hxxps://gofile[.]io/d/r03NaX

Analysis

max time kernel
299s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/r03NaX
Sample260812-zb71dasvft

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	api.gofile.io
28	api.gofile.io
32	api.gofile.io
34	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310404501658588"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{DEFC8B9D-4C72-4F41-BBE3-1D4A13F06D03}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2064	3884	msedge.exe	86
PID 3884 wrote to memory of 1728	3884	msedge.exe	87
PID 3884 wrote to memory of 332	3884	msedge.exe	88
PID 3884 wrote to memory of 332	3884	msedge.exe	88
PID 3884 wrote to memory of 332	3884	msedge.exe	88
PID 3884 wrote to memory of 4352	3884	msedge.exe	89
PID 3884 wrote to memory of 4352	3884	msedge.exe	89
PID 3884 wrote to memory of 5036	3884	msedge.exe	91
PID 3884 wrote to memory of 1492	3884	msedge.exe	92
PID 3884 wrote to memory of 5036	3884	msedge.exe	91
PID 3884 wrote to memory of 5036	3884	msedge.exe	91
PID 3884 wrote to memory of 1492	3884	msedge.exe	92
PID 3884 wrote to memory of 1492	3884	msedge.exe	92
PID 3884 wrote to memory of 2592	3884	msedge.exe	93
PID 3884 wrote to memory of 2592	3884	msedge.exe	93
PID 3884 wrote to memory of 2592	3884	msedge.exe	93
PID 3884 wrote to memory of 4956	3884	msedge.exe	94
PID 3884 wrote to memory of 4956	3884	msedge.exe	94
PID 3884 wrote to memory of 4956	3884	msedge.exe	94
PID 3884 wrote to memory of 3724	3884	msedge.exe	97
PID 3884 wrote to memory of 4520	3884	msedge.exe	98
PID 3884 wrote to memory of 3724	3884	msedge.exe	97
PID 3884 wrote to memory of 4520	3884	msedge.exe	98
PID 3884 wrote to memory of 1136	3884	msedge.exe	99
PID 3884 wrote to memory of 1136	3884	msedge.exe	99
PID 3884 wrote to memory of 1136	3884	msedge.exe	99
PID 3884 wrote to memory of 1516	3884	msedge.exe	101
PID 3884 wrote to memory of 2688	3884	msedge.exe	111
PID 3884 wrote to memory of 1180	3884	msedge.exe	112
PID 3884 wrote to memory of 1324	3884	msedge.exe	113
PID 3884 wrote to memory of 2440	3884	msedge.exe	119
PID 3884 wrote to memory of 2440	3884	msedge.exe	119
PID 3884 wrote to memory of 8	3884	msedge.exe	122
PID 3884 wrote to memory of 1072	3884	msedge.exe	124
PID 3884 wrote to memory of 4236	3884	msedge.exe	125
PID 3884 wrote to memory of 1072	3884	msedge.exe	124
PID 3884 wrote to memory of 4236	3884	msedge.exe	125
PID 3884 wrote to memory of 2152	3884	msedge.exe	126
PID 3884 wrote to memory of 2152	3884	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/r03NaX
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,16753698346932157119,7673641021135353283,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4125078347371697643,10904732085820562139,262144 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,12371638471575247473,16885290866455683148,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,15119160856576915576,10061817166975038412,2097152 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11264305232216735425,7642049581649916276,2097152 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,9624918444187285597,12136561479399744690,2097152 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5704910613547765329,12072166300865470126,2097152 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2187483336942796895,9436555405313753415,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,15689734206345770336,6310063223802297849,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5692,i,548249742006509309,16961093581672950515,2097152 