hxxps://loader[.]jewhack[.]org

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://loader.jewhack.org
Sample260928-e8nmsavt5n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{CB160E7D-0693-4F09-8F6E-1A2B81A18074}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2836	1872	msedge.exe	86
PID 1872 wrote to memory of 3868	1872	msedge.exe	88
PID 1872 wrote to memory of 4480	1872	msedge.exe	87
PID 1872 wrote to memory of 3868	1872	msedge.exe	88
PID 1872 wrote to memory of 3868	1872	msedge.exe	88
PID 1872 wrote to memory of 4644	1872	msedge.exe	90
PID 1872 wrote to memory of 4644	1872	msedge.exe	90
PID 1872 wrote to memory of 4644	1872	msedge.exe	90
PID 1872 wrote to memory of 1160	1872	msedge.exe	91
PID 1872 wrote to memory of 1160	1872	msedge.exe	91
PID 1872 wrote to memory of 1160	1872	msedge.exe	91
PID 1872 wrote to memory of 5116	1872	msedge.exe	89
PID 1872 wrote to memory of 5116	1872	msedge.exe	89
PID 1872 wrote to memory of 3064	1872	msedge.exe	93
PID 1872 wrote to memory of 3064	1872	msedge.exe	93
PID 1872 wrote to memory of 3064	1872	msedge.exe	93
PID 1872 wrote to memory of 456	1872	msedge.exe	94
PID 1872 wrote to memory of 456	1872	msedge.exe	94
PID 1872 wrote to memory of 456	1872	msedge.exe	94
PID 1872 wrote to memory of 1868	1872	msedge.exe	100
PID 1872 wrote to memory of 1868	1872	msedge.exe	100
PID 1872 wrote to memory of 3252	1872	msedge.exe	101
PID 1872 wrote to memory of 3252	1872	msedge.exe	101
PID 1872 wrote to memory of 4900	1872	msedge.exe	103
PID 1872 wrote to memory of 3244	1872	msedge.exe	115
PID 1872 wrote to memory of 3972	1872	msedge.exe	116
PID 1872 wrote to memory of 376	1872	msedge.exe	117
PID 1872 wrote to memory of 1072	1872	msedge.exe	121
PID 1872 wrote to memory of 1072	1872	msedge.exe	121
PID 1872 wrote to memory of 4816	1872	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://loader.jewhack.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ffa3288c188,0x7ffa3288c194,0x7ffa3288c1a0
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,281944012666072891,18306735838889032384,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1875520264817527389,12358968582984240978,262144 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,8052657811319204595,7308641663349445501,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,505567555725157864,7279404793085907449,2097152 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,14377615115722730919,7307682638477269761,2097152 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,6159924746164336457,13678233821706024682,2097152 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,16105437055393293779,6412171333297070849,2097152 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,15973734737464857654,12777062850937019495,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,10109552200657694539,17075380157078710107,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,6079534073352693466,10763025399993931257,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,6079534073352693466,10763025399993931257,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,12401402476253672148,16062144047711671334,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10451978602374925601,15422140562010981768,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,11572261528209154279,14408015339605299780,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,16045266109959544701,13228342174511445003,524288 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5772,i,7094009573328576457,3750195857154096398,262144 --field-trial-handle=2456,i,5378995533163235302,7604911368839300717,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ada4ab2ca66dd9f6e94468f1eb3454054759669a068343fb37c0c3bde3574afb
