28b8da380c41b050030f8c511278d973ea0b50a8a46e332f752a50fa67006e31

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
presentation/citrus-limon.html
Size 2KB
Sample260723-pm36fsba39
SHA256 28b8da380c41b050030f8c511278d973ea0b50a8a46e332f752a50fa67006e31
MD5 968a80082ef821cb51259964a0a351b2
SHA1 706418b7b772e6ecf562489a8474859e086fe97f
SHA512 7f0855d2f2f547fd78fbef40a9afba926138fbecd0ee29abb3ff384027659f7bf09a25aaab241ce6c5ab81d0a4073f0a74e9a5dad5b004a5277c0c51b902e386
TLSH
T17751225AA844A12B42151AACE531391ADF76DE0BB257EC10F5FD0A370FB37C9CC1B650
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292837268082196"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{6A8A97E9-F5BB-424B-B04A-4A912CF52B32}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5212	msedge.exe
5212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1360	2944	msedge.exe	89
PID 2944 wrote to memory of 4416	2944	msedge.exe	90
PID 2944 wrote to memory of 2220	2944	msedge.exe	92
PID 2944 wrote to memory of 4416	2944	msedge.exe	90
PID 2944 wrote to memory of 4416	2944	msedge.exe	90
PID 2944 wrote to memory of 1588	2944	msedge.exe	93
PID 2944 wrote to memory of 1588	2944	msedge.exe	93
PID 2944 wrote to memory of 5768	2944	msedge.exe	94
PID 2944 wrote to memory of 5768	2944	msedge.exe	94
PID 2944 wrote to memory of 5768	2944	msedge.exe	94
PID 2944 wrote to memory of 3620	2944	msedge.exe	95
PID 2944 wrote to memory of 3620	2944	msedge.exe	95
PID 2944 wrote to memory of 3620	2944	msedge.exe	95
PID 2944 wrote to memory of 3948	2944	msedge.exe	96
PID 2944 wrote to memory of 3948	2944	msedge.exe	96
PID 2944 wrote to memory of 3948	2944	msedge.exe	96
PID 2944 wrote to memory of 2432	2944	msedge.exe	97
PID 2944 wrote to memory of 2432	2944	msedge.exe	97
PID 2944 wrote to memory of 2432	2944	msedge.exe	97
PID 2944 wrote to memory of 2556	2944	msedge.exe	100
PID 2944 wrote to memory of 1700	2944	msedge.exe	99
PID 2944 wrote to memory of 2556	2944	msedge.exe	100
PID 2944 wrote to memory of 1700	2944	msedge.exe	99
PID 2944 wrote to memory of 5792	2944	msedge.exe	102
PID 2944 wrote to memory of 1560	2944	msedge.exe	106
PID 2944 wrote to memory of 3328	2944	msedge.exe	107
PID 2944 wrote to memory of 5680	2944	msedge.exe	108
PID 2944 wrote to memory of 5204	2944	msedge.exe	109
PID 2944 wrote to memory of 5204	2944	msedge.exe	109
PID 2944 wrote to memory of 5212	2944	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\presentation\citrus-limon.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffbdd72c188,0x7ffbdd72c194,0x7ffbdd72c1a0
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9467914809755351810,17128840553100281412,262144 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,13297331696977805164,10638787200756960632,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,12825309858424784247,14670021571794165822,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,7674258731873075792,13738088609753052127,2097152 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15879239336532727528,10067324346421064994,2097152 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,17472027188534573326,14169951290621658427,2097152 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11839411093446467418,820755687138484048,2097152 