hxxps://7795266[.]app[.]netsuite[.]com/core/media/media[.]nl?id=4804943&c=7795266&h=A522I3nOR1pH4h0qzTdjAIWVO9FF8ZnO3fKFLrKZr1RUrmDX

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://7795266.app.netsuite.com/core/media/media.nl?id=4804943&c=7795266&h=A522I3nOR1pH4h0qzTdjAIWVO9FF8ZnO3fKFLrKZr1RUrmDX
Sample260815-ds2n2ayvfs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312374339134728"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{A657E795-4807-4B4B-BF12-F1586FF2A4CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1100	4800	msedge.exe	79
PID 4800 wrote to memory of 4624	4800	msedge.exe	80
PID 4800 wrote to memory of 3428	4800	msedge.exe	81
PID 4800 wrote to memory of 4624	4800	msedge.exe	80
PID 4800 wrote to memory of 4624	4800	msedge.exe	80
PID 4800 wrote to memory of 2960	4800	msedge.exe	82
PID 4800 wrote to memory of 2960	4800	msedge.exe	82
PID 4800 wrote to memory of 3112	4800	msedge.exe	83
PID 4800 wrote to memory of 3112	4800	msedge.exe	83
PID 4800 wrote to memory of 3112	4800	msedge.exe	83
PID 4800 wrote to memory of 3776	4800	msedge.exe	84
PID 4800 wrote to memory of 3776	4800	msedge.exe	84
PID 4800 wrote to memory of 3776	4800	msedge.exe	84
PID 4800 wrote to memory of 5084	4800	msedge.exe	86
PID 4800 wrote to memory of 3836	4800	msedge.exe	87
PID 4800 wrote to memory of 5084	4800	msedge.exe	86
PID 4800 wrote to memory of 5084	4800	msedge.exe	86
PID 4800 wrote to memory of 4676	4800	msedge.exe	88
PID 4800 wrote to memory of 3836	4800	msedge.exe	87
PID 4800 wrote to memory of 3836	4800	msedge.exe	87
PID 4800 wrote to memory of 4676	4800	msedge.exe	88
PID 4800 wrote to memory of 4676	4800	msedge.exe	88
PID 4800 wrote to memory of 948	4800	msedge.exe	89
PID 4800 wrote to memory of 948	4800	msedge.exe	89
PID 4800 wrote to memory of 948	4800	msedge.exe	89
PID 4800 wrote to memory of 736	4800	msedge.exe	92
PID 4800 wrote to memory of 3352	4800	msedge.exe	93
PID 4800 wrote to memory of 736	4800	msedge.exe	92
PID 4800 wrote to memory of 3352	4800	msedge.exe	93
PID 4800 wrote to memory of 5028	4800	msedge.exe	94
PID 4800 wrote to memory of 1520	4800	msedge.exe	96
PID 5028 wrote to memory of 5008	5028	msedge.exe	97
PID 4800 wrote to memory of 4288	4800	msedge.exe	98
PID 4800 wrote to memory of 2816	4800	msedge.exe	99
PID 4800 wrote to memory of 4852	4800	msedge.exe	100
PID 4800 wrote to memory of 3944	4800	msedge.exe	101
PID 4800 wrote to memory of 3944	4800	msedge.exe	101
PID 4800 wrote to memory of 4464	4800	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://7795266.app.netsuite.com/core/media/media.nl?id=4804943&c=7795266&h=A522I3nOR1pH4h0qzTdjAIWVO9FF8ZnO3fKFLrKZr1RUrmDX
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffa7ea7c188,0x7ffa7ea7c194,0x7ffa7ea7c1a0
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,1107659661209922803,15828309720061758584,262144 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,7819357690182135999,11408698402031443061,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,5040050642775807360,17611147968193978176,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13054959519646862730,12570779090223224362,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14897213839433435034,16398624439460151511,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16124088636159685402,10106314276541354022,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,5939296904098708777,13085657829219976605,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,9904019279544099450,6869240420672085018,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,15331294028322705175,18159785760793367408,2097152 