hxxps://rpc-mainnet[.]matic[.]quiknode[.]pro

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rpc-mainnet.matic.quiknode.pro
Sample260804-cxlypsbe86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302840981392694"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{3D6484CA-AD38-420A-8EF0-D4D83998CDB1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3396	4108	msedge.exe	85
PID 4108 wrote to memory of 1068	4108	msedge.exe	86
PID 4108 wrote to memory of 1424	4108	msedge.exe	87
PID 4108 wrote to memory of 1424	4108	msedge.exe	87
PID 4108 wrote to memory of 1424	4108	msedge.exe	87
PID 4108 wrote to memory of 4856	4108	msedge.exe	88
PID 4108 wrote to memory of 4856	4108	msedge.exe	88
PID 4108 wrote to memory of 4524	4108	msedge.exe	89
PID 4108 wrote to memory of 4524	4108	msedge.exe	89
PID 4108 wrote to memory of 4524	4108	msedge.exe	89
PID 4108 wrote to memory of 2920	4108	msedge.exe	90
PID 4108 wrote to memory of 2920	4108	msedge.exe	90
PID 4108 wrote to memory of 2920	4108	msedge.exe	90
PID 4108 wrote to memory of 3964	4108	msedge.exe	91
PID 4108 wrote to memory of 4560	4108	msedge.exe	92
PID 4108 wrote to memory of 3964	4108	msedge.exe	91
PID 4108 wrote to memory of 3964	4108	msedge.exe	91
PID 4108 wrote to memory of 4560	4108	msedge.exe	92
PID 4108 wrote to memory of 4560	4108	msedge.exe	92
PID 4108 wrote to memory of 2964	4108	msedge.exe	97
PID 4108 wrote to memory of 2964	4108	msedge.exe	97
PID 4108 wrote to memory of 1688	4108	msedge.exe	98
PID 4108 wrote to memory of 1688	4108	msedge.exe	98
PID 4108 wrote to memory of 4260	4108	msedge.exe	100
PID 4108 wrote to memory of 3440	4108	msedge.exe	111
PID 4108 wrote to memory of 3012	4108	msedge.exe	112
PID 4108 wrote to memory of 2776	4108	msedge.exe	113
PID 4108 wrote to memory of 2332	4108	msedge.exe	114
PID 4108 wrote to memory of 2332	4108	msedge.exe	114
PID 4108 wrote to memory of 3804	4108	msedge.exe	120
PID 4108 wrote to memory of 3804	4108	msedge.exe	120
PID 4108 wrote to memory of 4680	4108	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rpc-mainnet.matic.quiknode.pro
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffcf538c188,0x7ffcf538c194,0x7ffcf538c1a0
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,4432917426668871770,2130345070908606705,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9424404740280509035,16376058036957197570,262144 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,18352002400799727979,8291242070827274983,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,128564867857591192,11614077636168431863,2097152 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17550962384686360312,3484774653746703446,2097152 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8660328509921395712,12966698167133090127,2097152 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,7235628545936479983,4892886741175678198,2097152 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,9454128817461023506,16886847400804696177,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,4959522460635238399,17273637734830221480,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,16984499256860342638,5820659425487987265,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,16984499256860342638,5820659425487987265,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,16180487114898130598,17177906206903793405,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12526167405166981049,11976203705938715004,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,7971491023271666661,4883130706977141640,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,12716453752480587123,16082591353057056222,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17767128770524599592,802355299545486531,524288 