hxxps://cc[.]cloudad[.]icu

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cc.cloudad.icu
Sample260701-vn28faaz3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273993472672537"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BC08A688-98F3-4358-B544-07A41658F837}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4472	904	msedge.exe	86
PID 904 wrote to memory of 2156	904	msedge.exe	87
PID 904 wrote to memory of 1768	904	msedge.exe	88
PID 904 wrote to memory of 2156	904	msedge.exe	87
PID 904 wrote to memory of 2156	904	msedge.exe	87
PID 904 wrote to memory of 4972	904	msedge.exe	89
PID 904 wrote to memory of 4972	904	msedge.exe	89
PID 904 wrote to memory of 3192	904	msedge.exe	90
PID 904 wrote to memory of 3192	904	msedge.exe	90
PID 904 wrote to memory of 3192	904	msedge.exe	90
PID 904 wrote to memory of 1312	904	msedge.exe	91
PID 904 wrote to memory of 1312	904	msedge.exe	91
PID 904 wrote to memory of 1312	904	msedge.exe	91
PID 904 wrote to memory of 1372	904	msedge.exe	93
PID 904 wrote to memory of 4084	904	msedge.exe	94
PID 904 wrote to memory of 1372	904	msedge.exe	93
PID 904 wrote to memory of 1372	904	msedge.exe	93
PID 904 wrote to memory of 4084	904	msedge.exe	94
PID 904 wrote to memory of 4084	904	msedge.exe	94
PID 904 wrote to memory of 1716	904	msedge.exe	100
PID 904 wrote to memory of 2832	904	msedge.exe	99
PID 904 wrote to memory of 1716	904	msedge.exe	100
PID 904 wrote to memory of 2832	904	msedge.exe	99
PID 904 wrote to memory of 3392	904	msedge.exe	102
PID 904 wrote to memory of 3104	904	msedge.exe	107
PID 904 wrote to memory of 1268	904	msedge.exe	108
PID 904 wrote to memory of 2148	904	msedge.exe	109
PID 904 wrote to memory of 1216	904	msedge.exe	118
PID 904 wrote to memory of 1216	904	msedge.exe	118
PID 904 wrote to memory of 5060	904	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cc.cloudad.icu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7fff4668c188,0x7fff4668c194,0x7fff4668c1a0
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,6897538697090605246,7272553293627492416,262144 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,3308845919006277884,16207247719627858086,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,13325290379570399371,6004943817772446162,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6405863827722653544,12477890526167686599,2097152 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,10650534200016475803,10363624231531432141,2097152 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,17224227719853828378,874797673903320562,2097152 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,11553491651903757496,15604858486293090565,2097152 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1037800295952525991,8692715112516625077,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,7752874441779149293,6303557965037467528,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9922384817286866793,6191103445292467014,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9922384817286866793,6191103445292467014,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15508819408490665692,13526552587950030116,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17743429415511520496,6721287191336463149,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,8254754499339311365,10353888529043453912,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13865258684775119829,5376964976923865384,524288 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,17080916652140191669,13888426792683998119,262144 --field-trial-handle=2256,i,3129647199868565956,12261309319844232424,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3ea6ab9d93c93f1b8c6ce3de056e3f15278c23a8faaac38f1f97937865983b2e