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,14952068304314591365,15099942766196939994,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,12146218650503460907,13970203151407089053,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,15236380906939165485,7061603120320404498,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1685950088473335141,6806716049391453707,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,1685950088473335141,6806716049391453707,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,7564008775213319577,5348007452326809758,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16494050681324774295,5877626948432939770,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,13424304510674131624,5714705895554357813,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17503767419234515557,12607997486813332340,524288 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,7107266091403526765,14038154443007675775,262144 --field-trial-handle=2224,i,3853960700034471292,6058881829256047872,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e8edabe3cea2543420111b0508620c037c6568fc659403876af877c57e7371bc
MD5 4c489541483e88b1e77d6eb7a6b2b3ca
SHA1 8141447de0c4a126cc667b93c448899b277da067
SHA512 efcde0b42559b74982506865860ac163e675e105ffcb92116814fdc907ebf3eb05f62d83355d7f32db666c595ced2ff5daede34be4345e25be3f78c7b2d4fa3a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T1BBB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85e1408d2ed1ff001d9a78531b56064670b75432b6c7c88d7500437d45089286
MD5 36ac767919a1a999aa795cec24634b83
SHA1 6d3054fdf203352a0f908ef09d7a6f8885a14778
SHA512 14eb6184657d3dbd9771c21387a86e0af408e94e3a4dd47a14641262c15f9ae01f3b6e0adcf752ed744608745e533ff600b1723e4a600da07a0decf268d9bc38
TLSH
T1C8615C37CA92C8EFD3B2953994F30145BE3D849834734E5910A8F5B5E42AA27FC12C17
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5846f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5846f7.TMP
Size 3KB
SHA256 5f24d0080891a146c33d93123770c81fdc1518d88173ae4c4f7f7dddd92f319e
MD5 4fbd8b29246705152c90a5445746de59
SHA1 c9c8c5d399d4286c78f66ce60ce9c2e6b164e42c
SHA512 9aa47227001db81b15107c4ace32ca401ae9465bdcfdef2e350a61a88413ce0d9a4d4f313add45f3231f6016b698a2ac3683afa15daef675e1abfa3248a8164f
TLSH
T109617E37CA92C8EFD3B2943994F30145BE3D849834734E5910A8F4B5E42AA27FC12C17
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1787bbb703cdeb11a117974f615b0ccaaaa9844bcc657926235cfd9d34556eae
MD5 1819eed877fa4a0ebf376f22507b73f9
SHA1 7fe57ba189cd78a55b451b4a3396b8927b250d5f
SHA512 cb9c7db946519c29c36e54a850d3c26f14233c0400198315a5c9200484bd671ebf8f6edfdaa796d439096d2029d5cdd4f00fbe27790855c1d6fde66b42f92977
TLSH
T1FC11DAF383E4856E8D1126F0AA14AE2BCE2D0505831C7C298AD4EF2BD7E3076E00259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 513ab9633fa112dbc83dd1e05b9d729b384a69c5089535de29c4edb9db3828d7
MD5 b07e7d1970f402c3aa1cbc4ce1e2ff96
SHA1 4d9849185178a5b9a6f55529f3fc41284793a9c9
SHA512 f9136f5104ea73a8c68f3d53372a65c7934bb4120f09fa9cf8f63cb6d7255c08dc2b30c9137397737898e4bafda985557753037a46ce0a97713b4771ec86de8b
SSDEEP 192:sxZwRfyM/jK1Ml8UQHF8/f4sdiNEsIdpaR/W6+WN1ov/Y01LZMtIg5mJ:sxZwpql8/f4sdiNE12/bG/5O4
TLSH
T18252D812AA385977CCDBE209F941BF93D7F9447292900E44A9FCDA1C00E6ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f8f1751273c6fd2fb437a95a8cd7580b3104731dbe1070494a369b17fb12144
MD5 693fe75b9e761dd314bfee618ffa1e0b
SHA1 6e16d747eb34f3e77513f53716c1cea56bcaad21
SHA512 74613774e5a6c612d015f2174369748d6ae2e14d93d5e2caa01f76e45a1e06d1ded60f662b9e35fc6f60369b9cc4390054bc546710e5d3cd58c55ef56aebd436
SSDEEP 192:sxZwRfyM/jK1Ml8MF8/f4s7IEsIdp8R/W6+WN1ov/Y01zkttIgrJ:sxZwpd8/f4s7IE1M/bG/5g9
TLSH
