1870e0c5586188e99482c51e65
SHA1 3abb30f2a47f934d586cfd0d3b8ff0059fa59b37
SHA512 aac743bff85d84d13050bccd48696c39eab821e88aac887d9c3ecbc5be9a83852c23b47d2d526becde5eec02b479924e481234b41b9ddb9a04e862bc4e23d2ae
SSDEEP 192:6ON+6hZfQmiUy+sy2c/+jV8jzorxonX6+5cOqzq+U6:6ON+6dR2u+W86nX6x9JU6
TLSH
T136120A36696CAC675DD2A591F4C732134EE85127EFC57F84D6EC1B2C00DE6AC230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b71eda8f-021b-4199-b1da-1ae7ca85c89e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b71eda8f-021b-4199-b1da-1ae7ca85c89e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a112fc4b5bce6e7adfce6f7828f97fd0a3837dab928bd662641159065296555
MD5 c5f12c547d312e3f797f11f94b3c42fb
SHA1 b6e61a3afc6545c1c873d259d0ada917af440f17
SHA512 9808049fb7107db4597da2926d1213c8b7e1cc4f40d826d478414a9bd76d879ac0b8f84074e6475e64801e139540683cbbdf3042850157fdfa6aaa00ea68edd1
TLSH
T115412B5CB6F91148B3B36F5AABF764BD847BB8772E06D46E00010E4F0A62B40D862737
MD5 SHA1 SHA512 TLSH

Submit Download