MD5 278d3427e16f13d5f91e05dbb44adb09
SHA1 b72347efce1330dd3944f57272d7008bd0477bb2
SHA512 93ab960a8fec2eda1eefd1004f563b25db55b2916af99715029419d9a222faa4f9efd7c3b100386d81f6981f22e4972414b885a5134a58484771779a5520a804
TLSH
T13981C739C20301A5DB2D01B8B1CD112C74FB99E9FEAB1E958CD56B7674323D5E39825C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b10b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b10b.TMP
Size 3KB
SHA256 27ee2721cfe47d094c20561470cc7f0ddefc5d72aa5a6fda0da39d61710abc1c
MD5 139e567329f022f94267b0917ef318d8
SHA1 270455d01310399770bacb7cfde47b24ef079740
SHA512 f29a97259987ad8480e92e57cbe1c0dfb91f3d14fb731216a251f0a8c1b3d5cd792cf44523b6a686ea91ab4393f70737bff636042b0b2815cfcb006e320fd0ed
TLSH
T16681B639C20301A5DB2D01B8B1CD112C74FB99E9FEAB1E958CD56B7664323D1E39825C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f8d10dad3eea8541f61defd3a79573f5b634f5b6b5c09f1fb110989f9bad4d3b
MD5 bf837866973dacf202303d5994332bc6
SHA1 0b90c3d621ab368dbdeba8854b01d1c241f8e53e
SHA512 d10ea7c6e500d1910d6f122a52505d785182b549f393eaa0636ca875f73df7846cc3f8e4024d170b031d425a7812a65f614a6f992511c4eeb9434790ff6093bd
TLSH
T1EE117DF3C7D585AE891156F06A24AE2BCE2D0515431C7C1989D4EF2BD3E3075E00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53c5c4a896f3bbbcdc0dbed74fbf7aeba35fb665d458e653026950090acf5947
MD5 ed6a5a233e06612f336feac383b83ea2
SHA1 51cc451ffebf419dc0bff63dc3d7f84c958568ac
SHA512 abb02fe72fed7f56ec94709e63ff4561b46313a96d61069bcac55279bdaeab6e0cef83039585bcdd63f1b148d58686b039af47684e919452265917bd7a877f79
SSDEEP 192:sxZVx0ZRIoyM/jK1Ml8UQYlkY4/f4ysYT1gIOVzDeIdpIV31HW6+WNBVyk/Yz1l4:sxZTILqfP/f/sK1AxGHb1/lyC
TLSH
T1F152D8526A3459B7CCDBD609FA45BB53E6F5147392940E44AAFCCB0C01E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f160af8568a09b8d0bb43e10bc9ed96a1aebdbd1ff889b9e00bf24d221c6783
MD5 1cddc374dbf6b27e9ea3764ce6770cf0
SHA1 cdd231e5fe0c03efc3e1681fff1df01d1d66b28b
SHA512 5ddb876b3e10c643522259387b763d99f26bd70f8845df269c5c9041c68a89180a7bf2c39dfb24d0dce4fe8f099c1bb52c696155a482013fe2f9bff7819b29e1
SSDEEP 192:sxZVx0ZRIoyM/jK1Ml8MkY4/f4yst1gTVzDeIdpiV31HW6+WNBVyk/Yz1qVEG5DY:sxZTILMP/f/st1cxkHb1/Zy9
TLSH
T17442E9526A3499B7CCDBD209FA45BB53E6F9147392940D44A9FCCA0C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 66d23b6ceb8ff30a4520ee2b9c27f2fb018704891043b72868f924f350fcb0f1
MD5 8e53a90c532dbcf1750d15fac7f71ff4
SHA1 18c05b8180acfbdc0567006d4b00d11f8211b13b
SHA512 919555577d095a62ee2677e9fedfd915fd33757b54ea9642b59081668259368130bda28abecf21d1222d3a83a23d5d11015b35461f7c6a99b463c40e9d05a8c4
SSDEEP 768:DiW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjMroIoi0Yo:DiW7kf0Wvqidau1jaa5LA3jXKo
TLSH
T14CD2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 155ff2844ab3cd58bc2dd251dad322be8002c09ab2c5643657173ced494c073d
MD5 b2d748800cf67697f8289ac97524733e
SHA1 cf8209bd4db20853769cb2f6afe59d59130cbc42
