hxxps://gofile[.]io/d/869ySs

Analysis

user interaction
yes
max time kernel
71s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/869ySs
Sample260808-mllhxada49

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	api.gofile.io
25	api.gofile.io
30	api.gofile.io

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\payload.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306588062935765"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{542408AE-0EFC-44F7-81E2-0F71BFFC3F9E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\payload.exe:Zone.Identifier	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
784	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2744	784	msedge.exe	80
PID 784 wrote to memory of 4856	784	msedge.exe	81
PID 784 wrote to memory of 3160	784	msedge.exe	82
PID 784 wrote to memory of 3160	784	msedge.exe	82
PID 784 wrote to memory of 3160	784	msedge.exe	82
PID 784 wrote to memory of 760	784	msedge.exe	83
PID 784 wrote to memory of 760	784	msedge.exe	83
PID 784 wrote to memory of 3756	784	msedge.exe	84
PID 784 wrote to memory of 3756	784	msedge.exe	84
PID 784 wrote to memory of 3756	784	msedge.exe	84
PID 784 wrote to memory of 1552	784	msedge.exe	85
PID 784 wrote to memory of 1552	784	msedge.exe	85
PID 784 wrote to memory of 1552	784	msedge.exe	85
PID 784 wrote to memory of 940	784	msedge.exe	88
PID 784 wrote to memory of 3976	784	msedge.exe	89
PID 784 wrote to memory of 940	784	msedge.exe	88
PID 784 wrote to memory of 940	784	msedge.exe	88
PID 784 wrote to memory of 5104	784	msedge.exe	90
PID 784 wrote to memory of 3976	784	msedge.exe	89
PID 784 wrote to memory of 3976	784	msedge.exe	89
PID 784 wrote to memory of 5104	784	msedge.exe	90
PID 784 wrote to memory of 5104	784	msedge.exe	90
PID 784 wrote to memory of 4788	784	msedge.exe	91
PID 784 wrote to memory of 4788	784	msedge.exe	91
PID 784 wrote to memory of 4788	784	msedge.exe	91
PID 784 wrote to memory of 1088	784	msedge.exe	92
PID 784 wrote to memory of 1088	784	msedge.exe	92
PID 784 wrote to memory of 1088	784	msedge.exe	92
PID 784 wrote to memory of 4676	784	msedge.exe	94
PID 784 wrote to memory of 4556	784	msedge.exe	95
PID 784 wrote to memory of 4676	784	msedge.exe	94
PID 784 wrote to memory of 4556	784	msedge.exe	95
PID 784 wrote to memory of 1904	784	msedge.exe	96
PID 784 wrote to memory of 4428	784	msedge.exe	98
PID 1904 wrote to memory of 2572	1904	msedge.exe	99
PID 784 wrote to memory of 2420	784	msedge.exe	100
PID 784 wrote to memory of 2420	784	msedge.exe	100
PID 784 wrote to memory of 2420	784	msedge.exe	100
PID 784 wrote to memory of 420	784	msedge.exe	101
PID 784 wrote to memory of 2040	784	msedge.exe	102
PID 784 wrote to memory of 420	784	msedge.exe	101
PID 784 wrote to memory of 420	784	msedge.exe	101
PID 784 wrote to memory of 2040	784	msedge.exe	102
PID 784 wrote to memory of 3008	784	msedge.exe	103
PID 784 wrote to memory of 4080	784	msedge.exe	104
PID 784 wrote to memory of 1564	784	msedge.exe	105
PID 784 wrote to memory of 3896	784	msedge.exe	106
PID 784 wrote to memory of 940	784	msedge.exe	107
PID 784 wrote to memory of 940	784	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/869ySs
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa2677c188,0x7ffa2677c194,0x7ffa2677c1a0
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,17126653898643927835,15413431860596954691,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,16048149390186059033,11927407934588700625,262144 