hxxps://internokof[.]cfdinova[.]com[.]mx/

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://internokof.cfdinova.com.mx/
Sample260802-sdlftsbg27

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1424	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301564477384916"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{FB179124-5190-4059-86EE-386EBB748C5A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4872	3192	msedge.exe	85
PID 3192 wrote to memory of 1424	3192	msedge.exe	86
PID 3192 wrote to memory of 1428	3192	msedge.exe	87
PID 3192 wrote to memory of 1428	3192	msedge.exe	87
PID 3192 wrote to memory of 1428	3192	msedge.exe	87
PID 3192 wrote to memory of 4960	3192	msedge.exe	88
PID 3192 wrote to memory of 4960	3192	msedge.exe	88
PID 3192 wrote to memory of 956	3192	msedge.exe	89
PID 3192 wrote to memory of 956	3192	msedge.exe	89
PID 3192 wrote to memory of 956	3192	msedge.exe	89
PID 3192 wrote to memory of 5108	3192	msedge.exe	90
PID 3192 wrote to memory of 5108	3192	msedge.exe	90
PID 3192 wrote to memory of 5108	3192	msedge.exe	90
PID 3192 wrote to memory of 1172	3192	msedge.exe	92
PID 3192 wrote to memory of 1172	3192	msedge.exe	92
PID 3192 wrote to memory of 1172	3192	msedge.exe	92
PID 3192 wrote to memory of 2592	3192	msedge.exe	93
PID 3192 wrote to memory of 2592	3192	msedge.exe	93
PID 3192 wrote to memory of 2592	3192	msedge.exe	93
PID 3192 wrote to memory of 1096	3192	msedge.exe	98
PID 3192 wrote to memory of 2496	3192	msedge.exe	99
PID 3192 wrote to memory of 1096	3192	msedge.exe	98
PID 3192 wrote to memory of 2496	3192	msedge.exe	99
PID 3192 wrote to memory of 1136	3192	msedge.exe	101
PID 3192 wrote to memory of 3736	3192	msedge.exe	104
PID 3192 wrote to memory of 4500	3192	msedge.exe	105
PID 3192 wrote to memory of 2204	3192	msedge.exe	106
PID 3192 wrote to memory of 5088	3192	msedge.exe	107
PID 3192 wrote to memory of 5088	3192	msedge.exe	107
PID 3192 wrote to memory of 2740	3192	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://internokof.cfdinova.com.mx/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffd6931c188,0x7ffd6931c194,0x7ffd6931c1a0
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,6355619901310327341,4239437750784539415,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,6299121306350655886,13427737043744488580,262144 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,15722339631498489293,5701246454186803099,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15714678394865863901,17281267491960764307,2097152 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16629593658021828785,6679606354006871649,2097152 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,74926623943072177,9903624549174060135,2097152 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,11845811159985831762,16816418318511542589,2097152 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,8366918048272160349,13236042231959365499,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,1998907151552464415,7459973373485596508,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,5783732103923008359,2192657050231227608,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,5783732103923008359,2192657050231227608,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,323472009028374604,3710741336153199639,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,10032426026964901230,11169622108369303541,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,979218001234344749,7342374067376935744,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,17521504118264106772,5555312949654833242,524288 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=768,i,4452255477345082049,11089923260670715907,262144 --field-trial-handle=2632,i,12436393615163937098,5015112929257020085,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 170dba82c3c1d375809e04168f3ebcd24865503047beaae16ac5acd42a07e369
