hxxps://aka[.]ms/krs?id=lxDNVZKK

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aka.ms/krs?id=lxDNVZKK
Sample260930-cnn2psyhqb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5588	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{AF819871-2ABB-4609-9B5D-8B6C72EB2376}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5028	4860	msedge.exe	80
PID 4860 wrote to memory of 5588	4860	msedge.exe	81
PID 4860 wrote to memory of 4440	4860	msedge.exe	82
PID 4860 wrote to memory of 4440	4860	msedge.exe	82
PID 4860 wrote to memory of 4440	4860	msedge.exe	82
PID 4860 wrote to memory of 2404	4860	msedge.exe	83
PID 4860 wrote to memory of 2404	4860	msedge.exe	83
PID 4860 wrote to memory of 4708	4860	msedge.exe	85
PID 4860 wrote to memory of 5040	4860	msedge.exe	86
PID 4860 wrote to memory of 4708	4860	msedge.exe	85
PID 4860 wrote to memory of 4708	4860	msedge.exe	85
PID 4860 wrote to memory of 5040	4860	msedge.exe	86
PID 4860 wrote to memory of 5040	4860	msedge.exe	86
PID 4860 wrote to memory of 4624	4860	msedge.exe	88
PID 4860 wrote to memory of 4624	4860	msedge.exe	88
PID 4860 wrote to memory of 4624	4860	msedge.exe	88
PID 4860 wrote to memory of 4052	4860	msedge.exe	90
PID 4860 wrote to memory of 4052	4860	msedge.exe	90
PID 4860 wrote to memory of 3336	4860	msedge.exe	89
PID 4860 wrote to memory of 3336	4860	msedge.exe	89
PID 4860 wrote to memory of 1784	4860	msedge.exe	92
PID 4860 wrote to memory of 2956	4860	msedge.exe	93
PID 2956 wrote to memory of 5748	2956	msedge.exe	94
PID 4860 wrote to memory of 4676	4860	msedge.exe	97
PID 4860 wrote to memory of 4336	4860	msedge.exe	98
PID 4860 wrote to memory of 2040	4860	msedge.exe	99
PID 4860 wrote to memory of 1396	4860	msedge.exe	100
PID 4860 wrote to memory of 1396	4860	msedge.exe	100
PID 4860 wrote to memory of 4192	4860	msedge.exe	102
PID 4860 wrote to memory of 4192	4860	msedge.exe	102
PID 4860 wrote to memory of 3860	4860	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aka.ms/krs?id=lxDNVZKK
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff9d4f4c188,0x7ff9d4f4c194,0x7ff9d4f4c1a0
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13857041444005328673,3148012878633381143,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,15674943601675459898,15971766862205198716,262144 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,8125599879611839771,16586015323402961955,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5054341423831923074,5682145671392807987,2097152 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3568043238129174865,5136813283137832322,2097152 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,1849223413753139284,3729726231387227558,2097152 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,1804750655444422186,8507796295491230646,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14650959242862549808,11705881051374188279,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10300764579664338364,14321711386673348658,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,10300764579664338364,14321711386673348658,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,16761243628732559276,14914141364648548614,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,8555611165957898075,16741838629514960765,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15085707521233946107,10924399934624333145,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,8347979094275416550,11025999779967357121,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,17401414142630585430,4957231629896026639,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11571099790528370064,13349523720294347477,524288 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6292,i,2796488572539475287,11388820674302823457,262144 --field-trial-handle=2536,i,7342078200151279586,14007648630909845819,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6f53ea3f58e5837bd02111d4f4b5c3bac1bdae538445312ca4e18a6b5f7c8f4c
MD5 43f4fae3f563dd80f34b79da0b016dd7
SHA1 933f6d007590ea92bddeec4d3e0e0619396f29f9
SHA512 9b44a29bcc8575476459c39ae3c689e446a48310ad72118aea1dfb50f73f60b9f9be2d37991f0e641e4f3567417df4d2ea7e0fb1712e04e35eb732942657aad6
TLSH
T1CFF0F4E9D931AC2718FD1B2920650B0BF75513273781995F3A3D821D8FB463B5686C2C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a65ce3cbfdd00aaab8c041a922581aa81ff42f768d3a57f8fe9ce1925a5dadc6
MD5 06f8b939b105120c22a2116925786894
SHA1 d27eb599a2b74afaaf28a8fb495890074202bb8e
SHA512 e8001896ce3550b300a60a51ba922b58d97290aa91a27a542d0e8ccf50c3b3fd6c3f3d5ebe16f508381cc2d31eaf17cbf3fdb9f834d237a547c04af3d50ffeed
TLSH
T1FC414BF3C3E48A6E890196F0AA18AE2BDE2D0615432C7D5A89D4AE2BD3E3471E14155B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f08e18e6-4a6d-42de-9bcd-362e1ed2e9a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f08e18e6-4a6d-42de-9bcd-362e1ed2e9a1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6d1c4dfa5b080580232e8cd067afd0eb70f9bdc5180e97a466c440602da1c126
MD5 60653d395fe5a03592020769b530d08d
SHA1 3c95dd6764852ce0bb9a423c9c30e2d91a738031
SHA512 6ae4abd3a20ab5032fa4121ad28dc27e85af49ee8facbff2314c4998a643b65bd51f6391f3138667aa3d230c03878cc52b845e8fbebb448744b6dee99c3a1f62
SSDEEP 192:sxZjREPFM/fJXsmQ705WsfKzodp5e/W6+WNXMGA/Y0Rg+gcwVIg5FUJ:sxZjmNM/fZsm35NY/bcB/565cmvY
TLSH
T17442EA55AD74A97B8CC7D21DFA15BF63D6F9503290D11E48A6FC8A1C14EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c9046f18420a65472ed1fb3cc2d535110b2734a40f939f61fa5016df584505fd
MD5 3d9466084900eaedbddc4a7003f3f061
SHA1 b5687dccb703c5a16cec242993e199a17d199d54
SHA512 e534b35fe235dda2ad4ca910bfe92dabbe6f5e12257024f83b21d8bd366d3beea10139eb23a94205f95b3e13250289aaf6d16fb5859e0f5accdd5d11bd3047cd
SSDEEP 192:sxZjREPFM/fJXsrQ705WsfKzodp5e/W6+WNXMGA/Y0Rg+gcwVIgjUJ:sxZjmNM/fZsr35NY/bcB/565cmjY
TLSH
T1CA42E955AE38A93B8CD7D21DFA15BF63D6F9503290D11E48A6FC8A1C10EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c42885a356056a0cd9e71164e0b356e373f72ac659fc18d72bbb73efc7dfdd3c
MD5 a69ee564f09492b42eddcc911076e62e
SHA1 7f46df9df477fba356674364e8afc1293dea78ca
SHA512 f81ed58cc61724dc160a61500cce6c100c1bbd56207d7003e4d94ada334dc8da9226cdbc5af530223826f2137439f83490e594f215ecb73dd8f809d7c8bcfe99
SSDEEP 192:sxZjREPFM/fJXseUQ705WsfKzodp5e/W6+WNXMGA/Y0RgagcwVIg5FUJ:sxZjmNM/fZsL35NY/bcB/56tcmvY
TLSH
T1DE42FA55AE78A97B8CC7D21DFA15BF63D6F9503290D11E48A6FC8A1C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 f8c6613100e2e03836efce332c8c5b99b84085e0b6f868f5c5c9c1389626922f
