hxxps://finanzas[.]live/mx

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://finanzas.live/mx
Sample260803-wgh2navcle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302532191340472"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{8577C806-D95C-40CB-AA6C-6B4E1F76DED1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3360	1980	msedge.exe	86
PID 1980 wrote to memory of 2020	1980	msedge.exe	87
PID 1980 wrote to memory of 3444	1980	msedge.exe	88
PID 1980 wrote to memory of 3444	1980	msedge.exe	88
PID 1980 wrote to memory of 3444	1980	msedge.exe	88
PID 1980 wrote to memory of 5020	1980	msedge.exe	89
PID 1980 wrote to memory of 5020	1980	msedge.exe	89
PID 1980 wrote to memory of 2668	1980	msedge.exe	90
PID 1980 wrote to memory of 3468	1980	msedge.exe	91
PID 1980 wrote to memory of 2668	1980	msedge.exe	90
PID 1980 wrote to memory of 2668	1980	msedge.exe	90
PID 1980 wrote to memory of 3468	1980	msedge.exe	91
PID 1980 wrote to memory of 3468	1980	msedge.exe	91
PID 1980 wrote to memory of 3464	1980	msedge.exe	93
PID 1980 wrote to memory of 2780	1980	msedge.exe	94
PID 1980 wrote to memory of 3464	1980	msedge.exe	93
PID 1980 wrote to memory of 3464	1980	msedge.exe	93
PID 1980 wrote to memory of 2780	1980	msedge.exe	94
PID 1980 wrote to memory of 2780	1980	msedge.exe	94
PID 1980 wrote to memory of 1080	1980	msedge.exe	98
PID 1980 wrote to memory of 4420	1980	msedge.exe	99
PID 1980 wrote to memory of 1080	1980	msedge.exe	98
PID 1980 wrote to memory of 4420	1980	msedge.exe	99
PID 1980 wrote to memory of 4376	1980	msedge.exe	103
PID 1980 wrote to memory of 4692	1980	msedge.exe	111
PID 1980 wrote to memory of 3804	1980	msedge.exe	112
PID 1980 wrote to memory of 5024	1980	msedge.exe	113
PID 1980 wrote to memory of 1136	1980	msedge.exe	114
PID 1980 wrote to memory of 1136	1980	msedge.exe	114
PID 1980 wrote to memory of 3044	1980	msedge.exe	115
PID 1980 wrote to memory of 3044	1980	msedge.exe	115
PID 1980 wrote to memory of 4588	1980	msedge.exe	116
PID 1980 wrote to memory of 4588	1980	msedge.exe	116
PID 1980 wrote to memory of 1996	1980	msedge.exe	118
PID 1980 wrote to memory of 1996	1980	msedge.exe	118
PID 1980 wrote to memory of 4704	1980	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://finanzas.live/mx
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,13933222738314184638,14896963735289487284,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,1427537554104805372,11063811625537342811,262144 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,2778814979727610726,10623519078108769102,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16389149233808993178,13986832402195565443,2097152 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,667491132800172095,13023498495487213670,2097152 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4949153187095398214,13400720905772655170,2097152 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12699468361005100254,12708946079607364131,2097152 