hxxps://gofile[.]io/d/lzFIE2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/lzFIE2
Sample260808-awd6csah28

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
42	api.gofile.io
74	api.gofile.io
75	api.gofile.io
32	api.gofile.io
33	api.gofile.io
34	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306228204089169"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{E0C26E5A-642F-4740-A09D-78BF4C66ED91}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 6088 wrote to memory of 4488	6088	msedge.exe	82
PID 6088 wrote to memory of 5340	6088	msedge.exe	83
PID 6088 wrote to memory of 1672	6088	msedge.exe	84
PID 6088 wrote to memory of 1672	6088	msedge.exe	84
PID 6088 wrote to memory of 1672	6088	msedge.exe	84
PID 6088 wrote to memory of 1020	6088	msedge.exe	85
PID 6088 wrote to memory of 1020	6088	msedge.exe	85
PID 6088 wrote to memory of 1580	6088	msedge.exe	87
PID 6088 wrote to memory of 6076	6088	msedge.exe	88
PID 6088 wrote to memory of 1580	6088	msedge.exe	87
PID 6088 wrote to memory of 1580	6088	msedge.exe	87
PID 6088 wrote to memory of 6076	6088	msedge.exe	88
PID 6088 wrote to memory of 6076	6088	msedge.exe	88
PID 6088 wrote to memory of 5292	6088	msedge.exe	90
PID 6088 wrote to memory of 5292	6088	msedge.exe	90
PID 6088 wrote to memory of 5292	6088	msedge.exe	90
PID 6088 wrote to memory of 1272	6088	msedge.exe	93
PID 6088 wrote to memory of 1272	6088	msedge.exe	93
PID 6088 wrote to memory of 4508	6088	msedge.exe	94
PID 6088 wrote to memory of 4508	6088	msedge.exe	94
PID 6088 wrote to memory of 5708	6088	msedge.exe	96
PID 6088 wrote to memory of 3168	6088	msedge.exe	105
PID 6088 wrote to memory of 548	6088	msedge.exe	106
PID 6088 wrote to memory of 3180	6088	msedge.exe	107
PID 6088 wrote to memory of 5912	6088	msedge.exe	110
PID 6088 wrote to memory of 5912	6088	msedge.exe	110
PID 6088 wrote to memory of 116	6088	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/lzFIE2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffd36aac188,0x7ffd36aac194,0x7ffd36aac1a0
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,11777271672143742916,17173668626626161527,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,2969479449579644662,5390211103063909657,262144 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,14665829105419282418,1034684231531803526,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13988561681234097890,5759359961032304751,2097152 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17095158736605918060,2290221863040434498,2097152 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,233813290338986949,16195602965931507588,2097152 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,6757821417594336057,15809169190107446496,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,18013001672172958863,3543120807257147808,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2872684566867996665,16971852275578029710,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2872684566867996665,16971852275578029710,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,8283418273601478234,14611613221203376745,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,2668738178477787170,15521231608583334327,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,11317339001516964043,17321504154207093151,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7980710659167078912,6291367587094420127,524288 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5780,i,13489705440414588232,10912173391222686352,262144 --field-trial-handle=2332,i,3426613733850490313,15262818349995600152,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 730984565220eb96373615a714e0b984c4099b65af29ce06f0d99b0d8f70d750
