hxxp://gozzi-casauxalsina[.]com/brivar/dylan[.]html

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
120s
max time network
112s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gozzi-casauxalsina.com/brivar/dylan.html
Sample260925-xzst9avcmd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4003929486-1233426720-3594832368-1000\{86796EC5-7AD8-45BF-A06C-A1CE7D318C3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4732	2352	msedge.exe	83
PID 2352 wrote to memory of 4988	2352	msedge.exe	84
PID 2352 wrote to memory of 4736	2352	msedge.exe	85
PID 2352 wrote to memory of 4736	2352	msedge.exe	85
PID 2352 wrote to memory of 4736	2352	msedge.exe	85
PID 2352 wrote to memory of 1204	2352	msedge.exe	86
PID 2352 wrote to memory of 1204	2352	msedge.exe	86
PID 2352 wrote to memory of 1744	2352	msedge.exe	87
PID 2352 wrote to memory of 1780	2352	msedge.exe	88
PID 2352 wrote to memory of 1744	2352	msedge.exe	87
PID 2352 wrote to memory of 1744	2352	msedge.exe	87
PID 2352 wrote to memory of 1780	2352	msedge.exe	88
PID 2352 wrote to memory of 1780	2352	msedge.exe	88
PID 2352 wrote to memory of 464	2352	msedge.exe	90
PID 2352 wrote to memory of 464	2352	msedge.exe	90
PID 2352 wrote to memory of 464	2352	msedge.exe	90
PID 2352 wrote to memory of 2904	2352	msedge.exe	91
PID 2352 wrote to memory of 2904	2352	msedge.exe	91
PID 2352 wrote to memory of 2904	2352	msedge.exe	91
PID 2352 wrote to memory of 4800	2352	msedge.exe	95
PID 2352 wrote to memory of 4800	2352	msedge.exe	95
PID 2352 wrote to memory of 4800	2352	msedge.exe	95
PID 2352 wrote to memory of 4828	2352	msedge.exe	96
PID 2352 wrote to memory of 5072	2352	msedge.exe	97
PID 2352 wrote to memory of 4828	2352	msedge.exe	96
PID 2352 wrote to memory of 5072	2352	msedge.exe	97
PID 2352 wrote to memory of 4992	2352	msedge.exe	99
PID 2352 wrote to memory of 3020	2352	msedge.exe	105
PID 2352 wrote to memory of 3020	2352	msedge.exe	105
PID 2352 wrote to memory of 3020	2352	msedge.exe	105
PID 2352 wrote to memory of 1776	2352	msedge.exe	109
PID 2352 wrote to memory of 2568	2352	msedge.exe	110
PID 2352 wrote to memory of 3320	2352	msedge.exe	111
PID 2352 wrote to memory of 660	2352	msedge.exe	112
PID 2352 wrote to memory of 660	2352	msedge.exe	112
PID 2352 wrote to memory of 2480	2352	msedge.exe	113
PID 2352 wrote to memory of 2480	2352	msedge.exe	113
PID 2352 wrote to memory of 4848	2352	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gozzi-casauxalsina.com/brivar/dylan.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff9e146c188,0x7ff9e146c194,0x7ff9e146c1a0
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12566880860622507281,8093664532065620485,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14714382948308501824,8702055415918578980,262144 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,11041172663187844651,7631029530957496631,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,15746620211211514664,11316528742310008887,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,3382997640481247061,10484824640926756766,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,12919776727286127188,4243416463141808600,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,3520062094397472758,7046546823216880161,