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,9292736595714545563,16436384124907325280,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8816366124633050645,5357636749615001844,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,8139311496471152971,11966714268393976750,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,8139311496471152971,11966714268393976750,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3901556511608201649,1349693556741667298,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,8368831978257309668,793252474296188298,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,14698878425921773951,13269652250315493070,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6758087006841627673,11172013652715185849,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,6175286718227883954,12633446550903782778,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,11524940801401689425,10423515301528365736,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5120744339515264330,867846227193306176,524288 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5036,i,132130835617331843,11519380897503662294,262144 --field-trial-handle=2272,i,6174931280603005517,10786711458185974475,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 22fe45662a5bb20524c37957e221998635cee1ee67e6eb61e56445034782f7c6
MD5 5c3720f03852becb2742653f98f5e992
SHA1 43ea67d88b797e1cc0d0eb3b0d7222c5bc0421c1
SHA512 693f53038590f124b1f7313a25af83087b67e056b36f13066dbb950982a9ab29269632f3ff423ba1edb52b88b02328ae00212681a4020e857c39c15c0cbaea88
TLSH
T1A5E020D915C5C21EFF12648792B4738C82C03A1BA6C8A90D1B18C445740244076F69E4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75cc7d68035ae3d5c0b30a7748cb43fdfaca171f8c29a855bf774cda7a73ba79
MD5 b1edc76345be987f61aad54dfc7f22e0
SHA1 e2d33ad950e55e9a7b9ceeb58adb2ab400e0237f
SHA512 18a1b74c76e76a5f5b4c4cd9044bc677453fa76440ff4a9fc392326b17080d6d785553df13903bc1444a09c918feb23f6e30390363feb4db5276a8845808a55c
TLSH
T18351606D02452882E330B630D4E91311B432ABFE09174E5983E09E3FE62F7E5894749C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c791.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c791.TMP
Size 2KB
SHA256 3dafb9406904c2614efd627b19c788a96ce793e6cfc3fd0af9063eaa90f25ca2
MD5 812c0bcba0336ba9b3b315b5ee370f79
SHA1 66d2e26ab9b5f9c2f1c8b84c192c94cfd1ee6c5c
SHA512 7facfd27e030be484e6123f14a0370240695e898fa45f568b26270f51b955ce4f3bafb5ee3f78d05afec3acc81efec92949fa7e494b26544c9db6efce1a9dc72
TLSH
T13951816E03456883E331B630D4E91301B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fdad51f125457b3d3c3fa8a789224ebe2378f06fe86fb8af0c5a33cc9191fa2b
MD5 eb42ac201badd5bcbd7f3e7261801f5d
SHA1 33fab561109f01edd57d8c0ce28f28866b397e84
SHA512 043e7c5221be97c967172b65634863a53a6d227a2996119fc0b2e96697df913bed119c83d8cd12350970015442da60b4640abef2dcb7c9df7e6f42e517d7ea2e
TLSH
T154519AB683F4866ED90156F09A046E2FCE5E051A52583D3A8ED8EF5B93E2471E102A0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c5db47c9e9f1e747a29e2a7a27a70b51e32336d2330fa6a6704554864a2929f4
MD5 828ac4a7f48ec1f0b9c40825b1817c13
SHA1 8f503c1f1f89a0fed2a2c4c1d079f141d84c0bb9
SHA512 445188888806a863693696d3cc532347273d99e0a778f84c022b274555e7a5c2e35e43adcfb1b84a2d1a82f781fdc93b06ba0a3c2ec77cc8379c05a3d587086c
TLSH
