hxxp://www[.]cwdriver[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.cwdriver.com/
Sample260820-xfztfstdlf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3824	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317253218462203"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{E0B5D497-18CF-4F21-A3C0-31E71449B3A2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2580	2956	msedge.exe	84
PID 2956 wrote to memory of 3824	2956	msedge.exe	85
PID 2956 wrote to memory of 1068	2956	msedge.exe	86
PID 2956 wrote to memory of 1068	2956	msedge.exe	86
PID 2956 wrote to memory of 1068	2956	msedge.exe	86
PID 2956 wrote to memory of 4516	2956	msedge.exe	87
PID 2956 wrote to memory of 4516	2956	msedge.exe	87
PID 2956 wrote to memory of 4460	2956	msedge.exe	89
PID 2956 wrote to memory of 4460	2956	msedge.exe	89
PID 2956 wrote to memory of 4460	2956	msedge.exe	89
PID 2956 wrote to memory of 2252	2956	msedge.exe	90
PID 2956 wrote to memory of 2252	2956	msedge.exe	90
PID 2956 wrote to memory of 2252	2956	msedge.exe	90
PID 2956 wrote to memory of 2800	2956	msedge.exe	91
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 2800	2956	msedge.exe	91
PID 2956 wrote to memory of 2800	2956	msedge.exe	91
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 680	2956	msedge.exe	96
PID 2956 wrote to memory of 680	2956	msedge.exe	96
PID 2956 wrote to memory of 680	2956	msedge.exe	96
PID 2956 wrote to memory of 4668	2956	msedge.exe	97
PID 2956 wrote to memory of 4668	2956	msedge.exe	97
PID 2956 wrote to memory of 1128	2956	msedge.exe	98
PID 2956 wrote to memory of 1128	2956	msedge.exe	98
PID 2956 wrote to memory of 4324	2956	msedge.exe	99
PID 2956 wrote to memory of 4324	2956	msedge.exe	99
PID 2956 wrote to memory of 4324	2956	msedge.exe	99
PID 2956 wrote to memory of 4064	2956	msedge.exe	100
PID 2956 wrote to memory of 4064	2956	msedge.exe	100
PID 2956 wrote to memory of 1892	2956	msedge.exe	103
PID 2956 wrote to memory of 3628	2956	msedge.exe	113
PID 2956 wrote to memory of 2420	2956	msedge.exe	114
PID 2956 wrote to memory of 3956	2956	msedge.exe	115
PID 2956 wrote to memory of 4824	2956	msedge.exe	117
PID 2956 wrote to memory of 4824	2956	msedge.exe	117
PID 2956 wrote to memory of 3748	2956	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.cwdriver.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,3531635794878836403,17134862383490241455,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,15482749302656488461,13664476800206331315,262144 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2352091683993926444,8199446873333123639,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,9767456292790617030,2149652335199187626,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,3280350027918802701,17426604530281751487,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,4630199217366196518,9192451869032105206,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,12296451548917648114,6083021876234675554,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4316,i,8282509669134227751,15040380283298865829,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11950436730093696352,4522654510529213767,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,603756950024277332,3456542571273799365,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,12417105404848765683,1179411097666600063,2097152 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,9217118575952968824,6650881298086350548,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14293020742877796992,16222279950425256976,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14293020742877796992,16222279950425256976,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6870298223124798632,10290252334053212930,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12342968401450019194,15119477969352648328,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,879671113578325163,6460181993748289289,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,16121178142821725461,16964044985810778357,524288 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,37068996128657397,2746658373496011590,262144 --field-trial-handle=2252,i,15139613263980598181,2602584646039466451,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f6b485e40234e183c4c869fcbef7860c8e40996856e0f613dbe564623023cab