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3588,i,14720469059459939428,2174201569865622612,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,18079724088562332485,17149861495102996553,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,6979788076650954653,14033415730954230627,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1124487130474724610,13805885894522354959,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,1124487130474724610,13805885894522354959,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,14290924868338924388,14753213984725346097,2097152 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,15260401737984365284,16670278468523262593,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,2747846565030091387,14553483220636544319,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,15019452654172346293,608751930216016408,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,7868457042037128269,1654220930704602373,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,17018695847970467139,14895726961336158325,524288 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,14471680216779307937,1500610261495793594,262144 --field-trial-handle=2200,i,1660360979232361667,8274514320067246168,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1fbd90963f1f01867a2b54dbce6397baef09a8a9e99457309e0a473a09d92142
MD5 988feeab7b905e1b260be24669cd9606
SHA1 7cdf44f3550c5556588639be0df60c0ee2626ee9
SHA512 b4d20ff0b3332f03393d852ad03bfc9f0f8a86fb8435754ccc302778b9f4bcc883041fb13f1d002ec464b30fbf38f7da41bba92f85b03b84230d5c5303bb2e9c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T152B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1c4b8cce31539f0d5bcd84945be8b47e4a7d8e745906a0f2c3136a815024ced
MD5 4df6d93c72b0b35ea429d00fa8d44c4e
SHA1 14b26cd574a47394e17afcf3b1f8539382eac18a
SHA512 bec1a58cd64bb4b95c2d295eb2181678e3a5c466fac5119b0c0273c3ef793de019b85323832613dd188b16138c66bf6bdcd8beb7144c514703189f99cd831b63
TLSH
T17CD02B988DC48561E0223438403349053349A4408D029093C1B10339088018204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7151f70a488efbce3d8d739a772444f20cb6a1ab3ca6bfbc3b269ea0535e48ec
MD5 3e729d9d2671674f3bfd818755ef402a
SHA1 3a2a8608ee6c0f8b397447816a250a15fe9bd66f
SHA512 d898a2368beba75703ead1a291c199153e41c8eb12d7aaa2fa01f99dd0bdf61950f4b55199f38ebc728b139d91a778299ce88c18c63bc0d298061cc4554fc1ac
TLSH
T18ED02B984DC48961E4223438403249053349A4408D02D193C1B1033908811C204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6b3c14578d60adda3bd34789ace5a4dd28353f7a2f79d74601b4c867494de66a
MD5 cfe994c44133e7f320a21f1b7fc54739
SHA1 2d65578f57c50b4b473a135841198228d3e5e7ae
SHA512 1dd38d4b4d6cc5d9b980105d040d0c655c40c848d865f96dd8ab0d17ec01d1d7e159fe9555245605fbbc84f833140240eec5e78a05fee2650a33c10c90f091f7
TLSH
T17761E48B5A504F54E7B98AF196D850C33A66E9B0D4D22B1C11ADFAFA4B42FF7407000E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f2d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f2d7.TMP
Size 3KB
SHA256 8931634ae86f52a909e89579a477c69c7626efdb136af893ab324e7b2a4367dd
MD5 997a50c555f917d116c9e44aba40500d
SHA1 6e5af7ba05ac680e0c4a314a1baf36e03e11d169
SHA512 f5d2520efd4827c3e60022484237e885573ae7546baef268fdfecd9adff71731f8a514783e8c551da5e938d5640cb1dc37705a4a7096a568b94b909950ae526e
TLSH
T12F61E64B5A504F54E7B98AF196D450C33A66E9B0D4C22F1C116DF6FA4B42FF7007000E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ed94c4897521a141fa73e79dd05c11608c7a9e8f3c7ad6a7dff3be1eb1017de
MD5 2fe3d163845fcda48ad2588900852315
SHA1 b7790d3d23ad32649dc894c56265af1ae19dd8e3
SHA512 09921f348cf4a9657aa34146a97b7b31447205916a9c2424b45bb41dc3a0781b2343856ef12209ff98b7d247dc4621f62e8c46648ae3147118c98e1f8f0d63d2
TLSH
T1F9518DB386E4861E99115AF05B14BE2FCE1D0515437C3C6A8BD4EE9BD3D38B1E001B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6c6f0f108e2c82926c288011c06063f0415ac1a28384c2ca15a6df0ae2789391
MD5 62589f22f2190718a1e945d4dc1078a8
SHA1 8c91cef5a4a89631d17e1b965b08d687dcff549f
SHA512 f33b7346ab3fcc34edc7b328f355c5c19608a0d1a9ddcbccc5f6c208017043086d2b8b3b88e8a70ca677ae6c3dcf69f142c65dacb3435a9927d749db0c88db29
SSDEEP 192:sxZIRsWB/fnsBnIdphtHW6+WNGBh/YLDWdpIgrJ:sxZItB/fnsBoPHby/rV9
TLSH
T10B22D9556E38A93B8CCBD20DBA15BF53D6F95032A1D51E58EAFC861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1c27e6fbd75c89b1bf702c14a6e31b0100edfe5e6e03341d64dea7fbfffbf939
MD5 778489df8df16e2f9acef029cf92fa43
SHA1 a791f36d5976549820e52872fc1ecdd9ce789407
SHA512 952ae07e3d3013f1e5476a27a1776a5a108159c42f35428a4462b102263e090d0a42684809427a90f6de38206970cc4d7230c95c8634609afa0c8448d4b8a76f
SSDEEP 192:sxZIRsWB/fnsL4IdphseHW6+WNsu0Bh/YLLWdpIg50J:sxZItB/fnsLJRHbsb/LVq
TLSH
T1FF22CA5A6D38697B8CCBD20DBA15BF53E2F9503291D11E58A6FC8B1C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 690776bde698c6b2f04daac987ed71daea50a6a3d6a3302b7bfa54de368dd495
MD5 b62029ac7252bfaa7cf47d85a88fe809
SHA1 dbaa8049d440f94ee024a89907ddecdae8d3d234
SHA512 4c551de61e359c429192e9f84a5d09c68b3e058022e4bc937a9d4054de3701a354f77401d774422bc0f852e917f46b5be066a60c3736ac7d24a9092ebc4db118
SSDEEP 192:sxZIRsWB/fnsX4IdphseHW6+WNsu0Bh/YLDWdpIg5eJ:sxZItB/fnsXJRHbsb/rVQ
TLSH
T13F22CA596E38697B8CCBD21DBA15BF53D2F9503291D01E58EAFC8A1C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c2760a48970a5ddabd0e23fb936cf6bb034a05f9312b754cfc4ac1f557c44226
MD5 5e4ad722167c271e3f6db06e86fd1abb
SHA1 156fd28157112d985e4ea4fbe18a12f001ac75e8
SHA512 dd0e5c0c03d4332ae630ea75e216ee34c00cfba76f4c1db1894424a551fa0ad416297936bbd25e3cefb3aaf2a19607ec4a14bb987be6519dc51c628ec7572018
SSDEEP 192:sxZIRsWB/fnsL4IdpnseHW6+WNsu0Bh/YLxWdpIg50J:sxZItB/fnsLJnHbsb/BVq
TLSH
T14A32BA5A6D38697B8CCBD21DBA15BF53D2F9503291D01E58AAFC8B1C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0dc00b82cad67b5c2790eb2d7f6d051cf5f3323a0e38b5c92ecc0773057afa60
MD5 6142bf69721fd4509d329792f5898272
SHA1 86609cc7ae66b81a8029c0ed386f5ab753ddc9c1
SHA512 0b7aa534b9ef8b7aefd4b071f1bdf67718f189840cfd3d24ce4f93f4f9ae1715e29b2f2e4b954fce05a1374893107d11d217feef5483deb5994751bad591bcb2
SSDEEP 768:ThS3ELCWvWGcm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV79Lld/u7Qro7FjC:ThS3ELCWvWGcmu1ja+9Lv2777lC
TLSH
T13AC20A3B640CCB7E4FC01A9DDC5AAFDB6E9802C766A88D4047FA944C02D77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 35fcc2099aa4a8fde2c3ef4f05a34b6cc78f9b0487e8575629fde2f87e93f866
MD5 17af969392c6266cd9c7f1b96eae4d11
SHA1 68706f1f3000737ae6913e36c7a92c0dbbf59c0c
SHA512 b6728c37b6ea2a04a4d4c9c4ae94e77760de3670cb8dd0833d62eb1643c3b65008da3ae13f46480f73f9baedc1c8e3d3f3a25965ea80e5e84b21fa2ccd4c672b