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,8147381714452427104,6468655676057394838,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14290621388029879793,10271341326825098409,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,3872735545861485284,16882923352961053807,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14564835335806527384,17985897952794156522,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7983112114573164938,12977379005804114503,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,16782294647249344158,2977233206991525355,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,17305362232264908437,9188007059939948616,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3688,i,12178962059911960466,4925826408410319482,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,4657971608802971127,12634817452262243310,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,5363910718314498724,8360853577056972196,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8455226591757694461,12184386527764439186,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,7219246408155740356,10305012367881994281,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,7219246408155740356,10305012367881994281,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6576,i,2640335465875426340,12910311825478555518,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6800,i,12172480679700058067,15665173607772877644,2097152 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,10365040643901730430,14966297063582352425,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,7394628061525482443,12935075436760208227,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9819478270957993372,14236171602846647282,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,3502503635157116762,4456001652953404789,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,2258418301684131834,9135037280308789123,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3275753024441453022,1888503522656159318,524288 --field-trial-handle=2232,i,251723906358975682,13241763952566830675,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:14
  2⤵
  PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e2cc1d4d00526f020d431721155aff61c9c0b3d16520a4d3506620b049d65f12
MD5 4e04397b6cd0f5d67cfbaa74499ad812
SHA1 bf738da478e23015d9913782534dcbcf1d15116b
SHA512 22126420acccee027ad3de158d48d2014ec8a0030397cce61a6d454814ece747959fd4c4bb50cf521eaf8a33eb2842795f8c9df0b9962f8505af2b63f3f4df53
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T130B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 32ac3a1139fd3b07bd2eba352cb7d8f379ac10e5d94cbfbb2e84bc3790cea9d5
MD5 3f9b6cbbe4b4369bbf757689188342b4
SHA1 bf9754b6a3321a9774f0c168baa3b2dbe93bb570
SHA512 6aa6124d3baf4c01ad4355694dcf9d2a3b64a5978aed669853f9d4b1aa1365722f1d7ee680928a21e05be77dd22eceb45e93f3c4d8077bc30367bd5b7b6bd78f
SSDEEP 96:QY7FqcbewwW/cZZCjff2qTZuFSwxq2ZZX7ZIL:J7F5CwPcZZCTuMu8L2ZPK
TLSH
T14D81EA260F976C90F33EF630B8F8622D3AB58E1548173E1352EC6EB4B631B5247519DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e74e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e74e.TMP
Size 3KB
SHA256 39ffba42d82abcc21227a1dc75958336fd3efa7264b8f8aee8798af36ccebfcc
MD5 b09ac57246503829cdea80a4199480e1
SHA1 2cfc48471a96ff8ecc518fb36107b173dc14729e
SHA512 6ae5bafda05398e7f01cb9eeac7ebbd179bc7dc57502e6fe8a2d95357d5b83f98460e2d451eb49f2ae105bcb67bd378ff444402f9536a4b8c571225bb777e75b
TLSH
T10671F8250F870C80F32EF531B8F8922D3A718C2958573E5350EC7AB46A32F624762CD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 969B
SHA256 f9de18018e873bbf510784c8f519467e5daf92b4da30b9c8543516967bad93d4
MD5 5f4fd471c9bb3d125d5ae49798e1f268
SHA1 c31de0c700c19f3c37ba0acb8a0e45a7165564c5
SHA512 3d7aa7f25d656d02f29c90c0de42b6615e893ee6cec4bfb57ae2dc2905cb4da3d08b2a33568a96554f037845c9322194d51dc632423611a4951d55942a7ac16c
TLSH
T19D115BF383B5956E8A2192F49E049F1BCE5C0012836C797986D06E27A3F3971E044B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c2269cb968757b76b5ed098603afcf0b80680c19d9f0692e918c5242a0165e5
MD5 fcc14a53260f9e487ab4a7991100de4b
SHA1 4e7244b562b3bc4326f5b2d0e2cba93204837595
SHA512 3f31e3282713ed7f230137328c3232056498111a025119fc30fef00ea473e70f19762de0724a59de05393fbf71c0b780bc825b4a127664cab7ec5d84003d6813
SSDEEP 192:sxZ8/yM/jK1Ml8Mof/fus5xKIdpKl//W6+WNeMD/Y05U2pJIgrJ:sxZ87Qf/fus5xD8/bN/5t9
TLSH
T1A252F8116A34697BCCDBD309FA55BF53D5F9057292940E48A9FCDA1C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f015f7d5ab1cfaf02b22f9936e653ebcb2725d9781b066dc01a38b82ef86dc90