MD5 39b6d152e9d3188d11ce59f66714ffc4
SHA1 672366c82a57ba2ee56ce1bebec053d57b4027a5
SHA512 7887dcfa8dfe2fb04f314dbd040d338622b0a4113286072969197216db6c63a2c5d9474828f23a2f83715da8de908aa05241abea5ae1cc3010c79f576ac1ccf6
TLSH
T12E717037CA55C063FF6611B288C305D9747F89ECF617AE5E122316BD3718B6AC1A9780
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d1a.TMP
Size 3KB
SHA256 19a7d7587e9f0ad29a94b23badd88c907f47ff116e7694ec8fcb909f8f320987
MD5 0f40f755fd473aceede6e925cb8be3e6
SHA1 b83dfa296dcaeb396fe562169b4b49e6525986be
SHA512 62dc32ad58215fecb9a5810ddb3d676cb343875e944ed1e95faef854bc6f62aa5eea3d6226bd819b218769ddabbe557f89ca8b20a04d606bfd3fb6a340870690
TLSH
T197615E378A11C463FB6601B298D301DA747F89ECF4175E8D1117157D7718B29C268384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a6e53d4ebb85bc717264b9f69d01aeae17f9a5d8b2875186fcaecc01134959d3
MD5 831466cdc57520162dfe69f4736d559a
SHA1 cdcd0b7d99dfe8558d1d8d4cee388b11167bee0e
SHA512 684f1e078b7b6ce368bfeabb06b5ab55dc532da62529b92a61f6fad06a532bc41369ee3c8405a2ba3674502a8790492807b528025906e92b4cf7c051a363ca2e
SSDEEP 48:YALlNFOcVnPcVpcexcegceDcV+s3zEsMcTsrcTgc6sjc8MsEcFcyc8Egc4EsncTg:DPOYQ/+tszw3bex42xxvjjwE3IUVwQ
TLSH
T1299168EB97E4963DDE2163F066152E1FCE5E0918C3383C2B89D5AF1B93E2471D10169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b6bf9a1c-40ca-47ae-b30a-5039bcaa640a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6bf9a1c-40ca-47ae-b30a-5039bcaa640a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 055c317d21d8abfcd913271b0a8cd75e00384371406e1097901f5a5729fa4983
MD5 473e056efce29364377a4e41ae1de9e2
SHA1 a8996b1d96928df0fa2c9260d2aab9e4a48bffb3
SHA512 55d2d334bc0d3e45c92757fd0d4d6f9da4ebdd331d2758a8af3666722b9408f1a4d05ae527064bf45bde081a56ed6bc436915fa76b40229a684c4b1ecda1b9c8
SSDEEP 192:sxZyRAkq/fCsI/UhIdpouHW6+WN0dzVYCd9ra+SIg51J:sxZy5q/fCsIcKnHbiVvatR
TLSH
T12522C8526E38A9778CCBE219BA15BF53E2F9503295D01F48EAFC861C05E76CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b5a7fe27aea95c2e1aca1a999ad79d62098f02ac1c2267e9c39483cab6f52614
MD5 c465aa15fef0eda580026d3b85f154e9
SHA1 64d788a1b6e57bf64ccfdd59a6fd36a304865500
SHA512 4eac04012ee4ca0971d47879ae754d5f775bf7e1f32cd9d1bb8dfe910ea099ecf83efa7c437afc8f5d014b0b95507ec84acb3b288d644f6c71feca591f27de18
SSDEEP 192:sxZyRAkq/fCsI/9hIdpouHW6+WN0QO9YCu9ra+SIg5fJ:sxZy5q/fCsI1KnHbG9Oat3
TLSH
T18A32C9526E28A9778CCBE21DBA15BF53E3F9503295D11F48AAFC8A1C05E76CD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3362ad24fcfd66cd273cc25300b421ec2cca73f3701fb04c97dfd0eaa5665dac
MD5 562ea369a0ce3d3f1a0bfa7431e1493d
SHA1 bd8a12cd46a8033ee44880bfda306de7f80fa02a
SHA512 c35b306e6e3c5871f18bc790e72f382db4bc171c1e605f213779d6af88ae2015eed1d81edf39c059a5656e375c5dca940b6163094c186efe763bfc85e6638caa
SSDEEP 768:9PqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrKroxf:9PqbUj+WvSCs6u1jaaZLbWrhxf
TLSH
T1ABC2E93B340CCA7E4FC01A9DDD5A6F972EA802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 a2d59fd0586b778d6ad0c4db38c756bbb114dee0e11c82d46d938ddac689c5d9
MD5 3d431be278044bd8da86c4eeafd35f28
SHA1 9a6694140822f8ab67e92af3f834454b09255da3
SHA512 ea3243a5fedcdea115a63acea2357d4d1717ef71311f848c7104f1580c8563a31ea4717be1f7e601511b3175d30b57568e345df5485f95b751b954cce09be609
TLSH
