hxxp://cdnorigin[.]net

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cdnorigin.net
Sample260824-lytjlseq3s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320390206235835"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BAA1877C-23D8-45FE-B792-A198440C41E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
460	msedge.exe
460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3360	1980	msedge.exe	86
PID 1980 wrote to memory of 4216	1980	msedge.exe	87
PID 1980 wrote to memory of 2132	1980	msedge.exe	88
PID 1980 wrote to memory of 2132	1980	msedge.exe	88
PID 1980 wrote to memory of 2132	1980	msedge.exe	88
PID 1980 wrote to memory of 1464	1980	msedge.exe	89
PID 1980 wrote to memory of 1464	1980	msedge.exe	89
PID 1980 wrote to memory of 2512	1980	msedge.exe	90
PID 1980 wrote to memory of 2512	1980	msedge.exe	90
PID 1980 wrote to memory of 2512	1980	msedge.exe	90
PID 1980 wrote to memory of 2636	1980	msedge.exe	91
PID 1980 wrote to memory of 2636	1980	msedge.exe	91
PID 1980 wrote to memory of 2636	1980	msedge.exe	91
PID 1980 wrote to memory of 4480	1980	msedge.exe	93
PID 1980 wrote to memory of 4716	1980	msedge.exe	94
PID 1980 wrote to memory of 4480	1980	msedge.exe	93
PID 1980 wrote to memory of 4480	1980	msedge.exe	93
PID 1980 wrote to memory of 4716	1980	msedge.exe	94
PID 1980 wrote to memory of 4716	1980	msedge.exe	94
PID 1980 wrote to memory of 364	1980	msedge.exe	97
PID 1980 wrote to memory of 364	1980	msedge.exe	97
PID 1980 wrote to memory of 364	1980	msedge.exe	97
PID 1980 wrote to memory of 600	1980	msedge.exe	99
PID 1980 wrote to memory of 4592	1980	msedge.exe	100
PID 1980 wrote to memory of 600	1980	msedge.exe	99
PID 1980 wrote to memory of 4592	1980	msedge.exe	100
PID 1980 wrote to memory of 1992	1980	msedge.exe	102
PID 1980 wrote to memory of 460	1980	msedge.exe	113
PID 1980 wrote to memory of 3004	1980	msedge.exe	114
PID 1980 wrote to memory of 1128	1980	msedge.exe	115
PID 1980 wrote to memory of 2104	1980	msedge.exe	117
PID 1980 wrote to memory of 2104	1980	msedge.exe	117
PID 1980 wrote to memory of 3084	1980	msedge.exe	118
PID 1980 wrote to memory of 3084	1980	msedge.exe	118
PID 1980 wrote to memory of 460	1980	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cdnorigin.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,5987142832004654704,15037486687034175853,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,12217972683265261417,2910390104640845257,262144 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,13319222028150722862,12901385636793559112,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12730378366550957506,17161287655802397134,2097152 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3630028361336114107,3347178854404319223,2097152 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11995523341992173593,938872103561410185,2097152 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,3248944984346191522,10045529206123292105,2097152 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,2977704718043541317,8125379987693834783,2097152 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,2044227478362071679,6326142417080481430,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,13330240120988091339,17137327476806103085,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,16400195201618910592,792238365600917772,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,16400195201618910592,792238365600917772,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,8551113999014102799,2254740402743274854,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,12375342837172783290,3821814720858691315,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,5521736850175213111,3925709215748056974,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,8268560092224845121,1614218641625441053,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,10875140760175389228,9046088309243857303,524288 