T13B417BB7C7F48A5EC90157F05A186E2FCE5E091A42183D2ACDD8EF5B93E2471E102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c7d04e2b10ef1c0d41f92a4298065d380315daf16b03b4536e4dc65326d05d62
MD5 6dac5a39f79a0a420e70a041a625ddb7
SHA1 b739f1339d0d5d4df9302c4272c3a1cc1e7cda61
SHA512 75284ff8c3ee8a773b8f2e9845e6011ceb4f19400ed27298a8cf17edf70cd3836b0bf8c668a0c22c371b3476ba4991a49d5b3012a879c46fb166e48bd7dcbea8
SSDEEP 192:sxZlRGkp/fWswrXl4IdpPbHW6+WNE8p/YwgX6hIgrJ:sxZlbp/fWswrXlJTHbV/h9
TLSH
T18722D9126E78A97B4CC7D20DBB25BF13D6F9403295D01E58EAFC9A1C05E6ADD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0dda8d853735d9fcc5acec0e49b7308f30e03dbcaf7e497261ff0c79349224da
MD5 249a64e9a772e2ccabb5fa9935427df7
SHA1 06d05ed6d3dff9995b259a7f1d5d18206cd4d583
SHA512 395fbce4e22eb4663ea7b586bf2e09ff8b4bc444f2388c5bc82f4e4bfcfa8bd0f0284abe68bd9251903637beb93e35ecbe207f7d5c563334196fdf6d35021123
SSDEEP 192:sxZlRNkp/fWsRrQl4IdpJbHW6+WNE2dXYwyMIhIg50J:sxZlkp/fWsRrQlJBHbrX8i
TLSH
T1EA32C8126A78697B8CC7D209BB15BF53E2FA403251D01F58EAFC9A1C05E7ADD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 08109d561901af05789961d0dc4aac37013c7c8d16dfceda28c4641917b59828
MD5 3cdf8a4a088fc12a1d4291374c2bbff0
SHA1 b352a3821c5b8c3c2c2f8318806f8fb7b2167edc
SHA512 e37f049d7ad43405ec4219a12474cbc5e54e4deca84275bce519a646c3ccb4f6923295ddcea510ff8a2966b441b1a5cd325d27d003a75d494843eb53153dd425
SSDEEP 192:sxZlRGkp/fWsRrQl4IdpPbHW6+WNE8p/YwMX6hIg50J:sxZlbp/fWsRrQlJTHbV/fi
TLSH
T1EE32C9126E78A9774CC7E209BB15BF13D2F5403291D11F58E6FC9A1C05E6ACD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4744f3cbc29414656fbb49ffba4a601b9015459ad04b4bb63beced2febc3118f
MD5 3b8ebf1390bbc531d09ea22287a0bd9b
SHA1 f5476e109cf528172125e81e9950381a5c5faea0
SHA512 20b7922eefc9fc766a40ff8266d067f68a5747ac3005a215b2a1ae41763873af551e16bff0503589547885bc3ba765068af65b56121c536004e3ffcf781ffb75
SSDEEP 192:sxZlRGkp/fWsRrXl4IdpPbHW6+WNE8p/YwgX6hIg5eJ:sxZlbp/fWsRrXlJTHbV/h4
TLSH
T19F22D9126E78A97B4CCBD209BB15FB53D6F9403291D01E58EAFC9A1C05E6ADD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 36a7c8c0190ac0777c1c442c409697937692eb5f92b03aa30f5d7ef2a1e31e98
MD5 d8acd4317c47cc3560d09a2574bd0178
SHA1 38a94d979dad23fc25eabba10c80bfb9bdbc4ca0
SHA512 741b4a4116732d8ab9c1a1ad99d7d24c07a5c803aace98a8aa6cf34426e8c94ed66ca4b8c6d1daa2205a96f481ddc7856725d3e8eaa1e8e56c255905a0a6aebc
SSDEEP 192:sxZlRNkp/fWsRrAl4IdpJbHW6+WNEucZYw+MIhIg50J:sxZlkp/fWsRrAlJBHbKZ8i
TLSH
T11932B8126E78693B8CC6D209BB19FF12E6F9403251D05E58EAFC9A1C05E6BDD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3b2063ee4ca8f8f23e1d925d4188a48c9fc0719c61d71933d50402d0a267891d
MD5 6ca8a4c8c296cae0382bdad8ec0f8d1b
SHA1 76e4321b508cde41b8c6c69629a42c540f642125
SHA512 9b75ffb9ebfe71434b95f8a4c9b7b8952da6e4c8fcf90a8f59e46da62413d0e1bc259354bdeb95b46b90ea4314ba3c3a5c70eddfdadc57d439a2554ad914d491
SSDEEP 768:QsmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DProfJea3:QsmjYDmWvmKyEu1jakPLZQDcRR
TLSH
T1C1C2FA3B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4087FA954C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a121aa4d84c164657c68cc262d1bb3692d9d764d5bde9f9cc5f4f71b1565dae9
MD5 e3fc491f6699f27d793e9c0cda2f7187
SHA1 0fca6031686c657491441a7fe610ed826ba3ca56
