hxxps://nulledservices[.]xyz/luckyware/

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nulledservices.xyz/luckyware/
Sample260623-yncvbsfz6y

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267181453119228"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{C7D29C20-9061-4296-BAE7-E7AB071C22EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5940	5048	msedge.exe	88
PID 5048 wrote to memory of 3644	5048	msedge.exe	89
PID 5048 wrote to memory of 1408	5048	msedge.exe	90
PID 5048 wrote to memory of 3644	5048	msedge.exe	89
PID 5048 wrote to memory of 6012	5048	msedge.exe	91
PID 5048 wrote to memory of 3644	5048	msedge.exe	89
PID 5048 wrote to memory of 6012	5048	msedge.exe	91
PID 5048 wrote to memory of 2728	5048	msedge.exe	93
PID 5048 wrote to memory of 2728	5048	msedge.exe	93
PID 5048 wrote to memory of 2728	5048	msedge.exe	93
PID 5048 wrote to memory of 2392	5048	msedge.exe	94
PID 5048 wrote to memory of 2392	5048	msedge.exe	94
PID 5048 wrote to memory of 2392	5048	msedge.exe	94
PID 5048 wrote to memory of 2964	5048	msedge.exe	96
PID 5048 wrote to memory of 5868	5048	msedge.exe	95
PID 5048 wrote to memory of 2964	5048	msedge.exe	96
PID 5048 wrote to memory of 2964	5048	msedge.exe	96
PID 5048 wrote to memory of 5868	5048	msedge.exe	95
PID 5048 wrote to memory of 5868	5048	msedge.exe	95
PID 5048 wrote to memory of 6000	5048	msedge.exe	98
PID 5048 wrote to memory of 6000	5048	msedge.exe	98
PID 5048 wrote to memory of 3000	5048	msedge.exe	99
PID 5048 wrote to memory of 3000	5048	msedge.exe	99
PID 5048 wrote to memory of 1244	5048	msedge.exe	101
PID 5048 wrote to memory of 3772	5048	msedge.exe	105
PID 5048 wrote to memory of 5588	5048	msedge.exe	106
PID 5048 wrote to memory of 4924	5048	msedge.exe	107
PID 5048 wrote to memory of 4072	5048	msedge.exe	108
PID 5048 wrote to memory of 4072	5048	msedge.exe	108
PID 5048 wrote to memory of 2496	5048	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nulledservices.xyz/luckyware/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ff9fbebc188,0x7ff9fbebc194,0x7ff9fbebc1a0
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7735626890966577534,2070388221438449902,262144 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,14493810153862689543,12431461661666541621,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,10541286408802972211,17673252698311019751,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,17592724751621738858,16933205077276244504,2097152 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,13261181394108724160,5153629497046207366,2097152 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,2103096280489495788,17023914764319389129,2097152 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,2710883892601083723,1119296329766310196,2097152 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,2287835426890142050,2015577518817629277,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,995566672695620555,9210899218299910334,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15565691443125874454,9126218628883501254,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15565691443125874454,9126218628883501254,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,8951293342991116158,4624373447980284716,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,932734824124177214,247570802390253171,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,9766895443845258040,15830083992040914281,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,8414735350514510402,10733864437247627036,524288 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,12650342105391004127,1888540624765553035,262144 --field-trial-handle=2296,i,17575533727717811384,13008691519295469934,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4d8b553e250e3666cfe627669e878a833ac3fffa8d3305c4db1e394870ea7b0
MD5 43a66221d3b25e5b76fe2ef93ce25cf8
SHA1 c147318ab497b6cd12fd638c135e7093874e867e
SHA512 fcd75948b76cfc0a8aaaad0d3094719a1482549747b91547080832e5aef23494d6b5e0effb0ed5c6d3468c13a2b2b5b381c284bf8f5e21ad016cec888134e0dd
TLSH
T12A71717063ED0026EBFDC7B51ED7108BF3B65DCC3687AE131496B8B258C5BB05A81A85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593917.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593917.TMP
Size 3KB
SHA256 8fcf16ded838efa3054537b33c3be881f3e27f5887984d4afc14c7f5ea05542f
MD5 fe3a7b06dd926d6af2a32289756ac98d
SHA1 cd701f343b47d88b9c74a9cdfe0d6450cf4d6887
SHA512 f297726e2faf12ae7555f6c2031f094b5867aa6acdf9947928f54a324ccf1c2f2b6c4478e7312037f2d5df9246171b3f45547ea4240311670135a3afb037359b
TLSH
T1F56170B0639D0025EBFDC7B51ED7108BF3B25DCC3587AE13049678B258C5BB05A81685
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7baba95bc201378a8db44c0e75184498216775e9553ddc78f2b6ff1eea640f96
MD5 79800e5a427fb2db7aba856ded336b89
SHA1 97ab1eb0cf931e9cda65434cb6b3aeed368cb871
SHA512 1d8dccfd42427adbd6573915ec2733601690438af480ebcc556ee7332e6d0fdcb4e010a0c88e6854554f2b21414b57264b60ccd63cc99b72ed6e8e81b6c664a2
TLSH
T143818BB7C2F8CA6D991256F0AA143F2FDE190924432C3D5AC6E89F4FA3F6470E10164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 28e1c718ca492acc5670e1c39484bcda4f90e21b48d9869c96fdbf9bad7d0b9b
MD5 3524231d6b180ab49596cf559f28d382
SHA1 ae50bfeed0c459a96f77cf2b002ab4ae692d5b8f
SHA512 b0f209d8b2fbe02d4a47aefba218509151469d9b5362ade586ed8d1c4d7a814d417813d181a205e33264489b8b4cc3b9b8efa6c8fb365f72f4c2ab63a86f7a80
SSDEEP 192:sxRGRxyM/jK1Ml8wFh/fXsybXzMdybwzoA8p55/g6+WN76h/Y4pV2GBIgIJ:sxRGpbh/fXsybXIaj/5A/ns
TLSH
T1C762C816563899778CDBD209FA51BF53D6F91573B2901E48AAFCDA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 63878d4171fb6d536badc90e66138ae743118d1f14e96dad372dc9133ecaab8b
MD5 e67ef95588e4c9757d8971da442822b5
SHA1 26dfbf0093fca31c5ae86c65359bda5f13493969
SHA512 729342d9e2cc0b7ca6d689ca1d781012850f9d19a4213823290f214a25055d5ea6a86f2953b66e51fe87fe26165d40bb97b6f2b429bc1bb04483362146b768f8
SSDEEP 192:sxR5RxyM/jK1Ml8wFh/fXsKZbXzMdybwzoA8p55/g6+WN76h/Y4pV2GBIgD8J:sxR5pbh/fXs+bXIaj/5A/nM
TLSH
T12262B816563859778CDBD209FA51BF53D6F81573B2901E48AAFCDA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 550328670da7f2f83a0085ea1df410aae6e4a7e6315c7d66bac9b5d81199f955
MD5 f83e42a3358f8d367c078202fc9985ab
SHA1 48f08f572ff857e1b607b53907bf4b0fe316ddab
SHA512 bfc116b603fc7a7859626502b35f4e28281ec7c5347f70567aff2c6c8a9894fa524cf038e74669162248a397f0b4235d7ca59282e7a5dad9eb41c7364c617084
SSDEEP 192:sxR5RxyM/jK1Ml8UQzFh/fXsKZJXzMdybwzoA8pn5/g6+WN76h/Y4pE2GBIgDeJ:sxR5pqph/fXs+JXIa5/5A/w2
TLSH
T14162A816563859778CDBD209F951BB53D6F91573A2901E48AAFCCB0C00E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e957d279f86af2bb04ec3f6303c483539d01cb14f6a275734d6bb548c8a14a91
MD5 7e7c4dfd237ec41de36afec6350655e4
SHA1 ed4567d345a4cca95ce4a239abf6903101edee3c
SHA512 760c022aa31a2459ca7550f9744f28846f37cc6ffa9e5beac6cf804ec84a1d299cf15cb1ca7c56e80836a90b15c49f4958a5351538fd834489cdddbde13cf1e0
SSDEEP 768:NmymipWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1LxgqroRLPN2Dg:NmymipWgvHfSvu1ja8NgBRLPgc