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2548714789626113488,13669296863489149581,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2548714789626113488,13669296863489149581,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,13267932538539731049,15533448344691815017,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,13414755911826784871,12305772537694927639,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,16832676850426492688,10697302094359939710,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,3491911122308623609,2742788575078723559,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,12170057273398332866,4156059879305902811,262144 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16304888924722876852,2419943503886133255,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,9076811850649945153,4220390146841014969,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,868417517845118816,5030691577351373063,524288 --field-trial-handle=2284,i,6862722629034476039,14399091244787749488,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6a64ee3e755b9870c2ba66da71c9e16301d50ead76b383c8afced8e3f9a477f7
MD5 f2fa5b55374702aee86c7babcad7a197
SHA1 7b270628cba9362aa8b7ff7a0a6ead8af6fe67fe
SHA512 716eb7a1f0a1bd3f833108263bf18683f7c570b73c22eb444625b8729b3f22e2777a0ca6d5bc122bfd51f56b11ed065a993ab179fa3a7b6e09c25e4cd5e7c9eb
SSDEEP 48:mT9Wgeat7/VlXP/wkSAeuvvHl2vBDVC7Xgj2CuAFgXFzUgpulfNP:mLFVlXjeuvvHMtV+XpC3FgXFQ5NP
TLSH
T14C9173BA1592DDF3E3D13A3190C03AA7BBB181E4F813BD6E63970C7563097614A694DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a89f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a89f.TMP
Size 3KB
SHA256 715a4ef950cdf9d05ac804b6b09b3dea96c13c10e62072175c4228c40452b4c7
MD5 9f8e90e0aa86853e0937d9d610fd09c0
SHA1 773afdc75bfb4eb7a3261c75da28efabf85216b3
SHA512 acc0c65162b316851eed167408a7e7ae751999fe8909b19b58bc1ac9e64c547a110dc2e621112c530e3cf7fe98360156b14278f5186d66e4836960966a14c62c
TLSH
T1A461C3BE0582EDF6E3D13A3190C03B8738F190E8F923BD5D01E348B5640AB214A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6891fa754b26d1f1751d34227803762da3553426dad94d3ab33404c1a52bb46e
MD5 e4efacf292087cd09d42c29bbcd01eff
SHA1 806fc62b1c0d196f9ef856aa6e45423d8d9d2ba1
SHA512 315a4666d96c2f659fac63a0d8e4f01af8e3db6958408828c2062546779069da591bdf56c8a601325c634db79436f6b99b5d6d87ca976b5c9b79a98dbdeae6d7
TLSH
T15741ACF3C3E8916D8D2152F4AE14AE1BCD1D151A832C7A398AE4AE07A3E3931D10565F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c45eba45a6bfb5d8830e7c844ebc26988c9ddb781beb91039c3ea369637f6136
MD5 3d6eb82bc9ede6f5456eaf68bd768982
SHA1 bc35b97c9c493567773be1fcbd72be429917917c
SHA512 0d072964909a48d1d447af0ca1ebe5d257abeb466fcc59836c913a450fca3c8c5df23f0b50563a6c226317cc9d77c6038188e61cec05e5fcc2f9eedf6818fcb6
SSDEEP 192:sxZzRKyM/jK1Ml8MkF/fYspez+RbIdpjlEHW6+WNe5e/Y9IdED2IgrJ:sxZzkMF/fYspez+mSHbR/J9
TLSH
T1BC42E8116A349977CCDBE209FA55BF53D6F5147292900E44AAFCCA1C05EAAED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a1ec3ea402a165c5c9c6136a8e4b5d4c5a36b082d3dd33c7d4e34bd487f70f2
MD5 d3ef64a6e82b26daab179f7fa087fcf9
SHA1 4b816cf18dc1d5bd99e975d4a1dd57c3a36c3ab1
SHA512 935fefc37ff2bd4cd4f31cbac73f9d6919c89a8ec5d91d59d2c9ab04875f3130f8c11a640076eb043334ae96dc672eaf124a109a679cdd724ea68d7c6b3bc933
SSDEEP 192:sxZzRKyM/jK1Ml8UQLkF/fYsXezRRbIdpRlEHW6+WNe5e/Y9IevD2Ig51J:sxZzkqgF/fYsXezRmIHbR/tx
TLSH
T18552E9526A345977CCDBE219FA45BF53E7F4147292900E44AAFCCA1C05EAAED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6a76774ae1d7f7c490797339cbb56a4949b4aaa1cbf9d4f7afc674a5315c049e
MD5 c1b066b135b523f83171b4c6f7e977fe
SHA1 07ac69e6b70133582877ce093b1c30f16853060b
SHA512 52d7a138638b46a56aab940ae9974dd7ac42f9153dedcdb4a4f51dfaf13369b5eaa63bddc76c4aa7905df8b6405f072491d5586c5a9cc0bdd250b3482b09f6bf
SSDEEP 768:5jucv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNjCropg68:5jucv21wWvu+Z+u1jaeFLeRNjZps