SHA512 7055bfe2341e4825773e9613bb3f758039929a437210fbf885ea444fc3e6d335126fdb97196e54ac52397734c8a3861e5241ae1d4905a7cd4ccd3e1eac4349f9
SSDEEP 48:K2hctBzTDy17eBIkxyKH3fnybxiqWPB7yZQIbKhqMh5IFKCQ43yT:KEG0KXqSqQ4KhqC5uKCQCo
TLSH
T14D91594630BB42012D3F7B1E95A1DA56898279733469E93B7B9C41760E67E108EFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 73fef35e520c97a6ca199f733178b5cb4a556caa366d5c409f30d522fd738f78
MD5 c3e973a0a96c35a0cc363c362d8a63ff
SHA1 1e477b7fe768f92836aa13e977ac399970226ce2
SHA512 9060664bfd22d7c7e92d525f4ec026c74c632174bef1c2a8b2b91c48438419a5ecb8b5cbc164ee856a07c712824ab8786ec545d567c198621191462483de0263
SSDEEP 384:6ZcIhsN9Yy/ucDNbf+9OMYDuFB6HlytEDq1rKDo:4hG/XLoO7gBoy6DqNj
TLSH
T1DA928D3198B89C335DB6B505F44739038EF84127E6D42FD8E5ED6F2D04DA6AC130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a266c2bc86839130c6ae1916ba9389b583637aaefa8c56a28a4235d5df6d89c0
MD5 30b37ce3943a22b8321a6b3d77562fa6
SHA1 bcb109f94a6bba66916a923484a1fbf81ce8b0f5
SHA512 a299377115f5e1dcd61825a44b11e93f39bd488934f3d297e631cee2cca261c9e042d83779056d336d8729a635605c7a895c37540bba10271326d9e5e80f62d5
SSDEEP 384:bZcIhsN9Ly/ucDNbf+9OMYDuFB6HlytEDq1rKDo:Dhh/XLoO7gBoy6DqNj
TLSH
T110928D3198B89C335DA6B505F44739079EF84027E6D42FD8A5ED6F2D04DA6AC130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5451e9fcbb7516bbbc2755eea42a5aa9b866b19d50155c3e889e41dbc78b578b
MD5 ad25bd9f96ac3be0d3a4c8e9eb7f930c
SHA1 f91fc6d2710af21511286f2b5fb447c802ce5583
SHA512 b7a2fb003543c2be8521924a10acd71dd9f6bcdb2699d064b26af88b840ddfb50c8e39d999d341f51531cf765185e66f4f080a1763f530b9dc05e0e12a60ca17
SSDEEP 192:EOND6hZ0QmiUyU2pc/+jVfO1SYo25wOZjJL0U6:EOND6oipu+9OMY42d0U6
TLSH
T15902E93569686C778EE2AE46F48737235FE4112BA9956F84DAE81F1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ddc08953f237eeba0c0de6149d8c7ff767bb94575fc0b0e6017719d26eeb112c
MD5 daae2f9fc0d1b47eb9ee94380a905285
SHA1 6aa4da2e0e07ac10ec58c93431b67dc5f7f10407
SHA512 8abcd68ccb7fb9782fe36a99480876295e6d71bb865396fb3e5c850350eeb403a7414a97521a780f47a33dffd55aa7385c5dc3776716cede2b485c47dec527f0
SSDEEP 384:UEZcIk6zsN9Ly/ucDdbf+9OMYDqFB6HlytEDq1rKDo:Uibh/TLoO7cBoy6DqNj
TLSH
T144C208F158E75832C9AEA703A77E2D025EBCC023B6D42A94B3D96B1CCC8557FD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4377da033287a36a098be99fda66169001c2851b8f657ce2bfd2aecc6779a127
MD5 faaa4843072c2ed3578fcb86151a5991
SHA1 9b53d5354794448e0cb4fe43677c37d33226d888
SHA512 4b090cbfc84cfee835b05d2ccdceaa6f0f4ede8ea25d6e6ce6e7cdb86a3689cf4278a94479a3077a1d042e5e901794fc500a6174a1a8d5280cb320ffbcb885b0
SSDEEP 192:mONo6hZDQmiUyB25c/+jVfO1SYoQIe25cOqJqYU6:mONo6ph5u+9OMYD99BU6
TLSH
T1A412E9316968AC374DE2A955F48735139EE5422BEAC57FD4E5DC3F1C00DF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c5d8b0fbce51a3397354632ef118a43e4ba00dd1c7fe80e6a82f40d93ac8aaa8
MD5 09324aa65ee87044324b5e258755488a
SHA1 da5c9c034f0e87fd2ce99c90eb49922c9994105f
SHA512 2d487aa82e66e1bb3b0d780faa2a0ed22023f20d2e63497525adc3865f58172572091625d6a96022f1b88bb280da8b11b09ad729bff292c78c3649cf51028f11
TLSH
T1A2412D5CB6F9114CB377AE5A6BF6B56D487AB8772E46D45E00010D8F0672B40C9A2733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download