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,5300918404422722184,12736412766081187831,262144 --field-trial-handle=2288,i,12630627946048214381,4005990560654916000,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2f2eff37d071f1e585f43dcdb17fe90a8aef5deaacda13b9ee87e0b1ec597fd
MD5 4cf3e12b082543d478ca37d8cf8ae6d8
SHA1 2046677013d85affc65c2fb8dda7266c5f006e26
SHA512 ed846b6187a77ce1ae5e46e3c120a5ab28c6fd0acb87c48e254995b2878541d00490af681a1bb3785f437e773b75a86a897309b64f2dca4dfca2b393c542fa43
TLSH
T14E81A7380E6F00B5F3B11FF2B3D14B44347E82EBF993BD9A62816A70790A761B2C9405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589d35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589d35.TMP
Size 3KB
SHA256 412638dd5ef1333de41474b72eea839dfbc62d5b4858c6fe0c7b14296e7c4727
MD5 b5109eac0506935378fcbb6f0d373174
SHA1 ca2417374be8c4c27f6f9ab74199a3c0eeb33e5f
SHA512 e1c911d3df34dcc9b808098c838012a23c31d2bb2cdaa7fa167eacdada04c8b672105c6c9ab7e462b15f9e84441304c172fc14d0869aa9f798fd24f30ff8d514
TLSH
T17981A7380E6F00B5F3B11FF2B3D14B44347E82EBF993BD9A62816A70790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c077931772f8064aed2a06406f23006b11d63a63a048bd4712c7a0cb369b548a
MD5 0765d5b6932a065395677a4bc4f48bbf
SHA1 fb0fd93aca85046a88b467ef090fd071457489f3
SHA512 88c276d53d7976bedb25c1851cee65a20fcf01aa8817ab6f2658ee77a3a9a606676df90ff2160a9d225c920b37869d71631dc515dea0552e6d4903095c35c7ac
TLSH
T13E118BF3C7E5856E8A0156F0AA18AE2BCE1D0516421C7C2585D4FF2B93E3475E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 daae331e28a237101c66451c8cdc4cd34ba6c490b69f09a9399ef6cfc537ae61
MD5 92194807e962de3f5d0a3057862c2aec
SHA1 c484b4f5b52e227f752476013a108e47e268cf34
SHA512 1011c9574844c224ddb86492594ce35cdf2e9b16c7c4ebfb88da54b666c17d06c11d1c2e8eee7c08dd839a34b1a3aef5f1dee17ef57413eddbc03f227dfcad9c
SSDEEP 192:sxZ2R4yM/jK1Ml8UQGk9W/fTsNp9ApIdpNglslHW6+WNPH3p3/Yz9vFtIg5iJ:sxZ2Sqt9W/fTsNp9FXHbP1/o0
TLSH
T1365208166A345977CCDBD209FA45BF53D6F9147392900E44A9FCDA1C00E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 720cfdebf6d5dd73085abbd9536d8532ca4a5330f5be77b38c4b725baa906a45
MD5 dec2c208dbf579e8e3a60d1899ac0aad
SHA1 5dbe5cb7aca345ac0525a3651ef4d37f5d137f4a
SHA512 ce8d15b5a4e4d26db7c3d6702006faa5ae3ceb8f834766b52e998f9bc0787fc76d4dc8a70a9bf4236c21a6f0799637dc01a3c0a37a9549379d7d14ee5996cb05
SSDEEP 192:sxZ2R4yM/jK1Ml8Mk9W/fTs8pxApIdpfglslHW6+WNPH3p3/YzFsFtIgrJ:sxZ2SM9W/fTs8pxFpHbP1/19
TLSH
T1C342F7126A34A977CCDBD209FA55BB53D6F9157292900E44A9FCDA1C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 deec0fb85db115c6974986be2d5d7575f9446dd676f6369bf3fca8a3a8f6df5e
MD5 26bf5e0532ee516a12bbb3bf436e2f7e
SHA1 6d8e2d6edce05e0991704ce50118fcf22fb8c512
SHA512 5faa62bfc5bdd894aa5a3611089df677af498a75b69417c0358d6bf5835ab3d9b41f3ea85c79ccb4e325a40e250e9d3870704e75d90b6051122bf8c2581d1b2f
SSDEEP 768:LSW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjcroIiiPYI:LSW7kf0Wvqidau1jaa5LA3jHBI
TLSH
T1BED20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1c84238631e8c84a0d8d093162299d97c370a377ef3a9671fdb8ab44a2a1007