T177211A1163FA06003D7F650C8994F46AB68130733496F43E7768887B4BA7E5159FE9CA
MD5 SHA1 SHA512 TLSH

Submit Download

c989daa4-a59c-4863-ad65-d737fba187c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c989daa4-a59c-4863-ad65-d737fba187c2.tmp
Size 10KB
SHA256 59181830d4f82c8f5c84e3d4fcd91e4b97b716831ca86b69041bf54c03d146a8
MD5 a81745e4fd58d44f15408d2fb78d3129
SHA1 c0d366fea252f9f04d46091fe8f8512a6d28ee47
SHA512 443f7de1d016bba1270eb525226d50eb7d868caa2fbe7493090b7c29337108106af100d4ed1f6d5fc901e8a0d536117cd11fc0c542045bbb05fc2d24f95f42a6
SSDEEP 192:sxZyRAkq/fCs9/UhIdpouHW6+WN0Gl/YCG9ra+SIgrJ:sxZy5q/fCs9cKnHb3/wat9
TLSH
T16322C8526E38A97B4CC7E219BA15BF53E2F9103295D45F48EAFC861C05E76CD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e91b6df3e30265ba1946a39b65c56013ef591773164b1501c2a7c73895ec740c
MD5 36c9545bdf22fa1db0c2199ee484ee2d
SHA1 8ba6ad4139abc52772c22922eb889a28fec3d673
SHA512 eb14008da0d16771b9cde0070500e3797b8dd42e924c32636108d6e44812dcd4b491872f25c4d54544ef52cd025f7f8c19e497a7682114a241e2a680c4bdfa13
SSDEEP 192:ubm+xasuheOwQxMGsNIUqQz9biXzQmiU1+xC84Ea+jN+FdChHtFXam4Crqot4/t5:xZcIhsNIUqf1hTEa+edyjR4IivCUloe
TLSH
T16F827D325C785C7759E6E254F4873A07AFB890639ACE6B50D5DCDF1C00EAAA81327C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 efcb62c2a3ccffb3097881373f4b114bf8701f9f1a393b694121abeaf0692d66
MD5 965158324d054c19e0ef4e4c7d072c4e
SHA1 6ca1825bbd2b9e120fbcdef342fc94776b4994b1
SHA512 e556d7455b5644292e331ccd47a71109d45d7e8764b746cee110ec35670a62ee940b915b5a6e033079037c344bc12ade7fabb57d1078bfa9eea5fe11313aeae1
SSDEEP 192:vONu6Db6QmiUy+S7HBa+jN+FdCtRgYpU6:vONu6uaHBa+ed7MU6
TLSH
T11202E73568786CBB9AE26E49F4873B275FE4203BD9966B50DADC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9c186fa1201628e18a89daafa0b9e775b3680b5b91013709e20a6324140a5051
MD5 45eaac89e1b029ae0dbef689f6e757b1
SHA1 e06d8bf601d20492cbfd799b43b45fc500b8b67d
SHA512 a7fd9cb585f2a70017a9ef143daf037a858a14244133cf252795e677b63c54891ff0f21b501f0d27151c84fa7a3b37a4b7aa7d8da99ea3f3a596c88dcfbb3781
SSDEEP 384:hhqZcIUsNIUZf1GTEa+edyjy4IivCUloe:hCUfoa30W1idJ
TLSH
T1CDB228F118EB5836C59DA307A77E2D035EBCC023B9895A00B7D89B1CCC9A57FD316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 485bf674f6472008938a4b398ed29e7be409ae6431546807dfa7a27ad6db484b
MD5 748cf3b9ba8303b9db599205b53fb054
SHA1 bdc4f5557e058cc2038b78d2934819e5990cb78d
SHA512 d2ed0f2eec4568f9b85ab52931df6e1e7c0125826e17c6fd36a8f2a84fbba33efc3a688ce02abeda9ea682a43a5fd18b768015ce15fd4b3098cd6f65b61a518d
SSDEEP 192:uUtm+xasuheOwQxMGsNIUZQz9biXzQmiU1+xC84Ea+jN+FdChHtFXam4Crqot4/r:eZcIhsNIUZf1hTEa+edyjR4IivCUloe
TLSH
T1D9827D315C785C7659E6E644F4873A07AFB890239ACE6B5095DCDF1C00EBAA81327C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6981e986181372643cdb425ca870b9adcaa42f90269dd56c117b1906e414fb1
MD5 935b07cc93f80a696c3d0535ccdb62f7
SHA1 dd62f3f03c81547cf94dcd8ee774a4ff37581bfa
SHA512 d3b790e679689f6045fd945509628286d094427553ac66afb104acfc86b9fdd7b2bc4f86a1c87f591ea19fcf8cf6511256e65db4075bbf54a27ff0f3b114c6c9
SSDEEP 192:eONa6DblQmiUy+O7BBa+jN+FdChHtFvNz4CrqoU6:eONa6LOBBa+edyjp4IU6
TLSH
T19712083668786C7B9DD27954F88736139FE45127DE8A6B90D6DC5F0C00EBA5C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

933b1e81-9553-4a4b-8c6d-cd4a35701309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\933b1e81-9553-4a4b-8c6d-cd4a35701309.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea248c89c6863bd9e4c1b70fc734ccab0f65bdbf61f999a5fcf096e3aa0a43a8
MD5 c9dabaac5414c24845d100b6a4e78caf
SHA1 b3cd8008a736ccf012d8c9fc1c45bfc1107165ba
SHA512 635d84e288c81bf1bd0e0bbfe12575f85e79d21c48426f57b1ecd92cae5b6629b64c01083b141b311d0348b057e15931f10ee75b9152f05af42ec79516385348
TLSH
T13E410958ABE91118B3B77F5AAFF7A86D487EBC372E06905D10110E4F0A62B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download