hxxp://usercentrics[.]eu

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://usercentrics.eu
Sample260814-vb3y7sysay

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311998012526533"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{D4DE8333-D24D-48C3-BD61-D8E2DE2086AF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 6040	3364	msedge.exe	87
PID 3364 wrote to memory of 5140	3364	msedge.exe	89
PID 3364 wrote to memory of 5164	3364	msedge.exe	88
PID 3364 wrote to memory of 5140	3364	msedge.exe	89
PID 3364 wrote to memory of 5140	3364	msedge.exe	89
PID 3364 wrote to memory of 5220	3364	msedge.exe	90
PID 3364 wrote to memory of 5220	3364	msedge.exe	90
PID 3364 wrote to memory of 3704	3364	msedge.exe	92
PID 3364 wrote to memory of 3704	3364	msedge.exe	92
PID 3364 wrote to memory of 3704	3364	msedge.exe	92
PID 3364 wrote to memory of 3316	3364	msedge.exe	93
PID 3364 wrote to memory of 3316	3364	msedge.exe	93
PID 3364 wrote to memory of 3316	3364	msedge.exe	93
PID 3364 wrote to memory of 5584	3364	msedge.exe	95
PID 3364 wrote to memory of 5584	3364	msedge.exe	95
PID 3364 wrote to memory of 5584	3364	msedge.exe	95
PID 3364 wrote to memory of 4784	3364	msedge.exe	99
PID 3364 wrote to memory of 4784	3364	msedge.exe	99
PID 3364 wrote to memory of 4100	3364	msedge.exe	100
PID 3364 wrote to memory of 4100	3364	msedge.exe	100
PID 3364 wrote to memory of 1772	3364	msedge.exe	102
PID 3364 wrote to memory of 5396	3364	msedge.exe	109
PID 3364 wrote to memory of 4400	3364	msedge.exe	110
PID 3364 wrote to memory of 5548	3364	msedge.exe	111
PID 3364 wrote to memory of 916	3364	msedge.exe	119
PID 3364 wrote to memory of 916	3364	msedge.exe	119
PID 3364 wrote to memory of 1088	3364	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://usercentrics.eu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1fd0c188,0x7ffb1fd0c194,0x7ffb1fd0c1a0
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9649914492551274000,16655320993119036748,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,12941376038176842352,4008462750998454886,262144 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,14271942492160996192,10712877729284910614,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13554206007079802003,3756224502138053995,2097152 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,18281320404788928208,2258471407365566860,2097152 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,3313341229445262626,15573085958331393929,2097152 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,10647503752452136741,219765414258862336,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,18230422303909639467,16937582702606186149,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7110836710003076214,15718878390590648472,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,7110836710003076214,15718878390590648472,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,7404653298107582327,18422616588491969130,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3015769570972367174,16919123786871303127,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1871738293676085288,18206024877821063417,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13657854194348937899,2823729095916805236,524288 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,1052873146909221396,7073386496457029638,262144 --field-trial-handle=2384,i,14176633027827732871,11573593603180055747,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7c550144f4f4cb341eee0369d7fa53e48bbe9a898bee383ca416c3f16e4a85e5