T17E52E8126A38A977CCDBD209F955BF93D6F9047292900E44A9FCDA1C04E6AED2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 211dc42ef5d15a189370d3455a3dcdd7d3b373c842cb5d10c3b7973b973eb174
MD5 a180c286c9acdd977054cccadde8526b
SHA1 ee9905811a13ada376a585f5bd933694fa2c2b8c
SHA512 1bf827b745b9ec47f5e61360f9d181963cf7be630a2c39a69dd17ec5a295b2dc7d854588a1ea88f242446136eee87575c7a843ccf53a0845a9dd001f76ca5138
SSDEEP 768:CL4bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4J:Ccu+68si2y1WRmlzQqju1jaKDILpZ8Uw
TLSH
T13BE22A3B280CCB7E4F844E5CEC26AF966ED802CB66684D5447FE494C03C76EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d6588c0edbe05d81fab8b9f4fcc533956bde9f5dd2c2cd60541621ca3962a829
MD5 c300d6d88898c513af12cf619480da2e
SHA1 d21bc9391ad3c3790c881094ef86577122f6ec12
SHA512 2420c58a3170a8fbe869eb3494377f3ea7b03c5642779464ef93ac454ba2b0ebf716c295a0c362c800b7b1078dda1d1e2104adeea1dd3652a5480107a6908d6a
SSDEEP 48:K8SI/KLq8DyZmI3K7aYby5GI/KrCgzchK2sm8:K8SIKLqaam0K7a2KGcKrCAchK2sm8
TLSH
T11591399272B646013C7D291C92648B275E437AA7302CA82F776858B10F6BE647FFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6398f88-d0c9-42b2-b609-2a74c562ae17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b6398f88-d0c9-42b2-b609-2a74c562ae17.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9e9cd3ff594b64c849365e2b2c0f58194c32cf38c8f2edc6f42ec0a730f70b08
MD5 93992c4fc0fd981aa48ee512674b1753
SHA1 4420d45318fbb38c37e4035e06f2f88d9512b118
SHA512 15506b8758104c15d0eadd862b7a5b867801d5200d9ee190fdcc8a4f7a11e71bc961f0d1a1e3e5cc7e247502299319c2f55bb798cd390d1e05fba5f7d608e1ab
SSDEEP 384:WHiFiZcIW8NZ8TUNTUlIl91K8z+r3b+AC8YbXE28beOOPrXLpe8C/m:WCFQWMwg1SrpGE2DOi9Pl
TLSH
T1DAD23BF258D75876EDAD9B47A77D2E034EBCC067B5946684B7D8960CCC8607FC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e8a76f523e7b278072b80a7a2bc92e919f13dfdc12e1365677e59075a2c1d92c
MD5 78941490883a05fa2c75e68cbd243b93
SHA1 437c811cb004a34708e4139a6422abae65c85a9e
SHA512 8a08792abeafc86f994d870948ccf841b395b31185d8bf1c3b05f0b1a093ffbe754ad6104043edc93a109e0dc82f103d87ecc42f43a832dad39aae3ffe8eccc8
SSDEEP 384:LZcIh8NH91K82+r3b+AC8YbXEn8beOOPrXLpe8C/m:ThTSrpGEnDOi9Pl
TLSH
T15C927C7268B86C676DF6B944F44632039FF84067F6D43BC4A6ECDB1D05CA56D030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 06caeb947b46c33ed1f1284429c10f595ad6846a93e78bc763b61b8aba6a1d31
MD5 d5149af882a0ca60da0959323942a7d3
SHA1 cd8e32be8f2f0d67b272750f003cbf8008b749cc
SHA512 cc2fe4dcf1ab8493321e80c86841576a0b06a2b9b6e1d425d566e55038bb7333d090fed1ac503f67e3e578c1e78c21cfacecf24054a9bf9d3694ca5452ebe994
SSDEEP 384:2ZcIh8NHe1K82+r3b+AC8YbXEn8beOOPrXLpe8C/m:khoSrpGEnDOi9Pl
TLSH
T17B927C7268B86C676DF6A944F44633039FF84067F6D43BC8A6ECEB1D05CA56D030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bcd597b45fda556c322936c91bb507e28bfefdc7552a743a10234680568ce65e
MD5 cf73d4fca13b0b321cb5d6e588761749
SHA1 653b22387c1f6735291850b054b888eb6071ae18
SHA512 a24d55027aa68ce5467986fb65a543e195d2a2a0bf2ab8e1f6837318615468fa82b9310ae75b96b8b0aa60d4197015052b61d611d14569700ab8c47475c2bf7f
SSDEEP 192:nRGN/6yMQmiUyZJmb1Y3b+jcejzorrsfRNMnw3U6:RGN/6xew1Y3b+AC8Y6CU6
TLSH
T1D902D835AC686C7B9FF2AE49B58737139FE4102BE5952FC0DAE81F1C00C725C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc8ce891d49bdd52f3cb7487f9cdf1f930d28ff0b3ba8896ce3747fa004b062b
MD5 9fe9e355a62ba250b147aa7fd54b3b6f
SHA1 747f8d13b94ae3c2131a327ec7fc9d81d9de85f0
SHA512 cff7ca1bd7772eb41e4df4a50b4a7446f1e7250cd9c1f8d7f016c9d16f4abf26edea6d37f98823c767e86013f8e11c24f26c1d63a867f806cc17b57267557c54
SSDEEP 192:XGN66yoQmiUy+0b6Y3b+jcejzorrsfR9XEXi4M8gqIgeU6:XGN669i6Y3b+AC8YbXEC8beU6
TLSH
T1D912FA326868AC7B5EE2A544B48732138FE90127EA897FC0D6EC6B1C05DF59C530E967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download