SHA512 77ba38ff5fa067fd3a5ef4f351dd42901bef573a373c38d4aaecb0a84970b06a4382ddf97310ae3e8a792405d1110f50b66c7e0d1ddcc3294b178c60edacd2d9
SSDEEP 96:KIbCKcjNmKeQqCIwKJu/i5iWinijiRiziHiDWi3iEiygiriDK4iagiliDl:s6prGCHuC0UE9MZSy6ngo+
TLSH
T112917446713B465138BF2998929AD6368E8239633418EC7F7BB814B25F67E114DFC8CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594f5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594f5e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4efbe518cf9ee447efd923c60708c7b581145f140f580bb339d7d3548de53d8f
MD5 d80e9d1c73b218458c9882cb22bb38d7
SHA1 a439f6d2f51c0c943c74cdfb460359bb070c4b02
SHA512 641b76f17debac090ef8a8800bba630f875c6418609beae34088bf58dad19857cd2d22cf2f13cb6ee6c33d809afe63c434825abe1a9f310e8496fd332893575b
SSDEEP 384:rtNn/s3n9SfsNsY2pb2bSRiGdpqrCX0IidKzvkuQ:rj+9UbJ2yxEC78Kzs
TLSH
T113928E366C355DAB4DA29584F4463B17AFF88277A3C13F50E2DCAB0C01DE7AC6316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d1027f58222cd1760cfdf3ea6d35224e3dbee22308bab2872affe0e5126fcd00
MD5 8380aae0b9006c8ae34715918af69c85
SHA1 9fa615bee1289aed61bf9276b2e249d8b6c6a52a
SHA512 680460eb90c16322228af0362ae963a24e4ede52d0fdd25cd728ab25ed5238c8ff69b22197236c4c9712683365663852e43d310c654fd1a5be4cba4501079c01
SSDEEP 384:aiF1tNn/s3n9SIzsNk8TUNTUlIlB2pb2bSRiGdpqsCX0IidKzvkuQ:RF1j+9HdwgWJ2qxdC78Kzs
TLSH
T10DC23AF608D7497ACD9E4747A73D2E039EBCC167B6806950B3C85A0CCD8A2BFD306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ed4dcf846bbc284587b2520516a1a9748ba2d8b038a4b4a1df7a97b29fa23e6
MD5 236ea9f7c67c4095e5d6aa820d2159cb
SHA1 2e62103979cdf311ae74196c16a1607aa845d6ea
SHA512 3ef5cba7e3065de5569b9c3dde2755299e2830e31a00b2f988b9f525df3e5d60ed8d9f27ee5f66b4cadfaa3d1ae0d1d98d7c8f09fdc8bc814ddd7cfbfab48ee9
SSDEEP 192:MON064BAQmiUyVH1V6W5GBPKT++FdGsfaDiPouU6:MON06eA6+W1dpcXuU6
TLSH
T10702FA34AC796C7B9EA2AE45F4863B176FE8113BE5C41B44EAE85B1C019765C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 971523c055e137f05ea52a7939ed18a27600d8c53bd31132c8454e70de8679dd
MD5 1a83955038b6fed8877cc09072257539
SHA1 9a159c954457d21d2e3a56c6063c51a03b7a2c4d
SHA512 a25f9e952ae3b6dbdf1c01d31978248facb1aa5d2e547892c1d9120e3fe752d3e6087aaa784725c2da1a201e1f677424c2b8e3ee723a8ed37e48f67e63828c19
SSDEEP 384:DtNn/s3n9SfsNsB2pb2bSRiGdpqrCX0IidKzvkuQ:Dj+9U0J2yxEC78Kzs
TLSH
T19E929E366C355DAB4DA29584F5463B17AFF88277A3C13F50E2DCAB0C01DE7AC6306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6cde45261e4821808da992d2891b5fe85f11b904b1210650c19cd62fdfdb1f84
MD5 45fcff04f14bb299e3a47b434f47d2d6
SHA1 26e20de7f994995df898c6a5a8312617920a226e
SHA512 227315ca3b6cc7078deb57c8a26d7b2b3f030875563208ba13e6906202b0805a68e2e056c912cd96a1bb6eca64abd1678b2983a884aad733b12eff1886554da2
SSDEEP 192:8wONrx64BE0QmiUyVbV6f25GBPKT++FdGsr2PNSWwiGq1U6:HONl6exD+1dpqwCU6
TLSH
T110122B359C756C6B5E92B541F4873603AEE85237EBC47F40E6DC6B1C02EF6AC630681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 66944243d575cd12d44b02b1271b204f3c263e0d3bd35fd56376c3f3951bd52c
MD5 bb9b883a3f18b3b673aaed27dbc36e80
SHA1 3fee2ae7582e39c5170fa940e707527dac74255b
SHA512 d34e5ab295eb4d7372b106da044de9d975cc0cdc9f4cb87860101788d1c201a3e8a997881c24e6d50bd726bdc8f7550f8cf8a268af8eaff471e7cd32831443cc
TLSH
T187410A98B6FA1148F3B77F5A9FF6A86D447B78772E16905E00010D4E0A72B40C971B77
MD5 SHA1 SHA512 TLSH

Submit Download