hxxps://www[.]normandie[.]ars[.]sante[.]fr/media/166561/download?inline

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.normandie.ars.sante.fr/media/166561/download?inline
Sample260930-rrzpyavfnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1324	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{4CC2DD38-3C0A-4288-8E68-0AA0D26B01F7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 3392	4152	msedge.exe	87
PID 4152 wrote to memory of 1324	4152	msedge.exe	88
PID 4152 wrote to memory of 4716	4152	msedge.exe	89
PID 4152 wrote to memory of 4716	4152	msedge.exe	89
PID 4152 wrote to memory of 4716	4152	msedge.exe	89
PID 4152 wrote to memory of 1660	4152	msedge.exe	90
PID 4152 wrote to memory of 1660	4152	msedge.exe	90
PID 4152 wrote to memory of 3932	4152	msedge.exe	92
PID 4152 wrote to memory of 3932	4152	msedge.exe	92
PID 4152 wrote to memory of 3932	4152	msedge.exe	92
PID 4152 wrote to memory of 4336	4152	msedge.exe	93
PID 4152 wrote to memory of 4336	4152	msedge.exe	93
PID 4152 wrote to memory of 4336	4152	msedge.exe	93
PID 4152 wrote to memory of 2536	4152	msedge.exe	94
PID 4152 wrote to memory of 2536	4152	msedge.exe	94
PID 4152 wrote to memory of 2536	4152	msedge.exe	94
PID 4152 wrote to memory of 344	4152	msedge.exe	95
PID 4152 wrote to memory of 344	4152	msedge.exe	95
PID 4152 wrote to memory of 344	4152	msedge.exe	95
PID 4152 wrote to memory of 2020	4152	msedge.exe	98
PID 4152 wrote to memory of 2020	4152	msedge.exe	98
PID 4152 wrote to memory of 2020	4152	msedge.exe	98
PID 4152 wrote to memory of 1776	4152	msedge.exe	100
PID 4152 wrote to memory of 1776	4152	msedge.exe	100
PID 4152 wrote to memory of 1776	4152	msedge.exe	100
PID 4152 wrote to memory of 2236	4152	msedge.exe	101
PID 4152 wrote to memory of 3124	4152	msedge.exe	102
PID 4152 wrote to memory of 2236	4152	msedge.exe	101
PID 4152 wrote to memory of 3124	4152	msedge.exe	102
PID 4152 wrote to memory of 4100	4152	msedge.exe	104
PID 4152 wrote to memory of 5860	4152	msedge.exe	121
PID 4152 wrote to memory of 5868	4152	msedge.exe	122
PID 4152 wrote to memory of 5876	4152	msedge.exe	123
PID 4152 wrote to memory of 612	4152	msedge.exe	126
PID 4152 wrote to memory of 612	4152	msedge.exe	126
PID 4152 wrote to memory of 5900	4152	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.normandie.ars.sante.fr/media/166561/download?inline
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe32adc188,0x7ffe32adc194,0x7ffe32adc1a0
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,15998042844490450625,13558415541356904554,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1378397386298631843,8554639258399602823,262144 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,15439231798873420696,10332943655861283584,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,11281185171761384421,9721654852019766797,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8637131285510369670,7012676163800663624,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10315586431128883895,13984436890687404013,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,16886485303886816803,7037196018871781245,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,794696342375469590,17797977320861404055,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:2