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,10679299857877964575,4469818449694005430,262144 --field-trial-handle=2084,i,14128488689098368986,10633578556542514012,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32df39c4-741f-4351-866a-ddef445d35a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32df39c4-741f-4351-866a-ddef445d35a6.tmp
Size 18KB
SHA256 1067d34478764efc9b15a3e6078a67740ca2b4f4128e5f85397a224e3d94435c
MD5 927760a6b65365b15cd9ac62e6b51540
SHA1 0cde486d490dbbd423efc7044684479f79ffaab7
SHA512 c79e0ceece15658abfbd5b5b223d7904332fc5536fa69da7ebf616b6cc0570057df923200d50d8818c63d4b989714363d00b5603030d9f41494aa0897a012e1a
SSDEEP 192:uHm+xasuheOwQxMGsNQ/QqAZEL7QmiU1FBv4H/+jVfO1SYoQIe95cFTOq+vt4/tL:9ZcIhsNQ/DhhxAf+9OMYDMFqviv9uYoM
TLSH
T1E4827C315C78AC775DE2E245F5873A135FB88027D6D96F8495ECAB2C00DDBEC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 97b832753d68ad9372a46212613981f0a0a02a921cab7cea0f43b48b1395a7ae
MD5 12f5ad61a8c297c919835b4e5663fe2f
SHA1 210ad1e8c6b1402f870d7d56314dd7eb34df1972
SHA512 6820a88100f347199a159823b7c5f3203bcae44ebe372e092c76c8f72343504f00a139a54d5726eb439f9f12f639f468bd439260a6957a6769d67a86d7035ec9
TLSH
T1DB51926D03456883E330B630C4E92351B432ABFE08174E5983E0AE7FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be4a.TMP
Size 2KB
SHA256 b636177119f737eb5dae5e2669a8e293d19fb1c853c29ae81cf2f6cbe88275a2
MD5 3a7161f6ae6365c3736554839c6fb03b
SHA1 168a8b74c306650c232e01a47f107fd021572b23
SHA512 00198e486ee4d8f8a968bb63904b06a83346b45d107d3267d7cbbff33bac6a4c818585b4c78fab26851065cf0d66b157838eec6164bd0988eb6366d94a653534
TLSH
T18251926D03456883E331B630C4E91311B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c3f59bd686a67b1b765869937583c125a128159ba4e904fe5c00404e6432f0d5
MD5 72c21997fc8b8a9eb30b280ba4eb3b69
SHA1 3dc7e144f04b1af21c1f79cf235299432390ca85
SHA512 670d0544d9af438cad73578ffdcd2228425c589b3908729ac3115fa9ce4097417390ccb09336633483be698759d8e06d644e02614085310869f3ae75ec6c4253
TLSH
T1E6317BB2C2D5C66ECE1556F09B14AE2BCD1C0A1942583C1ACDE5EF5BE3E3472E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3c96f94e28765aaf3ca8a227b74a314fda0c475d8c2c7fb4b584a0f605e0e7ac
MD5 6d5f7f24df45f30b318f23f11850a7ad
SHA1 fd46cb325cc51ed5167445b20cb29559e80804eb
SHA512 3f0048f71d9c291907b4bd33971d9c190891838aaaa27e648459d77da2ae12fb47ce141bf053b0bcb5e5fe9cff0fbe03c57b3d65ea2e9b8626c1e58e84b5c14f
SSDEEP 192:sxZERek5/fbszaZccIdpf1yHW6+WN563IGZ/YwtVGcIg5IJ:sxZED5/fbszaKF9yHb5M//5K
TLSH
T11232B6166E38AD7B8CCBD209BA55BF53E7F9403291911E48A6FCC61C05E6BDD224B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a5ab727407e42856fab56b639b12c6ce8138909f09ecd20fd75409c1ca9b4c20
MD5 06d6bcf6823e2a2e7686cb0e38cff6ea
SHA1 1ce58ebdb4f50d37a2b33331ae68fc4e20879cb7
SHA512 c8acf4ec81d1ed83d3af90361fdf34518a7ee508cef3170e24d8eabf269f5bcd9e6afb8280c3ac9114604b4692804dbe14d2f4224b6cdc92efb8ee624c33b3ea
SSDEEP 192:sxZERek5/fbszaZjcIdpf1yHW6+WN563IGZ/YwIpGcIg5iJ:sxZED5/fbszaFF9yHb5M//Ow
TLSH
T15322C6166E38A97B8CCBD209BB55BF53D7F9403291911E48A6FCC61C09E6BDD224B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 db5c4f0808940922772e07b7f2880fe8ad68b7e3dead40c5d802001fc87a4180
MD5 c621b6334a82fbcfe3b191f9923d56af
SHA1 1cbff333a6cbf5c807a276668c0845692b106f6f
SHA512 be5a2a21c2a1fcc12f24d88e9f1606f2fdbd288dfb96052cd6289da3d49760b55bcdeb261294a48f34e7d121f0e34baad19918524f15a76882608026cfa81a2c