MD5 7988917c57169937a286e8ee69c21d26
SHA1 274b0e6b8b798ebc323be509a040091667a4a402
SHA512 6e4706dcbeb418cb0ec51395b219dedfd21f7a2984332ff92d96f0c51f2d69d828e6533f1be8ed2a2008efe3afda084546b7b70e5078f1100cc5fef4db309b4c
TLSH
T1D3E0E5ADC921AC3714FC175C68154B46D740031B2A40496B3B3D910C8FB1A3B559685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e23a66ddf2101d32dc4b3ce3a99b2e6ea5b03780c70bb8f93d5e63010ef4d857
MD5 a613506d634313770a2b7c56e657fdce
SHA1 3a098d7f671c337ad08245f3bac44505d8741263
SHA512 cf9d23218418053a69a1df4a26dc12728819d9a22070cbcf798700f331f2038b9d0b8ef98ca414e7adb832bf08f845e3224e1ceaa9f702d72bd90b9985118563
SSDEEP 96:/KEx5aUjRY00IQEhPBMlecr1DgaxePgNdS20bfX9yNK68LD1jVwFSaInw6kbjPDm:/KKoUV30IQsBMlew1D9xeP+S20bfX9yA
TLSH
T1BC913E3C649BA8F0E752C332B0F21EE63A7E46B8D4930D9D1260D9F8751AB5791C4D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586fcc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586fcc.TMP
Size 3KB
SHA256 23b933b8ae41df10cbbf177fca673c39cf032cbb4abd033b9dce217c1cedd57a
MD5 87baafb3a049d9a4e76885430c70a781
SHA1 acbbb1c1f8385f4136ffe471ad90f60c5f2e6cbf
SHA512 7eb5e24850d35de49480ef89165b069f49d5f7e734b47b96a419a69c4c0ba9b52ed9b4a4f5172146ca1556087576e8c65645f26d770ce9bb5371f05baa789ebf
TLSH
T115717F3C909B98F4E760C372B0F21ED679BD46B9E8134D8D1050E4F8795A76391C5C4B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53eb620e7d16692320849c895ccf370aee6678bf3f188dc222e58ce0ba87325c
MD5 6aa665cd61601d134d4f35ae5bc88976
SHA1 d517dfebb29d732bf78da8ed9dc8e144e0d59e6f
SHA512 08105e069fda8b4894204a1cfd776d1ea20a288f083cd8bd514d0eea1e8129c5b9a71e0442301f949f47f2b7cd9e066902ce6a718a218aa570de07c58eaffe8b
TLSH
T19B41AEF783F4856E8A1196F0AE14AE1FCE5D0115832C7DA985E0AE1793E3871E045B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 efaa400a2423817f235567bed68b3fb9aef2b418c2e28676eb90d6a4f16a58b5
MD5 9a08db0d2c0c3ded561de9544109fd51
SHA1 5e023aac846aa7059ef58dc6d390fc94282f9230
SHA512 53f4622d55c929c93fff2e634af8a538b54507db4b8f1849cf60c13fc35f9d4764c1906fb683703fba93ec64c365cd1b05ae96f4ac94dcd62cad0aa2746c0752
SSDEEP 192:sxZ/R5yMqZjK1Ml8UQgk6/fMsc8uo4TgwzodpRlcHW6+WNe55/YXaJwr5Ig5o9J:sxZ/aqz6/fMscLg4Hbe/LoqH
TLSH
T1ED62E8156A38AE77CCD7D209F945BB93D7F9052391904E48A9FC9E1C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9ff936a552f05d3452779fcd09adc326c60d5d32327000d509e23f1ab6a1a5c0
MD5 172f9c654811bac245fcc2bac18e2dc1
SHA1 ec0f1d5ec8e28442b4b6fb53a99bfefb1cc694b4
SHA512 499f7273d3618e9213e5c3726aed9892ba90feab7ee3d547ec4edd23d272db25002cbe1bf917a9c53ed9ec3bb42660765f82f8342c5b74269aeb8a3dd0960934
SSDEEP 192:sxZ/R5yMqZjK1Ml8Mk6/fMsqRuo4TgwzodpRlcHW6+WNe55/YXarw55Igj9J:sxZ/aM6/fMsqgg4Hbe/LAjH
TLSH
T1CC62E9156A349E7BCDDBD209F9457B93D7F9452392904E489AFC9E0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4dfca8a0cd7c3fd9fda429b96b4643618e36b7feefdc6c390c22fde17563776e
MD5 db51f472f6ad70d4785418561c1e6d31
SHA1 0f80fe0c93cebf43020c602b145b9e335e37fb37