MD5 b9a030d5ebfe620ba73a746d987a4b0c
SHA1 1763fff7f41ba2eb1e470269186070dc0ee5b9fc
SHA512 bf0362588acc631402b97c8fed9a0d882aa7a14f71593b89a34ed6477f8b55b696adf7cde4b92c9be7529ef29f6b40f55d3d5db1db1bfe53382009112cc3e1f5
TLSH
T185E022A6CD22EC371DFE1B18A41A8A56E70113172A40895F3A3D82088FB062A97CAC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3438d52c8e6e8b7087eece10fea1784879203cee0df166a1eaddc9ef21dd0f19
MD5 feeacef76e00ec749d9148397d7f11f6
SHA1 bcd7c5e8471593044484a6cb2464f07dc969a6a3
SHA512 6d33a87da3e2d70f1bc17822e83e5888bde145ff407457907a6f98b95252a7dcb680d0f6f049d12be65d6d374b82b62298436dec5a11f64b5df8def398398664
SSDEEP 48:o/kIkQkCwC3bhlzfWm9WeXqVsFPWgUFD1LutlTfubfb0S/xIOFeOnvWmMGdwtxTi:o/ktQkmuwXxUl1gxf3SpnF3emMgm4
TLSH
T18A914D3609DD40E1EBE80D72BCD40D8133B369DAF60FAF5AA2140DB72DE2792864487C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c80e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c80e.TMP
Size 3KB
SHA256 f67c50504edbf9eea2bfd5800a5fb17b540a46d4e05a08cd65da72a3f8920515
MD5 e3af4a95da02d1252318afe6f5d97ac6
SHA1 e958390317bd7d29fd842b2abd3524e3d6e1b30f
SHA512 95e9aa7b20c1e9ad3a136ecb8ed1e73127ff71c536bdbe09298d8a752bd79f5a5d3def2143c56d77f0399f56575688ad9e904308377f9ad0a1a28869e422256c
TLSH
T1B4715C3949DD04E2E7C80D727DD4191533B3AAD9FB03AE99E25004B76DF67118A0587C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ecbd5aced27ade757ed7f3efd67429763b90f615465d24c77eb0a9186cab1f3a
MD5 176cad1e4a3deb5e1ef15203622ac3bb
SHA1 4f07d8c7e5a17718b3009d0b2f475ff2e043cd9b
SHA512 b8e415c005ac1c5ff060ccfde353c4c695ddae414c25518098471fd77fb405547a3981126e6fb246c8f07fc10d8c3578138f36349e4fd15a7ac68540ec065329
SSDEEP 96:D1vhObsjvXvVv7vVWaaij6o2f6fzB4sojh2uVqVb9ExrcKP6tTHwQ:D1vUbsjvXvVv7vwaaij6o2fK1dojh2uS
TLSH
T16CC1AEE3C6E4CA6EC50155F067257A2BCE9D492893283C59C9F0AF1F53E24B0D24665F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2d6a63757ea7a0e91f5f4441ccfcd91cce1da7d26c74608511fc8d8643c5d57e
MD5 c63f58af880192dbf935516c4c602fc6
SHA1 6ba646920839b05a14c168fa6c7c51311de5618d
SHA512 df02363e1151f6614b2401f6983a7357a0025402259bddfe3fa2a45173ee54737cff16f78ba4cd1eead43964524328a4e747fba706125bad4dbf817179899512
SSDEEP 192:sxZuYRLJyMqZjK1Ml8UQWkqL/fKbsoRZdL1zodpYzHW6+WNF/cXYvko16nIg5eiJ:sxZuYqq9qL/fKbsoRzLe+HbKX2mw+
TLSH
T17962D8166A349D77CCDBD219FA45BF53D3F90563A2905E44A9FC8A0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 89b81786cd151da5b991a3145930004f35ffcf667499e20ca199b4ccca9dd3d0
MD5 13322c2c6164b1cafeb3528351b7121d
SHA1 a22f37bc447ac00023c67b5a60f0e844fd435b4c
SHA512 c2c7278799c0d58ccbea017ccd9a4908af424434790e5b32a4642b424db1962bb937eabe59b3d34fae4a22b9a9005c8c73dfadddbc635a65575244217bcd9785
SSDEEP 192:sxZuYRLJyMqZjK1Ml8MkqL/fKbssBDaZdL1zodpYzHW6+WNFsL/YvEuor6nIgjiJ:sxZuYqMqL/fKbssBDazLe+Hba/Xmj+
TLSH
T13A62E7166A389D77CCDBD219FA45BF53D3F90163A2904E4499FC8A0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8979ab32c978021c8fde7a414a0a70e3b23c502b63b4532b950e57b54f6e3ddf
MD5 840b5ac30530a1c41034b2a7318d2458