MD5 f2be7a8f77a8df8a4f1a27713fe185b6
SHA1 50865dc9df91b9d23db70c51d1d87b8de2f3b96f
SHA512 84bedfcb1171fb66f2b401d03dae8c50581c967955efc645cb0795daddfed9851f759ae333dbe45e31ed8febb5c85c5004462a62c10a289e13b4b1f49bc8fd62
SSDEEP 768:lozXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hIOro0H:lozXl8pZ221WRmsYQL0u1jaKu/Lpd8hf
TLSH
T1CDE20A3F244CCB7E4F844E9CEC266F966ED802CBA7984D5447FA894C03C67DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8c2e5dc8668efd0d22f408654e1271414a81fb709e8079a4212dce1584f33dca
MD5 ac2f09c9f1bfec7c3bebdc5009768c4c
SHA1 17292f454ae6e2ed5500e7a3cf359e1f8c4f29bc
SHA512 d70c5d5026eda19c0cc85f087d0279162af9691e8c64b144cd78199c6dfadfd74b7fae8ff1cbdfbea9cdabf2d258ed1d7fd381bb8a09082d22046b5cba77ef3a
SSDEEP 96:KZ4REoimSAmerTAgAKIVAqA0fx6K6YSiikKra1sbIMyqa2Eqx9aM2KJ:06ZfisbIMyqaVqxMML
TLSH
T180911E0671BA22423D7E391CC39697164A9271637558B9BB7FA804B70F67E120CFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6f0b5c09dd70f74dc098dfe60a372461fbb27d7f8cb784cb142fb3858923bc50
MD5 53793584f2d3afc04815ca53b6412a5e
SHA1 ef1381c94fc0666e2949ede71d56be7160ce5fd3
SHA512 1ea41f707f6c3ad2dc5237e88b251e9e69c65e5748ebcdab07b12edbd5545a140660ca3a5d9d4ad545e6b4d5e277a68e972fabc6d3aab62f1ed7868c8d4ecd3f
SSDEEP 192:uRqX8NbeQBnieaNEGwQmiU1sfRN4K/GPTxkdfUYCZXVsAgqmRLqyULw:UI8NbeV1E3CJCK/NdfEXtoRXT
TLSH
T161523935AC78AC3B4CE39595F10636139EB851A796C82F98C6ED2B0C05DB6DC2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 8909c35d7fa72bdc2c3f3c400aa7994238cc208871617206f29abbc26f3ea67e
MD5 9d39597bd45564e11ae22691d9bbcffe
SHA1 3fca527a93a2bcdadaf51f6ea4c487c7ff63517d
SHA512 6397c4d5e91fac7b6e369f449d2be405ea36b29f1bed55d51bfbb78093ed2ca24d604cd33cbc776f8c5c40ae35e8a39e4d7e0ec478fb38e74371233af3283c25
SSDEEP 192:ufqZ+xasuheOwQxMI8NbY8xQBnieaNEGDQmiU1sfRN4K/GPTxkdfUYCZXVsAgqmi:SEZcI38NbXV1EGCJCK/NdfEXtoRXE
TLSH
T161727C71AC786C3B4CE7A556F44636139EB89067A3C81F9482ED6B0D05DA6DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 82cef2d3df6f454125652df0b5d068cb1f421deb96d3ba9fef04c310b5fd0d72
MD5 bb5b55ac2bf1586440ef123f642e592e
SHA1 8cb94f63d1ce05c805359c5e7d83cd2d6b470dd4
SHA512 c97c158d22ecbed4b672941961f6f458be6af9b6049c47f8983e7e5c2331a430ea36f7177c59dd8a300a64f640712a3395c1aaf0539ffad223b79c158d40b1cd
SSDEEP 192:uRqI8NbY/QBnieaNEGDQmiU1sfRN4K/GPTxkdfUYCZXVsAgqmRLqyULw:U18NbiV1EGCJCK/NdfEXtoRXT
TLSH
T140522935EC78AC7B4CE39595F14636139EB891A796C82F94C6ED2B0C05DB6DC2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 675742732c89be1ceb19cd4bacf3f0d4734357ca8c64766b7193b8de8255b2ac
MD5 c99ae84817d05b676234faed8beb43f7
SHA1 1a838e8319d1d8ed33796478a8cdc7696109d7c1
SHA512 a345c27da7e23a0f13ce38e695c6b94528e4ab4d8b1be437207c3253d402e00c85ab52b8469af50baa508c1e2ac5f51480d0dc7fa11a25781e9f21ac8a97a412
SSDEEP 192:udSf+xasuheOwQxMlx8NbY8xQBnieaNEGOQmiU18fRN4K/GPTxkdfUYCZaVoAgq5:aQZcIG8NbXV1ERSJCK/NdfEaZoRXE
TLSH
T1A8A208F198E7583AC89E9357B77D2D134DBCD017B2881A54B3E8660CCC965BFD306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 123ad962c4d35056594ffd6cc9c148821869979ee7fd46db22b9d64a39811e76
MD5 d3b63001395d89b2a78b07ca56fea4f0
SHA1 a07fcac9c55dfc8e3c76082426eab7fe019f8786
SHA512 a4d78d2275cd077e15c86d568fc68231abc9c1abd9865e2996b8726bdff3829d756677209243736d6bf3156c0fff56ef68d7004eb7c5f2ba3d1203d96902fd6f
SSDEEP 192:7GNp6fNNQmiUyazHWPL/GPTxkdZV7qUkU6:7GNp61LNz2PL/NdZURU6
TLSH
T1BF02F934BCB86C7B8DE7AE59B48777179FA4216BEA941F44C6E81B0C00D769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75e789c17a544518318771879af6224c43c5de2aead7f7e8c499889a6d73d126
MD5 08663eefdfdbcd664d814ade218aa8a8
SHA1 67e14e26d7404f743793fa1e01e150ba1e99a4b8
SHA512 7d79e8f3975f169850eac796ee3fb2de7221a3d44d8f371d6fcfebfd3ae4cd49e3c68369c740192aaeafc5696fee9740a0ff3754f3991958fd42dc4a78a81997
SSDEEP 192:iGN26fNhQmiUyHSWeL/GPTxkdfUYCZ1V3ZgqmRU6:iGN261/OfeL/NdfE1LoRU6
TLSH
T15F120935B8B8AC7B4C93A565F08736139E75512BDB886F54C6EC2B0C05DF59C6307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