SHA512 6dd2a19d3e87ea44d717fabd25415bce3d50ea46f4041b086aeb4b63469e55750585b9152b9dcccf7031e5b11dae368e5dc87856a86ae75a160d7bb82c7a13bb
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1Otvx:EJGnYNSv9PpHV/qjwlx
TLSH
T1BBB23C13313A03423CBE291DA2A696779E4231B33019E6BF77A904664E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4bd034c8fbe03b3cc2f2f3f234e4b0c8bd549f5899c3136349380b82a4b3cdd4
MD5 0a045a9a0ded2b77dccdf881a19e0fd1
SHA1 d492de34d35ba8227483e42bb89b4346124a7982
SHA512 3d5ab99e4dcae0dfb35c0d3d341ec97f6d46862095a3b56f4b6619febbbe7db4cb8970abba72a019d1e118003201b9123e9ecab608b557b01cc9ada565375c02
SSDEEP 384:n5iFiZcIz3sN18TUNTUlI4kdzoNmOYawBfgViXcR6QTkcDVVZoJHWilTHy/7Igr:QFQz3KwgZPaViXc6QTkcleHWeU
TLSH
T153D24B72DC64DE77EDE79B9AA74A3A03DEE0426396CC96D4D6ED1D1D008B19C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6c42120604c03df0d07799cc917e2ef7591e0cd1961fb11f21e13175a4699e44
MD5 c39f5ef90ff8b6a9f690f9f72dc27704
SHA1 7a6f97e48081cf0c08fc9c5efdf10cef2424bfc9
SHA512 8d323c29e31c80909ec8f9c1c99ea6c71055b50d73867af5006150779704fa9eb3d94ec1adc0c9171f51b0411c0f8bf1e045627b74b7f5d5e544b30244896b34
SSDEEP 384:ntiFiZcIz3sN18TUNTUlI4kdzoNmHYawBfgViXcR6QTkcDVVZoJHWilTHy/7Igr:kFQz3KwgZyaViXc6QTkcleHWeU
TLSH
T108D24A72DC64DE77EDE79B9AA74A3A03DEE0426396CCA6D4D6EC1D1D008B19C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c5c7d0258debd81b3722616891ccb78a024d3ae203ef4993ce7fae0c05b5123f
MD5 4d421be87f874bb63f088c3b63698057
SHA1 aecf78778b6153f1eb83a3a7afeba922fe6787d5
SHA512 95b20834e827eb7fc962241a87190673ff5e4b023d3e28cfbe18c21d7a3adce9b69fe38b78e2ec17ba64251512a7ca77ab8cbc011bf2e97eec80f63f2c48db63
SSDEEP 384:nCiFiZcINl3sN18TUNTUlI4kdzoNmOWawBfgViXcReokcDVVZoJHWilTHy/7Igr:JFQP3KwgZFaViXceokcleHWeU
TLSH
T176F2E5F198E78976E9AE4B87A77E2E029DFCC153B5885584B7D81D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 45a55b14bac3c497c5b7d335c83158b3220db7c106498a42f9da8ccc0b786c26
MD5 3bcaa8f6cac101871fa51931c27dcb32
SHA1 58aecfd14d798bd37b0b7278920e62e36f1464a9
SHA512 6c551ff25e11683d4bcb03faeabb66b74cf555ff7ccfb98acd364a201e8c79cc3d20ee4991bc8f981f97b069f740c5e15dc52735acaaaeaca878d7a4f9c1a863
SSDEEP 384:nmaiF9CcmyWCs3sNM8TUNTUlImkrzoNmfQvwBfgViqQ1T6HhkP+lFYS/11lDHy/J:mRFccps33wgl+NViqQ1EhkoFYS/5u
TLSH
T127B26C31DC98DEBBECE78F8AA74A7A47DEE012A7859859C4DAD81E1D00C71CD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cd31f16fd22bd0cce3a673d397f58cd35dc21c7acc07fb7b9d42bf6723f04dd8
MD5 1696225371d4be59211db3038d673d99
SHA1 2a8a1d26a788b7c03445aaa551d3207fdeb1ab52
SHA512 7f0669be86e87c2da78fb2f6b51275b18b0e4aa91a7b0aa9d386d8b0f750b0c806270f00f3b40cdaad94045cdc6e5ce1f434d13f38fe9869c3319841efe1d241
SSDEEP 384:nPiF9CcmyWCs3sNZ8TUNTUlImkrzoNm5w7wBfgViXcR6Q6khkP+lFYS/11lDHy/J:aFccps3awgl45ViXc6Q6khkoFYS/5u
TLSH
T1A1C24B32DC98CABBECE64BDAA74A7A07DEE04263C58C99D4DADC1D1C00DB1DC174B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a235af5b0813bffb20f507bdd39e5c758e94ebf30ed0dec856e03a6c5e16b2cd
MD5 acba958ef53ec3d704e7424dc77aa66d
SHA1 a243fff432b276559bf205d0eaae7f6341d83cc7
SHA512 921e80bdb086beb949ff30426503dd0c375ac0ced5441a7bb1138b7dd1a4eb623f3c728083adf6581a734f3038011c012c90fbe198bfdb9fa6f8a3a171be37bb
TLSH
T1FC41165DB6E91048B3F77F5AABF7A86E487AB8772B47D49D00110E4F0663A00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download