SSDEEP 192:sxZERek5/fbsAaZjcIdpf1yHW6+WN563IGZ/YwIpGcIgrJ:sxZED5/fbsAaFF9yHb5M//O9
TLSH
T14022C7166E38A97B8CCBD209BB15BF53D6F9403291951E48E6FCC61C09E6BDD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 28c7c4a7e44cb19201de5035c58e1bbbc4be00fff2703a83aedf9df6b15add5c
MD5 aa6adbd740dd2068d82c9b60adaf9e20
SHA1 77069a4f100b4b63870fec54539c5271aa31e5dd
SHA512 11ca4f154743d7706fbc4760b96b40c2abde8061298b08538d0ce611de58797e43dc2a70fb2ebbb1d267e0d22fdc79f34831577c33a19566b4c9dbf2f3244865
SSDEEP 768:QImjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DzrofyB7a4:QImjYDmWvmKyEu1jakPLZQDAiP
TLSH
T1ECC2F93B244CCF7E4F841A9DDC5A6F972EA802C76B588D4047FA994C02C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e2b4f5aa04aaa3852c9965a35569d7f1593632610a25fe22c096f118dc0c1a1b
MD5 3b2151dd18db702f8916398bc34522f2
SHA1 687539294c4ed65ed7829d3a8fa003a64d92c819
SHA512 8f1bd870306f10c3d59dd90665d629db91bc2e23747c0f4914c170f0aca2a71196ce69a3b8f2b2c95d66789fa22fe9b3555f33caff44fb087af97ba3c95c4b98
SSDEEP 48:K2hctBzTDy17eBIkxyKH3fnybxiqWPB7yZQIbKhqMV8IjKVic/yr:KEG0KXqSqQ4Khq+8QKVi2c
TLSH
T17191F44530F782412D7E7B0C95A1CA6ADA81B263301CE52B3FAD51B60E67E118EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595c5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595c5f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e0283b585f44417fc1deeb2dccd868808d7b8d39eb82e5a96599e038711ab54a
MD5 a64fef3ce499c1886e2cce48bc5fa6a2
SHA1 55794a11d2b7f07f35e4242120696b3a736df796
SHA512 b09f5a9dde65f08391772fffdabeb3dc6534593616a8753b4e6ccc8737e0f5f39c40452939769eb05c1deb302b14d4ad32297ea88ab19b179e2db1abba4eb266
SSDEEP 384:niFiZcISsNQ8TUNTUlIlGDhhiAf+9OMYDOFqviv9uYoM:iFQSZwgwWooO7AciluYX
TLSH
T114C22BF248D78836D9AD9747E77E2D134EBCC017B595AA80B39C5A1CCC996BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d7f142ba56098cae27333328acc109733a6e6b51b6769372624768e4499304b5
MD5 8f7ae9bccfb2069fce22bc1283cacf1e
SHA1 ec15bfd64182ef7eb347ff539bf2846e682dc672
SHA512 f2ce2f8a4a8497a83145ce1ecb7212211f155f751689e0f13048c85db64fc1ba76a5ee5ad50e3af99ae56d4d103f3458e3804ba414cdc0302523c447dfe9b931
SSDEEP 192:unm+xasuheOwQxMGsNQGQqAZEL7QmiU1FBv4H/+jVfO1SYoQIe95cFTOq+vt4/tL:dZcIhsNQGDhhxAf+9OMYDMFqviv9uYoM
TLSH
T115826C715C78AC775DE2E245F5873A139FB88027D6D96F8495ECAB2C00DDBAC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c5913983e4703500021b246f32a0399cbaad992941fb78df8878df95e42361f
MD5 d0dd857ed61cf68b6d5c5849c4249d8b
SHA1 1d709709de345711907128a1e4e1b899f86034e8
SHA512 846dd26aa742acfe2045bf1a41beb27e19fd68e89bf17398c3e67c441d45783529cf420c4fed4ccf2e4a5578c1aedeb61ffd34ebea3a32eba2cae15c3d3acde3
SSDEEP 192:EOND6hZ0QmiUyxxpc/+jVfO1SYo25wOZiJL0U6:EOND6ocpu+9OMY42k0U6
TLSH
T14A02D93568686C778EE2AE45F48B37235FE4112BA9A56F84D6EC1F1D00D779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c6477100267701f7aeefc7ff0fa1b1e2dc5ed3de6fb90b6b79048df3d81604b
MD5 bac9fb25178112fc657710f5f17c4c4e
SHA1 ee1ba824680f5b931f347b028adf8b6dd562f6e7
SHA512 601c5a9638aecb23109d568252a5bf9917d4b5a5c80618a75183dfb73264126a909ed8a8f51767ed2d5d5e3a24e98b69c30aa01b9f2eea0630458b7f21f4d74b
SSDEEP 192:LONZ6hZmQmiUyKxgc/+jVfO1SYoQIe/5cOqOq+vU6:LONZ6u1gu+9OMYD+9qvU6
TLSH
T18D12F9356868AC375DE2A555F48736138FE4422BEA957FC4E5EC3F1C00DF6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9d24d51e9526d12129279178b88e27e8deecefdfa89a1f365a585cb609506c86
MD5 ddb17573bfef35138b3f70ed7ae67d4c
SHA1 c7b2d2e16362e3a5482fcc3eca13b999c1c38943
SHA512 824b2425be8452c0c78921905cb8fc3f3ca0d5dad141798a427803e22a8ac806309beb4aae9e9799152ccc53b7227ab889486eb15bcf7e9d030dca610298b711
TLSH
T1AE41195CAAE91158B3B77E5A9BF6B86E447E79372E0AD49D00010E4F0A63F40C971737
MD5 SHA1 SHA512 TLSH

Submit Download