395ac1bc-0ae0-4dab-9bb5-4f2e6539f43e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\395ac1bc-0ae0-4dab-9bb5-4f2e6539f43e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

payload.exe

Path C:\Users\Admin\Downloads\payload.exe
Size 9.8MB
SHA256 7186d8fefc6304dd407b83791d000e6c151927958c65375fe463d46e40b07eca
MD5 55c601963ece9613aa8531eba71298cc
SHA1 f110e0e24527f4ad83e4798081bd9fbba1dceb5c
SHA512 24ab3e22a1f81a9814da686598165d46b1c65b0421b1c2174f9ff4b2109e4b3f63e4c27a9b2ec240cfe02122ad518db2c64b8be64724b1527b1704e62d2f9f26
SSDEEP 196608:LO2jDgPSNdBJp1156jXcXHnF3tuMp9lWX2ykCwoCd4Ud8jTd:y27NfJp/56jX2blY65+B
TLSH
T1D7A6334DB4231CFFD91B41B9C6596A87EB247DB9AA85653340C9F4713C13A183E3EE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\payload.exe:Zone.Identifier
Size 162B
SHA256 2cb562b59b6ab20f3bd94b26f0f7d866f43c2ad1c78298d8bf51eab0ff7b9ce7
MD5 daf29bb08a78ef62bdf748959f9c41f4
SHA1 675b7a0d5fcbb86f398443589bb4d187f8eef4f8
SHA512 2ace8299ea70bc726b11ad187edce918d4e2927580d1fe6e17739fbcba77075df4f5d94ceef96841fd2f143c1aecce7f3daed56c151d0c271d5dbcca3f7c25c9
TLSH
T109C080D750448426090435D012A994BD754F94454DA9C504A450D4DFEC8587486E11BB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads