hxxps://gofile[.]io/d/Vvbx1vU0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/11/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/Vvbx1vU0
Sample261104-bax7sagy6p

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	api.gofile.io
33	api.gofile.io
35	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{850F885B-9FDF-46EA-88FE-7BBC3A753C7F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1456	2892	msedge.exe	84
PID 2892 wrote to memory of 744	2892	msedge.exe	85
PID 2892 wrote to memory of 4868	2892	msedge.exe	86
PID 2892 wrote to memory of 3704	2892	msedge.exe	87
PID 2892 wrote to memory of 4868	2892	msedge.exe	86
PID 2892 wrote to memory of 4868	2892	msedge.exe	86
PID 2892 wrote to memory of 3704	2892	msedge.exe	87
PID 2892 wrote to memory of 5068	2892	msedge.exe	88
PID 2892 wrote to memory of 5068	2892	msedge.exe	88
PID 2892 wrote to memory of 1940	2892	msedge.exe	89
PID 2892 wrote to memory of 5068	2892	msedge.exe	88
PID 2892 wrote to memory of 1940	2892	msedge.exe	89
PID 2892 wrote to memory of 1940	2892	msedge.exe	89
PID 2892 wrote to memory of 8	2892	msedge.exe	91
PID 2892 wrote to memory of 8	2892	msedge.exe	91
PID 2892 wrote to memory of 8	2892	msedge.exe	91
PID 2892 wrote to memory of 1976	2892	msedge.exe	92
PID 2892 wrote to memory of 1976	2892	msedge.exe	92
PID 2892 wrote to memory of 1976	2892	msedge.exe	92
PID 2892 wrote to memory of 4448	2892	msedge.exe	97
PID 2892 wrote to memory of 3160	2892	msedge.exe	98
PID 2892 wrote to memory of 4448	2892	msedge.exe	97
PID 2892 wrote to memory of 3160	2892	msedge.exe	98
PID 2892 wrote to memory of 4908	2892	msedge.exe	100
PID 2892 wrote to memory of 5092	2892	msedge.exe	109
PID 2892 wrote to memory of 1324	2892	msedge.exe	110
PID 2892 wrote to memory of 3472	2892	msedge.exe	111
PID 2892 wrote to memory of 4744	2892	msedge.exe	112
PID 2892 wrote to memory of 4744	2892	msedge.exe	112
PID 2892 wrote to memory of 5004	2892	msedge.exe	113
PID 2892 wrote to memory of 5004	2892	msedge.exe	113
PID 2892 wrote to memory of 4740	2892	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Vvbx1vU0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffbf529c188,0x7ffbf529c194,0x7ffbf529c1a0
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6504176608554898539,16521828614915539408,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
  2⤵
  - System Time Discovery
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,13310959877506541993,16750348097245805400,262144 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,18153281982626360398,3164608846901297128,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6256698242401163183,6366565732763956729,2097152 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,16115305569666175413,797147081039642059,2097152 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,14293001568357905186,16453042846528121266,2097152 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,4649110775995618730,5072321400538312338,2097152 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,18232734703680395383,16049396693330985899,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,35075763710319225,8060725515995502620,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11971891712311642331,8726670918316837811,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11971891712311642331,8726670918316837811,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1835735318071174462,17966232652323737714,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,2317913517965446494,2497522041301072366,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,6625622423515469731,2816462457890395576,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9335152530850309294,8594571725860778611,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,7536372025284237306,17640776991534196064,524288 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5356,i,3852462852720766737,9973934624930011565,262144 --field-trial-handle=2568,i,14876428887173913154,14628094177848344835,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b70b8ce-0105-4111-bce0-8e7ed5bc32bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b70b8ce-0105-4111-bce0-8e7ed5bc32bf.tmp
Size 18KB
SHA256 66d81187403c9a5eeb5c77af52ab32f525a1c033ba47f75305131635244bd4c8
MD5 ad66fdf33777b7c4b9f67a9b756b7595
SHA1 dacba246ae5be0defbed04f03287ecfc1aac094a
SHA512 6a20adef40f7d069eb51f151d678a78c7e170ef706e45302221e1011b7728cb12ddc49565cc0fdb8c319ad6a72e8542898e8f199f819a56de7365481255a6134
SSDEEP 384:HQkUSv0sNmkcz/3eW7P04WysZLlbLHH7vBEGPIIl+:Z0JpLWPLlHHH75EGPLc
TLSH
T100827D7268B96C3B5AE7A511F14B3A17DFB4D117EAC41B90D9CD9A1C00CF29C234FA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44181e12-3329-4e95-b645-3556df7e37cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44181e12-3329-4e95-b645-3556df7e37cc.tmp
Size 18KB
SHA256 0b1150f037db24380c9e59fc1006b704711a38bb1fcb2fa9298a4da003f99cee
MD5 d1a69eadd453ffa8662b52acbca32640
SHA1 d7bc73b985966b7961ebbeb8784ed7a85b5917a9
SHA512 87b3f5f3c357628b63ead5c5e31638d6b151d86e0af8fe1244ae7e2b8860c59b28d79d3eab87a8958e2f9fc6a02a0cabac10b303db9cea1d07b28bc86a60b1b6
SSDEEP 384:UQkUSv0sNmkJz/3eW7P04WysZLlbLHH7vBEGPIIl+:E0OpLWPLlHHH75EGPLc
TLSH
T104827D7268B96C3B5AE7A511F14B3A17DFB4D117DAC81B90D9CD9A1C00CF28C234FA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