MD5 3c9aded40c22ce6c2d048535ace0e977
SHA1 c74250e15a13c5f5ac83039050878df1298c44c9
SHA512 2e57432b8359c45e46f3d05d9c6a57eae6ada11c95810c76be1c532993d0a00b71e958c5a942913acd811290e76a78a313f0d89e6f1b2d2cfed07734a97e03a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1E6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c783cc60997ac72ea49d3213651fed30a2ea5efcec1f7e1ea1326268a7fd4e49
MD5 19ebcaec46c2adbe0cd90a41ffec1308
SHA1 b94ec2ec006959229e9d825ee6e4e78f5f769b64
SHA512 35960e1ce3a0d31d1ace15c7d3c991595f83889ad3fc29c5f6a057c165acfe1f39e516475838da9e2a56b8f7dbddb5d16615d1c4c733e44756d24775decf4729
TLSH
T10661A46D1E46C063EF203630D1C2A1F174724D7ACE27BE0AD0C8D8BD580DBE7869AB18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58655c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58655c.TMP
Size 3KB
SHA256 48d9697903db0a71aec5e518643dde1b0172be3114be020e0a9d3c961ed8a4d1
MD5 4bed30b7a1aca3b4aa03e0fe0aa828a4
SHA1 8fea307030ae4bd5e1b92c781f3c9f69034f3948
SHA512 6c3a844577209f0d219b08fc218b865e3a3fe371a305701ef411d3de87d4d966cbbb7c739d940f7f3b7611a9f98aa7d962f7dcf1af1051a93d50609511f8872a
TLSH
T1D861B56D1E46C063EF203230D1D2A1F574724D7A8E23BE0AD0C8DCBD580DBE746AAB18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 999B
SHA256 666ee60597914e1a8527e0032f021350964db2dfd5a4977b74308ddbacc248bd
MD5 af8ca5b65a84ae9c4e0f312c2bfaf6f4
SHA1 3a25782def5b923b193220cafd20badb83c164e5
SHA512 0c8101d7350086ac2de0cf4b29373f114cb60eb52bd1120563fc04030504e31c32238ea7c129e7487ce9857e0e6a130ab61254590b4df3c2df9944020ac2dff6
TLSH
T18011ABF386E5869E891112F05E24BE1BCE1D0556822C7C5985D4EF5783E30B5E001AAF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c290911554ee0546ca4ea043266c7a5d1a9ac69dbf412a79b02a8e881546d1e
MD5 e996e53dabcaf022530c65b6ba590563
SHA1 ed2d1c2e20f3b2506fdbb3aec11f236baf4f4cc5
SHA512 bf9db903726a447dd7d362be3e862c005e2a97fe1db71b95a6d5977c49ee2551eeca74a0535cb5014aca44aaf8177437e3937534fe2272afc056d063e265d7ff
SSDEEP 192:sxZ7/yM/jK1Ml8Mky/fdsieAKIdpkSKHW6+WN9BpGfYHEQmlIgrJ:sxZ77My/fdsieADEHbofX9
TLSH
T10552E7126B34A977CCCBD209B945BF53D6F90572A2900E44AAFCDA1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d81ffdbd1e2b9ecb6b0a5ed5006b4406ed39d2379aa9007d0e0448e88592cad
MD5 288493a2136d8ab74febcafc5b110f68
SHA1 63c3c4ccaf304dbbd6a42a8905eacb7aa70e50e6
SHA512 b9b794b635423dc3e493a5d6fb3fc9d9227bf751e6275e9935779c1e33d73f48ebea34680ad7d6297f83450b8d0691f34d6e00f583eb3acfb35b0424c97f4244
SSDEEP 192:sxZ7/yM/jK1Ml8UQmky/fdsfeFKIdpKSKHW6+WN9B76dYH26njlIg5WJ:sxZ77qNy/fdsfeFDGHbKdGU
TLSH
T17752E7126A346977CCDBD209B945BF53D6F90572A2900E44AAFCDA1C04F6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0d3214af737a2e97648df98cd97f77b3da4592de1a84bdf14f2736cbadb81892
MD5 6715cc4048edd9cb74ffd4d93d7507dc
SHA1 7777dbd2eb4dee09929459caee7fef9890458fc6
SHA512 cac786183d2091bce5acba60cea11f642c901959ef3409da431346919d54be54b1060a7605e760582627a671316408faa865db955c5d0b9b22708db3e6202e31
SSDEEP 768:ZYUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RqroVR0z:ZYUZYTMWvg0Pou1ja7eLZmRBEz
TLSH
T139D20B2F284CCB7E4F844E9DEC266F967DD801CB5A984D5447EA884C03C72EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 da4a1f55ffc937b8ebc24757f16db04cb1c589c81b6d56212a45f4ddb537cb31
MD5 71d92861aafbaa345233c7de488146e1
SHA1 36093c431aece330fdea01fc99b3e5f3d51aaa71