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8203372165861760802,13133395647886873720,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11515309412945198157,2972807271521178320,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,5333639272295526621,691631821557956122,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,5333639272295526621,691631821557956122,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,9596791096520109502,16348837141760891756,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,2903831867580465988,5793856092632616239,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,7536091696636786312,6417447743102078962,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,12347131477206278154,17227851246014892492,524288 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2808,i,610325729362918180,2933716120658098784,262144 --field-trial-handle=2744,i,8374193624666987750,3568845127285433466,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6532e6c286146d1402e00a44cc9008479612fa4d873e44e19baff499e699c174
MD5 89341ddb27c76c64dcb54b7ecb168d55
SHA1 1abe8292b295d6a847259c6c13d27ce1f861b3f4
SHA512 1e37db7b541c293be071cd4ace83ce15dd2e9bb1f79cc40d34bebcc11321cf0061cc014c58611db9b3455fd0a5b74b530034e401b165a481ae832a9e4fba2f7d
TLSH
T1435122B9932219D9E73C74B1FAE15844B6F0A42A25072A107C407EF55E8BF8870F9C1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ab88.TMP
Size 3KB
SHA256 d35f649823ce8a2bf9be0518103e4efc207c5fc027b06e19e88384b0451097e4
MD5 31f324eb27adb57b5a4d6ec3cf7046f8
SHA1 d07d06651cced819c4324093232a0fc8b3e1d9c1
SHA512 f25786bf019a778ae36d803bb2627bdee734e6034b5731fd6ee91fe29e6b1e69cf51b724ed5ff2526e650b7797e088d88e424d0428a42e4360de0462a99b1840
TLSH
T18F5122B9932219D9E73C74B1FAE15444B6F0A46A25072A107C403EF45E8BF8870F9C1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9d5a463dc484ef7f92adbc606be3da9c20525e55a86b34371b2a402a35601232
MD5 bd239d150c77291b25f76ee6e0d89493
SHA1 24611d68ca777fd4253e5af1e09fb6972b5db607
SHA512 cd0143e4d4b61cc210366dc14eac287af14c5555e357469f1653bf46ec23631f9208233908f8a456ad290a8c4aca4b1d1ac9547ff57820e0274bdde629149d80
TLSH
T105519EF7C3E4866E890156F0AB186E1BDE1D0915832C3C5AC9E4EF5BA3F2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 54e25ed81898b91889f0f85b63aa6820c6de65108045333ad48af9610d6341e5
MD5 106987ddc948fdfdd1ddf9dc66185977
SHA1 edfe3f5f761eac42dd99c0ad01c46e0ebb8f9cb2
SHA512 a4d84386079cff4b5f6e1800e888b239f79018438365dfd15c546fa9101861ef878c7f808c5d0c2c9eaa53bf6b1ebbca1939456a45fb5c543d9576466471f3d1
SSDEEP 192:sxRJR6bj/f9s75AoKCA94/MCzoA8p45/g6+WNIYD936SGGgU/IgDKJ:sxRJqj/f9s75AoZ8P4/5ILSHS
TLSH
T16C42B7166928AD3B9CCBE21DBB55BF53D6FA5032A1D01E48A7FC970C04E67DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9cdeb53d754f32db1f928a8dd2995b6a16eda70baef6ab63daa324f9cf7687d2
MD5 764541492ae036b25e97873448cef700
SHA1 b5fb007daf49403d2a5c1600ec92ac017a299397
SHA512 0eaa25254e6e7944e0bdf9a3ae6e8b407118c61bc5854c6b8edc68ab5c2f1566e0af482a1652de869730605376b71d2d4a842c9ff211d2de19aaf959238cad04
SSDEEP 192:sxR6R6bj/f9s/53oKCA94/MCzoA8p45/g6+WNIYD986SGGgU/IgIJ:sxR6qj/f9s/53oZ8P4/5ISSHs
TLSH
T14532B7166A28A93B9CC7E21DBB55BF53D6FA1033A1E01E58A7FC960C04E67DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 093dd0ed439e080c60d481aaf8b2adfbcddee43ee97d8843a09737a1a7f8c4f2
MD5 e0a8bceb449f02864e638cc215f73f46
SHA1 902cd95f3170044a1139d7c4cabfc4c90fdf242f
SHA512 de0c68aa4acf40b3d53551bccc183a3280047a14e51ddaaeb549acf44d7dc6bb65260ba2673beb8982282d6ac7235e7a4b1ddee40b9d0b7ca42d2ebd434fb43f
SSDEEP 192:sxRJR6bj/f9s753oKCA94/MCzoA8p45/g6+WNIYD986SGGgU/IgD4J:sxRJqj/f9s753oZ8P4/5ISSHY
TLSH