587bd931-9679-4fd7-8bff-1f75c80b6c93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\587bd931-9679-4fd7-8bff-1f75c80b6c93.tmp
Size 8KB
SHA256 3985953caf0eb6bd2cd0b7c6dee73e6ef04ae6059ccae0416f2d3dcd2330bd99
MD5 b9f1367143d7929c1ba74b6ab1a3efb5
SHA1 1b128f16eb38a72095b7303b6c7803ef528936cf
SHA512 5e11e0694b0991f0cf332041c837ab2bcc77497487d4554016e1a1eee383c86b82039f10716c556f8b16d33e8442701784a870ff3db7d5e2a35a7ee6f04123ce
SSDEEP 192:uONH6ILeMQmiUyUHZW04Wys/1rLvWQbmrNIZqaU6:uONH6y9xZW04WysZLlbzHU6
TLSH
T1DE122A31ACBC787B5EE3A450F4873A139EA49227EA857F84D5DC591C00EF29C134F626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9692be7d7c6b78a8cd27fd9e180eab5d1f3f22f3430c97460cb81b853a522808
MD5 4522af4692072a79d01f3192c32a6d08
SHA1 265b2ec9455a5be2603ff3c8413ee124af2ce2f3
SHA512 45fe6e7e9c064c9331789088de4c1ac88902cb8cfcc1d61c6b8333b8521ef520d682ffe13777047f7bfc7837ce5b12b79ad9738fe80040896ec4174801c56025
TLSH
T146D022CBF3003000C823303220FF832C0228CC80C80202082CACE000ECC0C0A0C02C80
MD5 SHA1 SHA512 TLSH

Submit Download

7713498c-e45f-4a05-b3b3-02a8002b6581.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7713498c-e45f-4a05-b3b3-02a8002b6581.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

85773c28-a4c0-48ef-b70b-12cb7f11428b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85773c28-a4c0-48ef-b70b-12cb7f11428b.tmp
Size 10KB
SHA256 f6343cbb74f8d00aa414259a900a5b5c6cf7017129fda003dca7254571197faf
MD5 c70cf727a6028c16eca951e96539ab91
SHA1 bb49b299e7e254e49ef634b2336edd22a2a8baab
SHA512 1d13a97c46d74bbf620f12befbe9c39189cf995731964238b77aa96e757c1bd18a0e3c22536f26de1a83ad6a57266e093232c6ff442432a727b1e79f1e72b8b1
SSDEEP 192:sxZmRYWpL/fJYsde1GsIdpjltHW6+WNe6x/Y/N8vKIgrJ:sxZmF5/f+sde1avHbR/I9
TLSH
T1C322C9116E78A93B8CC7D219BA25BF53E7F9503291D51E98A6FC861C04E76DD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e0d269eab683ada21592a3b13205ae8a0a2adfd4d616a96d5ada377675607cb7
MD5 8004ab66f70cfd6a29db3a480700a2bc
SHA1 4836a98927691836766a79bc491dfb4759692bc3
SHA512 50ba38a22084f7f977e1b175bc74a6937d51d0b54f3e395a469aebdc80c2abcd52d9687f2b4e57d92c681c4dcfdd431d307cd1989f0bdbe9e85db38683988b39
TLSH
T16AE0268E04CCC22FE328788722F8638D8280371AA3C5FA1E5B08C48C7001844A787FA4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 fcca74b8abecf2cd4955178f1d5dca0fa65270bb4b639eb1c59ad0f3ad472b29
MD5 2eb728353d715cd451287fa09a9820f9
SHA1 246f233eb9364a8b79c1f51b12aba6b0b74fe034
SHA512 3e96094363b0ab914b450345cba522bc10c799e590af96330a113b52c5415afd30ed980b533e6de8266ec8f10988c0197a3df9f2929e0e4c45ba7091614e6387
SSDEEP 48:RJr67zDp59fbrmAgCuvomBNxHfQ67pC//xmgLKYzL1vID2+Jws3UOMBQ9iOuU+:RJrG9HTrjg/voQxHfT65mqKYobMa9z+
TLSH
T1B691A3EE12926FCBDBDAAD308CC63093357282817C6F2D1E3254E4BC1B82F5301449AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