TLSH
T1EFC20C3B640CC77E4F845EADEC29AE976DD801CB9B588D5447EA880C03C67FB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 44d1ad3954083272921074c48c75fd7b9b592ca7cda29ebbd5091c02520917ec
MD5 b24743d02cf15aace8a5d7d3cf76eca8
SHA1 1ade612b08f630396eb399ebdfe0c33e8c415846
SHA512 ad6f23b51659735ffba293b086e770a4df0b52e667156d167448efa80f39ce804213f28c71b0482c53f0ff97fb05b4b4bf5c3c76e04651237dadb05f9cbb40a0
SSDEEP 48:KgDIhKggE7ylhI9KiowfqF2a04sk84nPInSkKeBWMkC60VH065yz:KgD6KggaWhCKiox3qK8gaY
TLSH
T1FF914111357A2311387D29089061D65F67417063329AF82F7BAD68F30EABE401EFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b28557bb-f45f-4dc4-8ca0-ff28256f9293.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b28557bb-f45f-4dc4-8ca0-ff28256f9293.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6e2c55a552968963541dcc4ffe8f88bc6e780120128429a223de47c43d5e5372
MD5 f2ce4c50e41cdbeb5ce91a9eceff6686
SHA1 0ae46b83f23ac5c58e26b5aa189584559b9c0cf7
SHA512 5ead4db44cc08b5494c04bc3de646551e0c1ec9b032c72c3c611a998ad8f99c50b547676ef86733bce35cf7b6c3a4602d93e86c7e884bceb1503c538a3be2be8
SSDEEP 768:qj+9t3fltfyefHfsA7NpespIRM0UmkTziwjgzSnGl30:J9t3fXfhfHfRQsZ0UmYHGlk
TLSH
T149F2BF32A8659EA34CF9D78976033B0B7EF0134392C42A84D9DE6F0D44C76AD634B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 76163f9f41a1e5ef0a06e7043d5006218adffa5ab16f341cad23049e3bd415e6
MD5 aded5d15b2fa986823d7e2584a4355b1
SHA1 03960ae3d8a6ea894697e6efcd8cad9d39702331
SHA512 871e42cdbe56eb48f8d60f938c9014ac2b9a55efd0900ff71732e7f9d2412af9c8400a4b5de6cd997d65fc5000aad91adc9b3a8ca8d24e24d7e85b62f8bcdda2
SSDEEP 768:qjaeqD4MlshiLdMmz3ojtfyefHfUA7NpespIRM0UmkTziwjgzSnJ0/TO:qqcjhIdMQ3opfhfHfpQsZ0UmYHWq
TLSH
T1A803B072D8645DB78DB6E68A6A033647AFF00253C2C43A889CDD6E0D45972ED170FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 33f1508a48d89c358aa8996b18e22b8803b075efc77550478ad2189f27ec905a
MD5 b7045eef746413ab72d1af9a383b33e0
SHA1 32050de754be30c9f0f86dafa9b06f2c362bd4cf
SHA512 03f143a4158e29c7772d762d1ca648989614aa42ea3995d655fe2c275954adde50dc82d367c87dfafd7651e03d8df6efa0bc85099e9076bd6fe5d5064a1145fc
SSDEEP 768:lj+9t3oltfyefHfsA7NpespIRM0UmkTziwjgzSnGl30:Q9t3oXfhfHfRQsZ0UmYHGlk
TLSH
T176F2BF32A8659EA34CF9D7897A033B0B6EF0035392C42A84DDDE6F0D45C76AD634B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 c27cab3e299167b5d9dee44fe0603647dcd572ae20c25624596c8fa21d0764e9
MD5 681c002836c1c19e3ed4cd686ca63ee2
SHA1 abffe453e71f525e3d824645172ab9d5de04f4a9
SHA512 a7384794da20f89f1f94c434040876b03843afc122b164d9e2dc2e12040a0553aa36b7971dd3f127fb3af981a9555e2c87e1d64b3591c0270bca773907e64c1c
SSDEEP 768:FF1j+9P3mwgcWtfyefHfhA7NpespIRM0UmkTziwjgzSnGl30:M9P3lcfhfHfIQsZ0UmYHGlk
TLSH
T191136BF298D38976CCAD8B47673E2E066DBCC253B1806584BBD9590CCC871BFD30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cd7813d059c8cbde4bf2c749628b88fa2a5bd99164d8260e691e0492acbdec28
MD5 9333838f50e2400ed3fcb702346c283d
SHA1 a39b7505af4a70f5b45a118cdee12751f779a6e2
SHA512 f5a80372bd53c023a32b76ba2c7ffe5d8acf24f41eaf713f6454a7fea2942c0518a1431f651966af1d185a2e9e3bc175cf1409c218718e4665344120632f6d03
SSDEEP 768:3jaeqD4MlshiLdMmf31UfyefFA7NpespIRM0UmkTziwjgzGmnApXLPQTU:3qcjhIdMo3+fhf8QsZ0UmYunKXD
TLSH
T1AA03C036D8604DB78CB6E68A264336576FB00293D2C43EC8DCEE6E0D41872DD670796B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9440cf60-7f47-457d-9c80-5f20c60da328.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9440cf60-7f47-457d-9c80-5f20c60da328.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download