T10132B7166A28A93B5CCBE21DFB55BF53D6FA1032A1E01E58A6FC970C04E67DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 03e83f37ad39d4f8db4601332f798cbbdc6c8abaa8bab491750f0577a57e5044
MD5 beb45a6eca843e153314f054184e21f5
SHA1 e172053dc5d720d1da2af3acfb7ca6c4755ff284
SHA512 1e26ad456d0572278ed6b93b6bf83c7c6253461e341bd758b33b89e7555fd37683ca2f5a8f079fcc9416c43aa1aed5b7466c0457cef1a372f3a1e5285cc264bd
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcXropDT:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VE
TLSH
T133B2EA2F600CCB7E5F800AADAD197FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a6acac97-f716-4cbd-bd50-e02dbce78345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a6acac97-f716-4cbd-bd50-e02dbce78345.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4490b24922ad0111d2f4dfe5f75dadb5f51e20e7d7a4db796b240f8af7d9cec5
MD5 33d4cfb6352ecd2a633e672491aaf043
SHA1 de799c5048ae2dda7b443e4219041e315d67784b
SHA512 8bf7adf2152c6bcb6a294836096cc39a5b4158e56ee6db2261c94253367682863ce768c5e12b1de0c7a3d87aaffd895a1fb86ef8d4becdadeaeae304fece55e9
SSDEEP 384:vsrv+89zHqlDNP9oid638Nez9oZEr4gWZlf8hyEGmGEK9N7vy2rEoajo4cdR8eH0:0rv+4UNbd63ABi0zEwVrEnjN3Gac1F+5
TLSH
T17D03BF3569689DB38CFAD286B1477A037FB4069385D50BA4DACD7B0C029B9EC130F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 270460407c8529734f4a6e4c5b53ea08b69805234b9de55687458a22b8ef0b9f
MD5 0c19fdd5a13ac52e4dc8ef8579fcad20
SHA1 6f8ddfa69c9733a40ba7bea7f24b807ac304ef00
SHA512 34900a95d4d511289933e4a50b0e56f64704d6ffa4cdfd2ef07591a36a44970c61321c7f4016c7f9742f29300238df0feba5eae90a1a437b51a30837a2e443d7
SSDEEP 384:gZcId38Nei9oZECWgWZlf8hyEGmGEK9N7Ay2rEoajo4cdR8eHhVODjYPNDUM+hOB:ed32Bi0zEwgrEnjN3Gac1F+b9M0O
TLSH
T155F2BF356C649DB38CFAD296B6473603AEF14663C2E80B9499DDBB0C05979EC530B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 64e7da8d907596fff0b5831a2d355ba43c0351333eba5b806ad835f03680c08f
MD5 be16ee37d4295b0e913012a2a2407e81
SHA1 167478e2eafaf7326e47b546321defade917b54b
SHA512 b3496a43f2bcb421da9e050c66c9d33007afa741d4d3f54ce3ab4a05e5778fa8e89ae9f2b0b1584d6efedcfaae0b277ac177b0ece4990077f6c804a049fa62c6
SSDEEP 384:iZcId38NeH9oZECWgWZlf8hyEGmGEK9N7Ay2rEoajo4cdR8eHhVODjYPNDUM+hOB:Qd3nBi0zEwgrEnjN3Gac1F+b9M0O
TLSH
T138F2B0356C649DB34CFAD296B6473603AEF14663C2E80B9499DDBB0C05979EC530B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4036ac3471ff7597924a4577349774f29ef126a1c66ae1a7fc05852ea7e1d319
MD5 ddeb6594ed60787e9bb921843c2fb01e
SHA1 bf38a22182af54c23b5bf4116b78f25cee5aa42d
SHA512 9fb6ceeaaf39e174a6b423ef7d487e1e9c11a4edd726808d4dfceb985b7bd12fec5155de83eac3ec623e9181e4a692fa1a58ae08ce47dc50b1cbe9c929ad8aaa
SSDEEP 768:VFQ331wgMBi0zEwlrEnjN3Gac1F+b9M0O:033ozEoQnjMaFb+x
TLSH
T14E03B0365C94CDB79DFAD795B64636039EF14263C5E84AA4E6CDBA0C01A75EC430BC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 50dda84e7f549f336c28448d1405b4beaf0a729ec5488b76e6b1eefef2abb28b
MD5 6d256f95e80551d098e9508a8bf66a6b
SHA1 3716dcddb1621ad17b509eeb80e473e0663ea200
SHA512 85f5ac45c4bc264f3e589000d0e815651e52561ee81dbc61edbdd18ad26cd1274db38785a2471c0ac385531c859b3a2d3b446b99c21126a2822d9acb620ace1b
SSDEEP 768:rrv+4UNbdS3Omi0zEZrEnjN3Gac1ZMeVH1SCz:rbsbg3tzEZQnjMaPEH1V
TLSH
T10303CF3569A89EB39CEBA385B1877A037FF4525386940BE4C9CD2B0D02975EC130B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

027fccb6-3178-46c7-93c3-5cfd60edba69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\027fccb6-3178-46c7-93c3-5cfd60edba69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download