MD5 95a52ada67c41eceec136ae85247798c
SHA1 7c9c88f0c0d48deba1e6e3a9fb378893d7886aa6
SHA512 2d9a23ba1dee928150d2ba9496c043c54d8589f336a29864b3e21bdb589a6ef429d58c758da0b943356dab48499438267c2ec14074ecad740916c178072435b1
SSDEEP 768:WJ6E28xO215WRmp3QX/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fsLl/LN0Y3Zroyw:WJ6E28xO215WRmp3QX/u1jaKfsLpLKYG
TLSH
T114D20B2B740CCB7E4FC05AADDC666F976E9802C7A6688D4047FE894C02C77EA511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 dac8dd11fcb074dec6faf74e9666d3874d7a8bb355be589f1838d1d1830e2dd9
MD5 43159e5dde74784bf7641f58a7b39c54
SHA1 2a6b7f406f51db611899a7002916df8a1a8b1914
SHA512 790dea6199cd93aaf01e11822452847acfe2c1f92bbbdbfd39c9ac7579eaea8bda4ad8031262ef3821f2d80b5793b05badbdc683890549b80513cbcf3ae29ca6
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0B5:80Z/jH0TnaJxzh/Mrzcp3wHbAnba
TLSH
T1C1B2211131BA12053CBE290D81B49B2F564232B37119EA3F7FBD50A68E6BE445DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6d8b59d21f2f79cd0f2cc97e3dbbd10f95dd6515f9459fb313bb117e8d07c25f
MD5 addc5a3743eb5a0d58e56857f33205df
SHA1 e4ffd34bd89ddd3bea22ab20b792df652eeb9dcf
SHA512 757418624df7cda4de0f3e4483efbfcf5c5a2591bcf32ecbd70afd6c23601dc39bc57fd65c5b765940b6a0ddb181cb804bb4d84530b187c643b74d0b59029d67
SSDEEP 384:nViFiZcIq38N98TUNTUlIRtQnhxOtmtzTfoBvonckCIIy4JVVIAtgOIwZOyibgLo:cFQq3uwgGh4IUBva5IyrAXsRJ
TLSH
T163C24C32E8A8CDB7ECEB4E89A74A7613EEF01163949C9AD8E5D84D1D00971DE170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 88bb3fbf3c427104731b3c75ad5b4fac3c3eea6ed40a5c826181625912896524
MD5 ce33c6bb2057db637db68b32d34dbac0
SHA1 0488521e97403a4810962ecc7fbcf0f66c97b554
SHA512 d4105d373768e775f2daa44b29c4cfe8a424a086352bf94e01b4e59ccc328e81a9ac4a41c10d14b8ccb5862f2ff6ef12408cf749ec7171bd74fc01ab65e047ae
SSDEEP 384:nIiFiZcIq38N98TUNTUlIRtQnhxvtmtzTfoBvonckCIIy4JVVIAtgOIwZOyibgLo:TFQq3uwgGhDIUBva5IyrAXsRJ
TLSH
T1B5C24C32D8A8CDB7ECEB4E89A74A7613EEF01163949C9AD8D5D84D1D00971DE170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5824cb6b103aaf33e61be9d2e5e4fa61d3f2f8729b11d388b56f243e5bf6bf78
MD5 4ec22e669b0a9d15dedeba9abd1e1824
SHA1 0eb08122e82249246612e75933e05938b1459286
SHA512 6b57c0338e439cb5edf287e1339c59c5b710f96f222cf285a1a72645d945bc179ee76b0ee163d00d70ecfd4de9c436cbdad0330f26cabd21377f724607763ff1
SSDEEP 384:nUiFiZcIB38N98TUNTUlIRtQnhxvhmtzTfoBvonckCIIy4JVVnAtgOIwZOyibgLo:vFQB3uwgGhPIUBva5IyGAXsRJ
TLSH
T166E2A3F194E789B7E89E4B87677D6E1299FCC123B4888694B7C44D1CCC921BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ca523854ec7129f7a85bd7c740f96224bc322230ee4e20fe9f590fd257e79e6d
MD5 29f22765fb4d7ecb7f3a67c3f78c2bc5
SHA1 4d7c0604f468678975ef386fe8b1cd959e3d8c6c
SHA512 90a6f563a190e339d979f1694d93656f8fe233a3e66d3cae381982db7114393419eec30019e909cc1580c867755114b4363ee90530fbd3eef0e49b3dc5583354
SSDEEP 384:zLiFiZcI638NX8TUNTUlIxBQnhxqFLitzTfoBvonckCII3b7O6R2FeohqgL/7IzO:yFQ63owg2hCL8UBva5I3b7TRo9
TLSH
T1DFC24A32ECA8CABBECEA8ED9A74A7606EDF04163958C9AD4E5CC1D1D00D759D130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-196-0x000001FD17560000-0x000001FD18560000-memory.dmp

Download