MD5 7e9b3c6105d1b6f14f51224f67ba709f
SHA1 2cda450cad112216625144c383afda8e0c5d87e6
SHA512 5aa0f529f7a68bf0ddcaf8a357b0d135d44916bcafcd484fb327999f75db5cf95c282f2a9bc76b7aa70d1ad574f6bcabf58aee29f0e70e60d6f38545ab4a72f5
TLSH
T15561A74412F08159F7987032D7D803B7B7307CB23BB79E31A1A8F57898663797128083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590e2f.TMP
Size 3KB
SHA256 830d08a52cd46257531229ef9459ffa2895599f97b13ecb71c72b399b0353c2a
MD5 58dccdfe828a24781ba2e26dcec09f48
SHA1 707d49dcd786715292082281f7215aa4db75c19d
SHA512 f8b38b4dec57b9928da2b910c7e4426eaf89da2b95145eeac8f123fd2fb7347511e35d9ed8f8fc5313e089aed0c019affca9797a8584a645edbfa269f78f065e
TLSH
T11861A64416F08159F7987032D7D803B7BB307CB23AB79E32A1A8F67898663797128083
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 edded443ba46f0a18cbaae84117e0b1814286809fb80d70f4e730bf939b9d6fb
MD5 559bf3b161bea904dceb70b082b40be9
SHA1 3cb1186ec8e55282f2ffa32f6aae30e28bc07cfa
SHA512 85e9e69c379e5a77e64be934958c9fc44a1d02a0d7b947b073faa2ed58f6c696014f8e62bdccd6f5a82671ddff527903503839521dc8adee32cf1e18e7b78c39
TLSH
T1BB214CF3C3E4856ECD1116F59A24AF1BCE1D0915831C3C2A85D8AF2BD3E2475E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b18637eb70bb6704b9dbf141f9e6b901e9bb500c14eed2996eca5122986916b7
MD5 ee7b9274c670ed3ee08239fcd2543876
SHA1 c73dca624e5a2745c953be015a5df8f5e2f294d5
SHA512 d5a385ef98974cf5e149b8433ad468f25a4792ec145a8591968c638b165aaa9ca3137a6bedc4af88f62c3cdda6aea3e1ed7718b7d950cda9e8eeb18c7b66e0e9
SSDEEP 192:sxZ7RLWW/f7sZBaY9IdpkxHW6+WNqJG/YrmrlIgrJ:sxZ70W/f7sZ8hIHbj/39
TLSH
T14222B7526E38A97B8CC7D219BA15BF13D6F9503291D51E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac8f4fdbed99e4879c849135fef015332179d5ef222802586c8da4192e8b60a1
MD5 ad7b4a8ebae59da0c7c4d4d4987764b1
SHA1 502d23dcccd4a27770d13d993cba20a4e58df104
SHA512 9efe0ab56dc270c6da7344339d7fabc68803da9cdeaa6ebab8aabe2e9d8f639aab8d8c87c45bcec440f5b19bc5ab34fe60a42ae3d76eba0907640a455c775e91
SSDEEP 192:sxZ7RLWW/f7sNBOY9Idp6xHW6+WNqJG/Yr6rlIg5PJ:sxZ70W/f7sN0hKHbj/pL
TLSH
T1E122C8526E38A97B8CC7E219BA15BF13D6F9503251951E48EAFC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 32d6e69faa6e6ebfc59249aed002295deb5e3662dd02cd5815a88605b5cbcc2a
MD5 3a08d0f60da4025ec3bdea91fd8c1184
SHA1 fced9b5bc836462aa4df5715b35f7d89a1d146bc
SHA512 c9e15cc567a1ad31e7ea3040000c7eb4fa62a178985924bb453b0b6492f64b2fae27c9d8879a2db6a5cee75bd1e41f224329f22a1611f001a648f3cc5e328890
SSDEEP 192:sxZ7RLWW/f7sNBOY9IdpkxHW6+WNqJG/YrCrlIg5PJ:sxZ70W/f7sN0hIHbj/VL
TLSH
T1E522D7526E38A97B8CC7E219BB15BF13E6F9503251D51E48EAFC861C05F7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d0c2508eb941dafa0a350c3f239981e43b1093af001246aa155e111ce7d395d6
MD5 edef03b4b4492d6fa73e76b73d6bc280
SHA1 c0fc642c80fb02d3ca1e8bbce8acfac9ea4a95b8
SHA512 b24c0dc7b9c719c6f307b0485f93c0a5ffa12fbe2e57c3705ee49f7d68871e9f70c6c8ac2610f981043d86f08e72af0838cdb0e38d28a6f983a4b9c92829665f
SSDEEP 192:sxZ7RLWW/f7sNBaY9IdpkxHW6+WNqJG/YrmrlIg5lJ:sxZ70W/f7sN8hIHbj/3l
TLSH
T1AB22D6526E38A97B8CC7D219BB15BF13D6F9503291D51E48EAFC861C05E7AED220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9c49333a1a8c009c3cb1a37fdadf20a2f7e91c5e6a9dd91b5545f554c33ad839
MD5 2749f3d783db1e1ec74aed740c4096be
SHA1 f934cd84817e5debb5db394dcdf5df9c2cebc8b1
SHA512 dd970dc3b8d2601a302919d7858a450887dcc692e84e9a922b6fb1eb6c4ba93d6f777155f6bdd55521701412cd6e5be7f673cfdd6a34fad5b45028b4a9433d95
SSDEEP 768:Wzy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbJroRj7:Wzy4J/DWvbtBhu1jajiLm0bih7
TLSH
T113C20B3B644CCA7E4FC00A9DED5E6F9B3E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6eb37ac3ec230f507f54820a834e2e84995d12f03d8cc99267b3d2e904dc7eba