MD5 7d081b78a3540c18189f61b989503789
SHA1 70568cb7d99ced3ac96d9e908e9adb5567ff04e4
SHA512 7a78d1bf590d3c02eb7019d7d8cc5595ac44dd78d97eed1879811ba5841a3ba3f9ddf557e55f40b1e85d80256f3d620f09a471c93ba7ef82f80c007d86a65a0b
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcHAAKt3:sCFpf3
TLSH
T180914401703F160138BE290D9669CA365E42B297355468FF7BB910630EA7E114EFEDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593a40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593a40.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 de0d615d28edfd8123e20f5226a9f392778aea653d1b9f36d0461ff08902122e
MD5 1d3a478165d38d70b38ad7b577101db2
SHA1 1d004172f6e396ea2d463a4106a74a21acd7dde2
SHA512 aff01f10fef4d3d46bd22a7fe14cedee501570d45f8b1c8c72a0c99cf6839df50cdd1160d99b1c2a986e965be112fbe4ac06e65d56233a26a024187d5097c7fe
SSDEEP 384:NZcIhsNri76bt0j4IdEaACEJrvPVBeRs9JKgqijUla:Vhm6jlyhvtTjKgqmUla
TLSH
T1A4929D304875697BD9F6B581F4873B138FF8912BE7C06F94E1FCAF0C019AA98530A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54cd4572039e7ac1687d78f4d277983310eb4691985dac72c170650f40a75781
MD5 fc41b8dede15783da92734804e79e2f1
SHA1 3e2a02da36809a9922447ed56e4b8ac917c58cbe
SHA512 ecd8cfbce3f4b4580bdf0eeff3ffa1b8a4edfb1c8970a01568f5d011ab4ff3ff625b0890aec3ee02b18c7048051306ae0d26299cbc671ec68494efc183b2e065
SSDEEP 192:MON664BAQmiUyM1zW5GBPKXo+FdGJaraDMhLU6:MON66eAztWTdEaQyLU6
TLSH
T1C402E935AC797C7B9EB2AE45F58737175FD8113BAAC52B44EAE85B1C009764C230382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 56d968fc4c90f6acd89a09d068194d4e2a0e50d03d2654129e0403cd6c75522b
MD5 c9a509f2be392a2b59fc2051bcc60a20
SHA1 413a7504ee2affa14acedae25420f14e583d1786
SHA512 23751cb8a7d6087e4496bbe6ac20fa4a3d9ec663927d5f624ffb0ed572f32b5a9534eae634c263a86fd040c78cfb609b8dd5f29be87cbd65f396d6806e3e3585
SSDEEP 384:oiFiZcI4zsN18TUNTUlIli76btHj4IdEaACEJrEPVBeRs9JKgqijUla:zFQE4wgzhjlyhEtTjKgqmUla
TLSH
T163D24BF148D7953AD9AE6743E77E2E138EBCC027B5806A50B3D89A0CCC561BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a62fbcf9767915ad4e051e9e4b90338de32d093aecc114b0decd6533c56e9be6
MD5 6ff37d9d4610eaf3b89a83a90d939527
SHA1 afd07934e947042d0ecc908d7ff0ace75878d92b
SHA512 839ed97c94168073d6e4994e2c3afaaf16d44249fe59dfce305ea0ef6386cda6cb8e73de5b861c87cf664da2affd8e3f15185156b81543aee14d9664ffd00e5d
SSDEEP 192:qONW64BbQmiUyyzs5GBPKXo+FdGJaV6FC1SJrSWwbqjcVU6:qONW6eNvsTdEaACEJrwPVU6
TLSH
T112121B35A8A46C3B5EA2B541F48736139EE4423BEBC56F54E6EC6B1C01EF69C2306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5f283418573ea67ed7934ba8854cb5fc66596351ba0d1ca39d06253a4970df7d
MD5 bc7c76cbe2f64510ee28dfd70ca24a5f
SHA1 7bbda8d62d84b7b3d6470800f4f9c623aa355ef1
SHA512 2b7d5af34cc6b53836fdd87a19f7aa4308c85cca6a68f7808211a31b2074d94bc1f7f0b755c5a3cbccfda6fbcbb15c9425dbcdc550006d4f21c45a34d715daba
SSDEEP 384:eZcIhsNrj76bt0j4IdEaACEJrvPVBeRs9JKgqijUla:ch76jlyhvtTjKgqmUla
TLSH
T187928D3048756977D9F6B581F4873A138FF89127A7C06F94E1ECAF0C019AA98531A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a1d5ab37e23064522e90e3ab31e04b842f8fe3eed178297edcd25e5881e059c
MD5 43bf132d841f605170c4fa6518cb7729
SHA1 6c5fe939695ab81179f78251943dcc7bacb3cf04
SHA512 11e7695d98e62da28cc997f5a79b6280c01aa7924464186c82fc32af6bee87c29764af6a17b32d56a8037999217690f27265ad6f7cd70b147b9332c053fd3ab4
TLSH
T146412758A6E91108B3B77E56ABF7A46E487ABC372F0BD45D10110E8F0A62B40CE71737
MD5 SHA1 SHA512 TLSH

Submit Download