SHA1 de1e68e02737ac9207bdc50e1def2d2bf5d0467a
SHA512 bbe7c3d80ba504df4a7ec20d72d46be894de1a000e822340cd8d5a41a9862a61d787a698859cebcd5005b71730eb614afe7989bfc368486f3c2e740401dc0477
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGX:05ppxnY753RNBvRJJdt7p5J9xxN1
TLSH
T1EAB26A5A713A0211397E3988B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aad1e1760b8fe29448085910079f0e5260a909019b6dcc4b9b365843d3234b99
MD5 119d150b0ee177c19c05033d063f2799
SHA1 6c462583d2830279ccda46cfe915e8ce53ad1542
SHA512 8fbb557d4a5d2c3fc3dc7495f32a2d5889876fc4e0ab65ca5e9f5a4e922a5536fb21563fac9ea1743c7d9de810ff07ca9b643e4c7e8947c382728478aea8ee2f
SSDEEP 768:RFccpz3OwgTk0CbGCtD+qEip0MEAOOi9Ps:Vz3uWtD+qEiO/O3
TLSH
T108E2C3F198D78977E8AE4B87A73E2D029EBCC153B5885994B7C91D0CCD861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1affd50d9cf958ed790195f8240971e508de46f18db36703db44990a018bb461
MD5 d2b9d8e3ab005d97134cd468d17d0081
SHA1 2b7f38384f32caf46408e3094264f158de055769
SHA512 5e32d68d8f61438c086bc9037c08b67ffd2d3d166ce04388a0b41217ff3818e3024d1cb2dc5c1eb953bdf672cf1ec01846c06ff30b06de9916182cd59706e44c
SSDEEP 768:pyFccpZ3OwgTkfCbGCtD+qEip0M6AOOi9Ps:oZ3urtD+qEiOfO3
TLSH
T111D25B32E868DEA7FCE69BC9A75A3643DEF44163C5C899D4DAD95D0C01CB1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b1b44daaf51d4e4ffa2b3efd52a725a76e21dba83d7fa8b4bfb2a6440b3c0ea9
MD5 25b9d54ce5b5226ce2ee53334b482d3b
SHA1 0aa6a460389f5b230e741b8e48784d26c95def94
SHA512 ead5590e14b3d28f6b5803df60e63f97bc215e1983ae871960de7a8fa0145b07633ca86621962ef42fdac35bb942aa411fd39cb06a13db311baf1bd1401c5253
SSDEEP 768:2FccpZ3OwgTkRCbGCtD+qEip0M6AOOi9Ps:CZ3uBtD+qEiOfO3
TLSH
T16BD25B32E868DEA7ECE69BC9A75A3643DEF44163C5C899D4DAD95D0C01CB1AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ee3b36aadb2e66d8cec2693468db6951cc49360ed0c5b933b531c1feab30db21
MD5 2203a7d9be10dcad6516a514e121f144
SHA1 f4382970eb7d6280088d07f2f782948dd9a15fdd
SHA512 0a0c166aac6727f57dcf14ed14779d990a126b6e18f11cfc0057dbc949bee4ea104bf9dd417eeca984c7d71466d864b38429c378c140735c67b5eaaf3e91cb65
SSDEEP 768:p1Fccps3ewgbkU8vbGCtD+qEip0MlAOI8p0TLY:zs3wqtD+qEiOiI8p0TLY
TLSH
T103C24B32E858CDBBECE24B99E75A3A07DEE4526385CC99E4DADD1D0D01DB1AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9565a04-8045-4db7-9b81-663f92544cc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9565a04-8045-4db7-9b81-663f92544cc0.tmp
Size 24KB
SHA256 55df1a289cd7a58fae792bd7f180059b38a86845e6c489de275cc855d7675f2e
MD5 427b24e42dcd55ae9bbf63a4ad89a6ec
SHA1 86e06f87b9690cd585d56316556a564890690b45
SHA512 b50a6c03b4e79aa8e5fc28df59e924142ba657fb52900ea5be43ca4ad9094896c8e170c4a94c925199f15a1559403f2eedf19adefb28854ad4c815fc2869f298
SSDEEP 768:pcFccps3ywgbkUBkbGCtD+qEidxI8p0TLY:Ks3UwtD+qEinI8p0TLY
TLSH
T176B25B36EC68CDBBEDE24F89E75A3A07DEE4526785D899E4CED85D0D00831AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5816579c840b50573d66244c6dcfa301a32c3bc37a251f7014216fa89a125235
MD5 c792e2f1d6725ec3d6d3db1879d96d48
SHA1 633903d2fb4ac4785d25783ba15063fcfe0a991f
SHA512 e8412b8af4f9e8b3b3264097cf7dd667b6c1b2e978f688123c1350cc42b4675ee2d14f3bd4dea98ff2e3037d0991d4433980c3a6064e9da99ebada7855f2e355
TLSH
T190414B5CA6F91148B3B76E5AAFF6A9AD447F78372F06C45D00110D4F0A22B40D9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download