673b044d-2c6f-465b-9ced-144d8566eb4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\673b044d-2c6f-465b-9ced-144d8566eb4d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

12cf20a1-00ce-4f32-8dc2-96549e4abb65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\12cf20a1-00ce-4f32-8dc2-96549e4abb65.tmp
Size 1KB
SHA256 9ddef4c0bc71cd285ef06dbc59306ab8d298c11bf6c9f231c56d48a21a0994e0
MD5 08e9d869cb79b4acad00fd6b7d6e6e01
SHA1 6200dbd654552cca75af37f204153d9fff6dfc81
SHA512 fd2b4b702f873db223b550fb7bcc02cb14ea2deffd00e5e4710e20a262288f4e8487c1b73ad3a5955d84b00e542664d4c1c8475f9d23db7134cefb144bf24720
TLSH
T19F31BBF3C3E9956E8A1556F0AA14AE1FDE1D0506832C3D29C9D0AF27D3E3471E04665B
MD5 SHA1 SHA512 TLSH

Submit Download

215cf6de-39a1-413e-aa52-d8fe0e75c170.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\215cf6de-39a1-413e-aa52-d8fe0e75c170.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3dc0fa1b-9612-4fcf-847d-b1ed061dd406.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3dc0fa1b-9612-4fcf-847d-b1ed061dd406.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a64ae32e2656da01c67f9de4c0f5ba9ddef13799e857140e3d89f0e5164edc0c
MD5 81a6e69c5f0a796b69cfe8fd2717a547
SHA1 6e5f6adae1d31062c71aa45d15c3cfa983c48baf
SHA512 a6fa97cb2cc76878a42c465982382146b62b9c251573105064f693d2446c4a7e47af35fe4c2c012393c8826d790ca9de267e8d61d289516c474c25ba6b65233e
SSDEEP 48:K+zivjZtRkhtYPIY7kKXBPxkrD0y4ZD5yy5aDPR/TbiDUqITXbKQi41b05LNsrzt:KUsYKxy6qCMK/q+CO8KvaL
TLSH
T13191B41031FA1204387E290880759BAF554233A33038EE6F7FBC56669D6AE085FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b95b3ac0-1e8e-41be-bb66-97fed4e0e936.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b95b3ac0-1e8e-41be-bb66-97fed4e0e936.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cba7d7bf-0e84-4e11-9d16-a04d11cbc82c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cba7d7bf-0e84-4e11-9d16-a04d11cbc82c.tmp
Size 10KB
SHA256 5fa1d9456abec838d22c9864c75529d6f871743617fe00f9b0063c05245e3de6
MD5 b95512251b74f18e10d218b6900ace19
SHA1 91eda2792bfc10e6f517c8c9c88aa7a1118fb4e6
SHA512 a0ed33dfee40d4a167004d031a179c555980df9fbca284db732fe7939aaebe81b60ef1a3afbb5dde7e20c9deca4fdba84dc4440cba17c2a79227f54ef3552d1a
SSDEEP 192:sxZmRYWpL/fJYse/1GsIdpRltHW6+WNe6x/Y/G9RKIg5VJ:sxZmF5/f+se/1axHbR/U5
TLSH
T11332D8116E78A93B9CCBD219BA15BF53E3F9503291911E88A6FCCA1C05E77CE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0a96303-cbc2-432a-a91d-b4857de7920c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0a96303-cbc2-432a-a91d-b4857de7920c.tmp
Size 10KB
SHA256 024888f17f0ae3a576e24420842a7bf07615a7e2ec31506436c2b0be510f2deb
MD5 ebff5c8b95a30425f5f8d9241df2024f
SHA1 aa6eb93e73bf3d4943e053ba5faf11c5a5aca046
SHA512 33dec7f29ddcb87698851bb7a371651db695544500d4a873e32d9b00049200d477ff749cb04bd8f61f14dab859a3f35a209c9b97f93e02ccdd258c1619d41226
SSDEEP 192:sxZmRYWpL/fJYse/1GsIdpjltHW6+WNe6x/Y/fKvKIg5VJ:sxZmF5/f+se/1avHbR/G5
TLSH
T10D22D9116E78A93B9CC7E219FA15BF53E3F9503291911E88A6FCCA1C04E77CD224B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec1e597d-1c1a-471d-9be9-fae3db2d3263.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec1e597d-1c1a-471d-9be9-fae3db2d3263.tmp
Size 10KB
SHA256 2e877acfa8fcb2d76d7d7fb51e7f01271916a118cdbb39a0bb4c2ec42ca13e29
MD5 a456e1466e069e41dac766c2fd2bee81
SHA1 fc243ab8dd4f49444677f5401d8b517906e8c005
SHA512 1fcdee53c2ae55080b30b93f3fe925a019b1e81f5af5f3617a839686b480b4413da63cc6bb634572554d001a43cf19014a9df88780a0c3045f494422276dd4ed
SSDEEP 192:sxZmRYWpL/fJYsee1GsIdpjltHW6+WNe6x/Y/N8vKIg5HJ:sxZmF5/f+see1avHbR/IH
TLSH
T12722C8116E78A93B8CC7D219FA15BF53E3F9503291D51E88A6FC861C04E77CD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f687a4c5-1436-4dec-b12e-a851f8b95bcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f687a4c5-1436-4dec-b12e-a851f8b95bcf.tmp
Size 27KB
SHA256 71b8e92764967f9e9043e7a3751b4d42599e3f3e09ca1d34d4b6e189a8e140e3
MD5 54f466660e609669545198086917d0bd
SHA1 b9e00836992dc5f50467e5d7441c2359bfb5bad8
SHA512 f604902925affc732408194be54b851df0e74a1429e14e2575941e1591a77c46ede7c266834b3497c6eea15cd6ebe3735bea55304e31ce09fa0a0dc19038e59d
SSDEEP 768:7/mtKXIWvEgCc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3Llztc7orovSe:7/mtKXIWvEgCcu1jas3L9O7TX
TLSH
T112C2E93B240CCB7E5FC01A9DDD5A6F9B6EA802C776584E4047FE984C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