MD5 6f1549a9a7d947d97a776a822ae01b2b
SHA1 cb7c26bd8489eea49ad25114f31fb56a853e83ed
SHA512 2b48f29b2a11bb34da119fa6b98965ca42d8f94ec9db18c26740f022ed96032aee5493c74d343ec52ecd88dc95cde4a47a842d4580dd2ebc2a7c3b2936e67925
SSDEEP 48:KIDI1Ks04jyLUjiu8+SbbiRqISGbK9i1wbxULY5ayoyLaFoUaYoZbED0ISMZK9wt:KIDCKs0+eLGKYk6WViK2M4
TLSH
T13091DD9831BF124138BD259880B1CB1B625132B7755CEA7AFFBC50615E6BE081DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63a9b001-4c3d-47e2-bab3-7c026834ddad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\63a9b001-4c3d-47e2-bab3-7c026834ddad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6593e231d1d45e0b94fbd2cb4bfd8576c0b639a871a332399b850f8273ce3962
MD5 00421ab52998ecac7c241493cc6d0f24
SHA1 34391f4d38b19afed120af846706acef13b07a9f
SHA512 f78399a95589b74db6297eaa7a3f2eb14e40e1d89fca113139941984dbfe7503200bbeb354d74da0b2415b443e44f1e6e25a2855908328f49e192abc9ff880f5
SSDEEP 384:OiFiZcIzzsNy8TUNTUlIlOg4ZVfOHX58ED8pXR+2/fGtgOIwZOyQgog:lFQXDwg347Ia5RlXGXsy7
TLSH
T1BCC23AF248D7997AD8AE5743A37E2D028EBCD067F585A750B3984A1DCC561BFC30AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc6477d320a0667578e1e6578d0c7e88f57fdc94605bcd792b02242d712e79a5
MD5 a442d24c3e7c6e60090492746d6ff095
SHA1 badf4f152df32e1ef07be6fed0b245928225a37a
SHA512 dc63cd995ae2c82c2d3eb6bffafd25d5793810f44ce66662837f8b6c3efc359a68811fd57c438160943a60c71a6b7832e4501ebc23391058fc479f84645c3f76
SSDEEP 192:1ONGS6wlD7QmiUyRRq4X58gZTjzor2cX77R+2rzMve/qlU6:1ONj6ktKq4X58ED8pXR+2/nGU6
TLSH
T19F121831E468BC2B5DE2A545F08B35039FE9512BDB4A6F90C6EC1A2C01DF2AC534BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 663b38af7f113764fa99fd413359e5d959d0fe46cdf01c86e2880ea94febf08f
MD5 aa43d7cd0c4ecf28af1924e032a4d6e6
SHA1 aec6cebde261e6a116c093dedadd91d9c7f44119
SHA512 9918533e1c26b190e85fe7fa8fdd5d1909f4a2c3e54cec9134a0ba08a34e905c3fcb97b618c2915e04b97432d1ad7a834bfc53e66c77c401e272f7933d940911
SSDEEP 384:nZcIhsNqOg4ZVeOHX58ED8pXR+2/wGtgOIwZOyQgog:PhL46Ia5RlIGXsy7
TLSH
T197828D7299B86D7B5CF7A244F14A35035FF85027D3C96B90C6FC5B1D019A5A8130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2d6169ced7b7169936a30b90651f629cf3d3a6ca02c9d5825b4d3d4941c9988
MD5 8c49f40eb2163572b75f9ecd6f65d246
SHA1 284cf1dbd7f0680ca0dd9d2f51ad39a4f8119299
SHA512 23bf9618edd331305a39b8fdd89c24ee36e2bff8757cbcfdad42d68db24c52f96f6cd4189ed2b4998b768b5c83ef5c11db75e46187bfac9d860b2c91148cfea4
SSDEEP 192:1ONV6wlDgQmiUynRW4X58gZTjzor22DlpDU6:1ONV6kguW4X58ED8xNU6
TLSH
T1FC02D935A9687C6B8EF3AD09F48636139FE4212BD6566F40CAEC1A2D00DB65C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1a4c4485eacbb74bc00c43d52881c54e6e9b3dcc37a7a44f5693620cfe318c27
MD5 aef76108607585f5a4330437d3f4e623
SHA1 4a3af367ceffa501ab0bc479d35ea98462857d34
SHA512 72665fa616fb81f2f34298535918bb21eff16f8b1f9501a221a03559a964b7e6c958d618d1758cc68cee0ed7f51aaa6a8de9a1ba3a3152284eb7569aff14b0ca
SSDEEP 384:ZZcIhsNqrg4ZVeOHX58ED8pXR+2/wGtgOIwZOyQgog:xhK46Ia5RlIGXsy7
TLSH
T142827C3299B8AD7B5CF7A244F18A35035FF89027D7C96B90C6FC5B2D019A5A8130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

530dcd76-4021-4550-b95a-0636cfad9b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\530dcd76-4021-4550-b95a-0636cfad9b85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9817ea53049a4070e2c44790326c5e6d4ff94c3b1d9bfa1a44a686494efded0d
MD5 091e4c7caccf5212d355dc7e0f08d0fd
SHA1 4f1fe9483e1b2f79df07a4e3b5041cf5ff75959f
SHA512 2b3616fcdceb719550510778752ed05d8e3be91a4d0b465d1792ab3efa9120d7ecd6f4fd0998237dc48b33517196c09fa500160520cbd1878e9e3fe5c7d6b56e
TLSH
T1AB41E459B6E91148B3B76F56ABF6A86D847F78272F06D06D10010D8F0A62B01D972737
MD5 SHA1 SHA512 TLSH

Submit Download