SHA512 b1e9283c210934dc5e3c4b63ebbbb9e4561f733ec067a88df2230a84a7d992aa035424f747e1fa0bb3799f81b488cac5dd5946af024081b6fb02947592a62364
SSDEEP 96:KA1eK2AozWKco+GjaKAQAx4fjxvPxWDGsA7xKI4ARxUJhe7PSiIgKNOI:E0F9TbzP
TLSH
T182D1F41272BB02033D3E2908A399D73A0F45B5D33858A46B3BA904B15D6BE345DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adf03873-2502-47c1-8bb3-cd795b26a47c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\adf03873-2502-47c1-8bb3-cd795b26a47c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 eaeca380fdfae0136fd6ad6838db688ef1ca12150163b593100951ef87548bc1
MD5 72f183c869beed87a39606269d0ee126
SHA1 d19e88013774b4ec3625948c57c1d75e51556aed
SHA512 b5a7eb339c24a78b7151b365c7ed6f504522388dae8e3e7768e230154bc5df4f4556353ba2de709db4af0998a19446e2d075a8b34514bdceca685010d9e4a31e
SSDEEP 384:lOiFiZcIhzsNd8TUNTUlIlPeZYAoLflszX5od+H8ykXvDnTKwBODNZOCe0R:llFQR0wgkZMSONvDnewBKZOT0R
TLSH
T151D219F259DB987ADD9EA747A73E2D028EBCC063F5806690B3985A1CCC9517FD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4fa2dafb81aebf3c6dc4398174b40a611d8e5bed5b03e04835abf2a672f26ec6
MD5 8641f397ba1d84461f10755bc6b18a02
SHA1 65e42ac18170672715eed8e981e33223233c5140
SHA512 5e74e4effdbf71bad1913c4f55142bf70c369139435f76b224ad29f7ef6ed23262c44ade70687b9e4f3d09139f4060a3327661358599b586f5de90725c453675
SSDEEP 384:9LZcIhsNDPeZYAoLylszX5od+H8ykXdDnTKwBODNZOCe0R:9ThzZpSONdDnewBKZOT0R
TLSH
T1BC927E72A9386C7B5EE6F545F44B32138FF89067F7D42B9496ECAB2D00D565C130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f1d2b07b28c6d1277ede8a41495caa0b9cf0eaf4a59fb2b40cec9540e34313e2
MD5 73183ca8767dd84850ff4b04542024d3
SHA1 448429dc659751ac36b85319604ef638e0fa11e1
SHA512 7a9709542f0bf68b43f8b03eedd6f1b23b75c71726ea11ed7c69675d7ac2df3c227f20e41548dc85ed62260f529c041970b4862c0f8c5b6a737e66a6eb722a5f
SSDEEP 192:yONa61VWQmiUydongGX5Obd+jTjzoryu/aM3j+U6:yONa6WC4gGX5od+H8y9k+U6
TLSH
T14E02C835A9686CBB8EE2BE49B44737135FD4206BEA546B84D6EC1B1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f1cf46433f67903345cfc01678608033c6cc39ba8fd68296142c5c0cb841fab
MD5 c5a00d3e7ca905c296c2527646c572dd
SHA1 64635edd2b598668338cdac13b48d0add170a3ff
SHA512 7ee73d93a5044e7dcc19a22f26ff4ec19dafbcc4ca842b4918cb1486d35359b8cae31cec010a0c42f261ef9f4cfa4758778c647922700536c4ac38e9332a06c4
SSDEEP 192:u84LsNDwAQBlz1CxtXQchQmiU1dj2lD4zX5Obd+jTjzorykX3D4QQqxU8:X+sNDwAeZYAoLylszX5od+H8ykXdDU8
TLSH
T102320B32A938AC7B5DE3F555B44732139FE45067DB842F90D2EC5B2C00DA6AC631AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ffef9305f0e2374671990a13358d070a279d7ab4aebcec534605a22032445f7
MD5 9d6688d2544297ca6bcb7b50d8e146a1
SHA1 fcad67f03191fae82bd7c925532f22ffe2d7989b
SHA512 109c83f25da4e350503a4a59d8f316a8dd923447ff5677a3d3c3c712219f46a22bdd125d6bf074b66563554e723d6a25c94d7b0b47dd5546dbbfe47d9b09f35e
SSDEEP 192:dONu61kcWQmiUydonl8GX5Obd+jTjzorykX3EjJQqxU6:dONu6W7C4l8GX5od+H8ykXsDU6
TLSH
T19612FA32B528BC6B4DD3B595B48B32139EE55167EB847F90D2EC2B2C01DF65C630AC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79fc33f6-6872-4406-82a8-bcc91b147e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79fc33f6-6872-4406-82a8-bcc91b147e61.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 18eabadd396e3736fc017460dc2af1bb976ee761c6d6213e96253c03687d38be
MD5 0ddaebd57ff10e54f10842c2f82c1b50
SHA1 d6a8634af71085d0ba1275d680faafccaec49633
SHA512 20e13704021bb024ee8b1a338c3eef3bd916783e401ef528dab571103ad4f79379cafcebd381768dee03db3cb7155cf9a5d09693f3f24d500fdd751d4f1a9c35
TLSH
T1D3412A5DA6F91048B3B36F5A9BF7A9AE487AB8772E06D55E00100E4E0A63B40D861733
MD5 SHA1 SHA512 TLSH

Submit Download