eb05e8b4-163e-4be2-993e-7aa598be09a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eb05e8b4-163e-4be2-993e-7aa598be09a8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a92ba7a9-6446-4522-8a82-6f6a29a5d5b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a92ba7a9-6446-4522-8a82-6f6a29a5d5b4.tmp
Size 26KB
SHA256 7078eda6692c4dbfbeab2c6d5350176c39b8999eea74cd8cd441197d7a52a03e
MD5 3c329d75a2da51df4df8364c17714421
SHA1 9032028eb2d0fcb19dcd66f76c09f49a5123da2e
SHA512 bd79bc0d211c6a03bc05420235f5aa46af3ad52a208202fd02dbd9a6f9cc59a7e667f999db0af7d101d6634e1d997c97d8921fa1e98deeb5d11df5657458e014
SSDEEP 384:biFzQkUSvazsNm8TUNTUlIlkJz/3eY7P04WysZLlbVHH7vBEGPIIl+:2FdyTwgSHLWPLl5HH75EGPLc
TLSH
T188C219F248EB583AD9AE5B03E37E2E039EBCD157B5845650B7C8890CCC861BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad84321a-044c-4c8e-a924-0176dd0aa0d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad84321a-044c-4c8e-a924-0176dd0aa0d3.tmp
Size 8KB
SHA256 dce9d41c6188487cfe2d80ed5d1bca23d2e913f58a7bbf6d01bacaf2d6eb2ad5
MD5 4b43504b874e983c627ad256dac9caa0
SHA1 0aa093df170425fea66b374410d3dd1831ae0f08
SHA512 dcd1b528d466127121c32a3700891d78da12e85a8f5720548804b025fa60594188d9192ddcab027190feb663c4007c9b9a9bbeb1c777d2b9f06fbc94399df785
SSDEEP 192:vONR6ILecQmiUyvHvW04Wys/1rLvW357UVyU6:vONR6yFQvW04WysZLCOyU6
TLSH
T15B020A35AC7D78BB8EF3AE45F4472B17AF94112BA6952F44DAD85A1C00D768C130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a72583e9-f9eb-4c6b-9e8b-178c156e312e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a72583e9-f9eb-4c6b-9e8b-178c156e312e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0d81d706af799a4f35196a10f481453876756ffca0788dba5080c16ea6d7d4af
MD5 6800a61113a57b633a969cabd4c9f7d0
SHA1 2d7b18f89ad51916e834dfab56e94caa215b6e23
SHA512 3732d05e0c4145a4e8ce1624e2db387b1c1e1c0f585e7cea76292054cbba3688b46bbc28c8888c1097daabb5d645e830f519229b1004d3c4552aff1acf97b08b
TLSH
T11B411A5CB6EA1158B3B76E5A6BF364AD487BBD372F0AD05D10110E8E0B72B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download