SSDEEP 24:K9j8H4fIfKThW1iSC97yXQQl94vkLg/IHKbhO1qSCtTyXVStKU4IJKGhY1qSnkb9:K0oIfK1W87yjkIHKdOcvyV3IJKwYcb
TLSH
T1C691F01232BA02013A3F690985BA876B578276E3302DF62F3FBC41955D66E081DFF5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5992e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5992e0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 42fab65fff2d7a018ef4588597caddcf5e89baf7cce5173cef510e1b2b70308e
MD5 c273a5bc14aab4e9f8b63731402bb93d
SHA1 5208108af88373c11aec9643350c95a6f530c1d2
SHA512 9881b45e7e6a388b092d4b8b0f9bcd7aefa694569b3fc2587589d421597b0bc1ab6e9484673d02ae29e9147560ed51cfc7694ebc78735abcd25cc55c4701dd7a
SSDEEP 384:F3yFaeO8WsNWkKFpE99zBqpXItiO9gsTRy+1AFM:F3IzhW3OkBIIO9gQRF
TLSH
T1BC826D7669786D3B98E6A481F54B3643EFB850A7EAD83F80C5DD5F1E01CA1AC130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6a8515e8bfad772dfc97bc6829c459fa9bdd88647ab3bc03edfc304dc7774b00
MD5 6aa0a339f006202be2f9dce49d7a78f4
SHA1 5faec76b0534798759c10df242a84a5994b49553
SHA512 3ae11c66c8931e091880eff7cb299ce6618740ac15539f8e7537cfd7f4428bf21cc27b85dc670c7f25a6931dd4497523f3c3042da4ea843828a3d6f677d0dacc
SSDEEP 384:NiFZ3yFaeO8VzsNW8TUNTUlIlkJFpEK9zBqpXItiO9gsbRy+1AFM:EFZ3IzhtHwgIBkBIIO9gyRF
TLSH
T115C208F658E7993AD8AE5743A77E2D039EBCC067F4946A40F3895A1DCC861BFC306901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 38ad2b80b92eb92f87be2f25b0e23cf04812308a0dc8518578915dc05bd2e5b2
MD5 5c31738b12302a0c84484bc6630686ba
SHA1 5e4adf4b926f829b1373a66256afbb4a2aa42299
SHA512 a499702c2da5830cadbf9dc058b9523a2ae674f7bd85816a0709ab39e788477a2e4b091368603eccfefb347b6ff04acd429b0da6fdd477f27ce3c5d21c86f67a
SSDEEP 384:/3yFaeO8WsNWkJFpE99zBqpXItiO9gsTRy+1AFM:/3IzhWAOkBIIO9gQRF
TLSH
T140826D7669786D3B98E6B481F54B3643EFB89067EAD83F80C5DD5F1E01CA1AC130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 160009501e7d26959a8475e1f66e15927035ce7413179d3a43e89aece166a71b
MD5 465d024667c7c82c908fa98504e7ddaa
SHA1 7b0c957ebeaf04bd6138ce44af4639c1bb35b03b
SHA512 825dc59530bb37475e2f220de6d18c47f627e831dbab650ecea63b44668ef809bbe71c0e8cc9aed4f0e61aad5b38c831252233d30588ea16711bf0246f5efc76
SSDEEP 192:0ONN64AeQmiUyk8zMqqpXIP10ROqYAtyKUU6:0ONN6naDoMqqpXItiO9RPU6
TLSH
T1B102D835AD787C6BDDF66E44B08736136EE82027F9952F80CAE81A1D00DB65C2307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e582393d82c96d331f3ea4e2b456429e9c8c6af08eb7feec1d4b1488b22163dd
MD5 cd3f8b76263a32c9912284e920da4a9b
SHA1 d64b5034dcac71451ec0a9a2e8969078704a400e
SHA512 3a635554642f8f8b2da322b6a815e8fd6c4e5ecf33f4ef1c4f7e3b854b677b83521bdccaaa8d46f081203ec65ab02a76d67228e8edc16afbf76c923678507607
SSDEEP 192:0ON/64ApQmiUyNqzhqqpXIP10ROqYgoF4zWxh8/sU6:0ON/6nHA2hqqpXItiO9gsDRU6
TLSH
T175121B35B978AC3B9DE2A584F48736139EE95127EA897F80C5DC2A1C01DF66C130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c67d3e8a6512d29a2d0c09d152c0909f9294c912a9e073940bdd8d9c29c321e6
MD5 36f38b0bb323c916a31d5dcf2a4db51c
SHA1 353b0d7ac616b9580f91028e6b457bd5ec031bb8
SHA512 34772ec3997ddff77844d6d0b9c7025bb24d1f681fc4d7c187d89a2809adad05363580fba65b6399d068773dc5a2e34640e8ff1fd499de3c946b8a78d5465c19
TLSH
T1E2412C58A6F91158B3B76E56AFF6A56D887FBD772F06D49E10010D4F0622A40C8B2733
MD5 SHA1 SHA512 TLSH

Submit Download