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5320,i,6927634536903632715,4135120293106404119,2097152 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13226384647420256914,15468539107372580770,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,11720482441311630414,2247615331290484097,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10758564153817706962,14497825595933408620,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10758564153817706962,14497825595933408620,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,10260061745932218748,8957681092713565640,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,9854228484309620089,10521656936891502857,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,769485499824319716,2008097485482521312,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,14759674747057887841,10295672015629287464,524288 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5496,i,8383093601532785815,9496875435065594912,262144 --field-trial-handle=2316,i,12618923201923051946,2959093852748736555,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 47ccfb1310d0416268e7d6c308116c6ce1a559fabcde3d1f06075b0ebafa1f61
MD5 be0e71caf5a432934e522cdf2ac532e5
SHA1 e4a811bfbe52d5005ff4bce901db53dfb5d39332
SHA512 3d1245a19e83f53e182af2311baf34b4b6e56f478f6d756efcaa4ad89a023219facad748ef3d567f9289697939267d576c0e8d9e6bf9ca9c74781ffda3eea985
TLSH
T1D2519495968153C8FFF5127867C52FA33638B59961433E4242ABFCBB684B74C72832B4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d3bd9f54071da2715bc3d8270a512edd316d1c6c367d93cddbefdc4a619b4115
MD5 3f826264db82da0cffd576de8dc9f203
SHA1 06498caad259feec75d23c251535295878bdce68
SHA512 ac6dcfbb140ce1035258ff671aaf249774102962a9d8cef6ccad1a223a4ce101c205b08cecd560a6ff5002780bcf85628cdd680335b0ea4b78b9e2d728cede91
TLSH
T148116DF7C3E5856E8A0556F09A24AE1BCE1D0505421C7D59C5D4FF2B93E3075E00199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 75719d0c0c1c95cdca01a81e59d289b0ac69462f7a8a7b05dd85a9411bc6d088
MD5 e78d11c1d28f6d7e1e23901422a5c166
SHA1 853b13b24ce40af01232b74d8052f426d4376ee2
SHA512 b12e9bb400e9a748cbc0d084706192d6c35941b631454a020d127c54ce6153f9e7a90e3749b4c5ccfb0c71b6d788dd22c254240f020ae7cd0704ddb0a391e443
SSDEEP 192:sxZdRxWc/fps1AIdpy6HW6+WNJxO/Yr6Ow9VvzIgrJ:sxZdOc/fps1BBHbi/pOi9
TLSH
T17722C9526E68A57B8CC7D20DBA15BF53E6F95032A1D41E98FAFC851C08E66CD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4293bcfd9036ad392ad5f2936184e4b9bcea26fb305428b3057c6f1ad7eebb8a
MD5 8a87a90bf4293bab2206734f963a0894
SHA1 fb6fd4c946707edc106765a333cfccef9f6d4f84
SHA512 61f5e11c74ee88cda46873ceb1c81b6ff862a46ea5fabe1124e413005511a0c62a3802a286641b4ea9ea08f11bf1c6e07e60ef82317681bb089df949afb48339
SSDEEP 192:sxZdRxWc/fpsAAIdpA6HW6+WNJxO/YrhOwSVvzIg5nJ:sxZdOc/fpsABjHbi/4OlT
TLSH
T1EC32C8526E78A97BCCC7D20DBA55BF53E2F9503291941E88BAFCC61C05E66CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c63b81854e57689ac98be612f1c0117e2aa5dc1bbb71bd753eafcb309e236f1b
MD5 d6c170a5b2a3119ecdc7de100c40dd8e
SHA1 843698094a256e2975691ea3e399a7248fd8a2b0
SHA512 f47937cea4be480ba3dad4786d22031c1d2e137738767bc49fa86916b987468a78ecb2192cd6e7a1cf4e648d8de6a25eb6652f0e0bb22f52bcf7ca12212a9a3d
SSDEEP 192:sxZdRxWc/fpsAAIdpy6HW6+WNJxO/YrXOw9VvzIg5nJ:sxZdOc/fpsABBHbi/yOiT
TLSH
T13822C8526E78A97B8CC7D20DBB55BF53E6F9503291941E88BAFCC61C05E66CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ccd11a1eb8aafd3fdb0c16b288c493835406d483c9f8dbddb679d8552021880a
MD5 86cfe9dcb1f340581187199ddd5cefca
SHA1 2dadfdf24cc1adb4a30b2a3de6dad199a558c605
SHA512 4e6ea8a509e05a8a330ef8bf6285d85fafab0a70b0d729fc3cbdd33750aa81e9152eb8414e7047cfbe9ff3d206985f695c423072d2e1f2e446c837fcff980fc4
SSDEEP 192:sxZdRxWc/fps5AIdpy6HW6+WNJxO/Yr6Ow9VvzIg5NJ:sxZdOc/fps5BBHbi/pOid
TLSH
T13922C8526E78A97B8CC7D209BA55BF53E2F9103291941E98AAFC851C08E66CD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4b538eb1c65c4cb1b28e675c4bab5928a8ffcb10480bf3e24ebd3a763f0e1070
MD5 74c3c28c0035f79d00b502b49a4461ae
SHA1 02aeebde3dec8dd965a459d40dccbd70faedcb94
SHA512 8088886c5e16e7af3f95caf4d1d6ec44a16651623b38e224506a50b66cc84e58cfc90521efc0625fc6de9bfb19f30ebb2ad8d4c3d7a39e03b0abee77501421cb
SSDEEP 768:VGy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbSroRbK:VGy4J/DWvbtBhu1jajiLm0bJpK
TLSH
T122C20B3B644CCA7E4FC00A9DED5E6FD73E9802C796A48D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d3cfadaf830ff511a6cfa8e79a7f74167f0a1e9e7646141785e8d7e3068ed0c
MD5 be67cd9af58f89560ecc8cd406865c3b
SHA1 fc1c2488b9fe98d5bc8acc72fb4fc4a7ffe68339
SHA512 8aeb67c565e282e0a53e5b344ca06d1fca2147dfad183c14da67570f5fdbbb99ff3630ec03e2fe13a82fc7c852550d77c94c8922cc23d4d5885f7f7af7a83b37
SSDEEP 48:KIDI1Ks04jyLbef70DCOcey7bCxKISm7K9C1Q8xhsYarhhyLEzy+suCLbyB6ISW5:KIDCKs0+r7GKIXq+T2Kg0s
TLSH
T11891224535BB065138BE258886B5C71FA28132737118EA2B7FBC50A69F6BE040DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aabd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aabd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 00828a25546974566dcdba1ec56506230062477e11fc2e3000c9076338e934b6
MD5 86e716aef59823d72bd1d9095c71f804
SHA1 14e615895903b44ce740c3e6b60cbd65853a2e6e
SHA512 251ce37edda50a7e83096e17673ab6670dbb9524ae1b99b54aa93d437f74d035cf403375eef25755637a9d9e0df15a38f3f74867f0d98d2da6788037d6c83f5c
SSDEEP 384:uZcIhsN4+ADRZ0YxHX58EV8GAqXHJrz1tgOIwZOy5LDoN:Mh1jFa2Hhz1Xs6X2
TLSH
T1CF828E3299789C7B9CF7A189F18A22035FF49027E6D96F90C5FC6B1D00DA6990317D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 04e0ad472f33e8536c2d5c96dd67c4507e2e9a62b725252b85b2121cc7d6e14a
MD5 bf19c89a9b2d7a62589cfe84b6f68228
SHA1 0933285e2564eab66ab57f632bec3b33eabadd1a
SHA512 46bcb60c01858086ee686a55d3f929cf0201797f4b55c95e6e09dde1df767d84d606fdbf0a669db6b62baf61c4ba937e190d2be2262319fea35e5861d0af3a9c
SSDEEP 384:biFiZcIyzsNo8TUNTUlIlnADRZ0yxHX58EV8GAqXHJro1tgOIwZOy5LDoN:2FQalwg+FFa2Hho1Xs6X2
TLSH
T187C229F248E7887AD9AE9747B37D2D024EBCC027B585AA90B798561DCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 833d84b514670829a0a1a7f07f2b69c593bbbb4e5cb1e771bc0972a1375351b1
MD5 8259a99898fccae1e2cb33a4ea7b42be
SHA1 e0698539f583506d078e70cc4634656e94279c37
SHA512 36314af71100b8d79c2cbe6246a7ad2c70e5b36a29e5f082e524e9aa2fb8e554a578291b9a2dbc67f610baaa002d5fa2387d7423ac3917fdeeac8f169e835742
SSDEEP 384:NZcIhsN4nADRZ0YxHX58EV8GAqXHJrz1tgOIwZOy5LDoN:Vh0jFa2Hhz1Xs6X2
TLSH
T144828E3299789C7B9CF7A088F18A22035FF49027E6D96F90C5FC6B1D00DA6990307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 06668767f93091874266208752d63abe9b21352424214300d2962863a66a4ccd
MD5 901c2aa216dd0f1bde9c69c3012eb9d9
SHA1 2312a8e7d0318516f214f00a4380448dfa5fbab8
SHA512 9679df3c56259df56283295cf2dff31954eca1148c1a12bfdb5e4b2ec07c077c231a664b1f6717f9e1230466105f345c60b1bad8a0e3bac7eda1e337b2b657c8
SSDEEP 192:1ONJ6wlDJQmiUyNyD4X58gZ5jzorGAqXgSJrBve5q4U6:1ONJ6knJD4X58EV8GAqXHJrQ1U6
TLSH
T114120932F5A8AC2B4DE2A588B48B31039FF55117EA897F90C6EC1E2C00DF66C534BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bcff39b4d43b117134697fea54fddf9636783bdda52996bf13fd74d94c75f71c
MD5 b883f31cca47327c49f9f82c207a5567
SHA1 cd361c5b1d90caa4f99b08ce51fec1edd12f5cf5
SHA512 edbb33b400fe15300fb9cd16b4cd7906a51b380f145f13aa067cd2f56fcc1410d71767dd797cf3547a2c8be200a66bd404cd8fe1918ce72ada6fdd799d73357a
SSDEEP 192:1ONCq6wlDgQmiUyhyW4X58gZ5jzorGArDlB0U6:1ONp6kgXW4X58EV8GANaU6
TLSH
T1B702EA35F8687C7B8EF3AE49B58A26139FE5112BE5952F80CAEC1A1D00D765C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca90b1d645e5dec2a0fbe25a477fa953db3d0d3826cb107ce3f4a66076fd2e60
MD5 8471489d51763b0c66e92b09ba811405
SHA1 71c58ec799f2f99523ab6b152898539b6754a179
SHA512 ccd76991c59f22f082ee9db57b84f0d5c5001a6b686ef15ec5dfb1f333ea14f23664ee85bd74a8aa942acb9f0e4f40291a75722351bef8a2621c5a6b8f7e5108
TLSH
T1B5411B5CA6ED0148B3B76F59AFF6986E487B79372E06D49E00010D8F0663A41DD61B37
MD5 SHA1 SHA512 TLSH

Submit Download