TLSH
T1A5D20A2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7d65830a062ec2903cebf89a9bcc606f2c0ab54327ca4dcbb55043485b534299
MD5 dd50187f5f338f18a1cbadd0fb5c7c51
SHA1 8a38abbc5c8d61525ab44f395e12035a9e7e0450
SHA512 77969ce791803a6a93204ceef41edcc82ce3af20cf77e1bc52586a57f5b17104cbd7499fba1f87a5a1e1ab5179e8320974b5761011d497006cd202fbbf7e0d37
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaIPmrflp1gJxczHHgKf1HdgbXHMT:mTfHb7P
TLSH
T17491D651347F42923CBFA98CA269862A5E4272637424E57F3FB904914F67E125CFC8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 18195f68bc46917565f84eb3fdf125dcbbd0744e0584720e06c0805d45e60723
MD5 26db026767ce88e0cd33b616281e8406
SHA1 1d7bce04ad683074528147207df084021d1eaf55
SHA512 3126d0c070e7186d8491d71c0d15aba671ac63e461dd5360d096a957f11be03240e8f168b53d49fc6f1fe0709ec0db8ca879a1127986fbf9b4b4a0a7f3d38e6b
SSDEEP 384:LZcIhsNv/w68ziRE+e+CXOmep3JrCnuMsRnlYZ5:Th33P5vO9p3hCnuhn2Z5
TLSH
T166928E32AD381C765DF6A552F58A3A135FB89077D6CA2F84D5DCAB0C02DF9981306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3983cc140c3eb8a6abddad25075fd15a33b0daf91d088e78c6e9a47931c948aa
MD5 3eb78fd20410605604065bd2813b6cea
SHA1 3563e133381894a93b0ed16b0005bb65fd23ee27
SHA512 f1b2c344e9b357859ece7c84059196a4520d44ce6e8128782f5ddb4f494b658eea17089b095a6abe6f15053994f1ea62db80134fe799ac7ee3d00c9d53f30eaf
SSDEEP 384:3ZcIhsNvUw68ziRE+e+CXOmep3JrCnuMsRnlYZ5:/hC3P5vO9p3hCnuhn2Z5
TLSH
T12F928E32AD381C765DF6A552F5863A135FE89077D6CA2F84D5DCAB0C02DF9981306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 51a872def671e29c0a10970de7f771930967a9af6bc31046f48d5e12a503a875
MD5 8c111fa6b0bc798a88e875d6065f73d6
SHA1 dc7036f0b9a6e23a1afc27e23870ce2d71dce117
SHA512 51d669c228ff5a6a924443a89c3720ddc76cee7e2f747aef57350b4ab5b329c7941ff2794cdfaf1d7c508265eff235e4528108d76401c430c7f0e23045b20ea6
SSDEEP 384:CZcIXsNvbw68ziRV+e+CXOmep3JrnnuMsRnlYZ5:wXX3C5vO9p3hnnuhn2Z5
TLSH
T161C23AF198E71836D9AE6343B7BD2D124EBCD067B1852A40B7D89B0CCE8A57FC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a8ec340d6c687f79b3cdc8634d4da27bb61de4a92120e9b9833e11c4bfbfd63
MD5 b4091c262877921335c294d9c43d3373
SHA1 9c91efb32be483cb366b2a1d4167ad59ed8f90b0
SHA512 b3fff6412618790b5e9ef32d6df264b237fadf213f28038a2c29b44ee36d7391515c82ac837604b1681a81fba67b9df2dbb559e80a647bc559dd29532cff2f7e
SSDEEP 192:JONO6v+YLNQmiUyDuZh+CG6Om9oEusAlU6:JONO6vz/bZh+CXOme68U6
TLSH
T14702E935BD281C6B9FF26E45F5873B275FA8217BE9962F80D9E41F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5a41bee712f8e7e24149a378215e8d8000699de0cedc1dae2c16b09144617aab
MD5 1e17b2a110598d17ee7f6765ccc36f0e
SHA1 5d5cc221ec1280370b71e74c95285f9a4aef20a4
SHA512 3da388b06b0ec4b26dc82b7f8b794132b6dee3869f52b00c7a6c7a30bd46e4285f826280008e803803c6527310fc50d22915f43e89dc31d7673d24cb6ba3f3f4
SSDEEP 384:aZcIhsNvbw68ziRE+e+CXOmep3JrCnuMsRnlYZ5:YhX3P5vO9p3hCnuhn2Z5
TLSH
T18F928E32AD381C761DF6A542F5863A135FF89077D6CA2F80D5ECAB0C02DF9981306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ff2316aa50bd4c45e84b31fa843c9b0a48e95b83275396d702981556c9d454d
MD5 00c50eb81f79ff68b357c0ed49a2a716
SHA1 ddf927f0bd3940fdcb683be1e9cfab6b0d0d9c79
SHA512 25d6831f7a16ec5ab0456fa48228f253136f3285d5cb74149eab18f56c81dff4caf978eaf04a4d01244be9a563989555a14475a329ef29e8e01030aa42626331
SSDEEP 192:OONi6v+YLjQmiUyWu6h+CG6Om9opwSJrHcCHnbqhU6:OONi6vzpE6h+CXOmep3Jr1nuU6
TLSH
T1FB121C35B8385C7B5EE2A591F5873A139FA85167EA8A3F80D5DC2E1C02DF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14286bc3-2f40-4832-aae5-df511cf0df73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\14286bc3-2f40-4832-aae5-df511cf0df73.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6b09e49f5edee45b9141e6640cd856279bca1eec391caafc348842c679166133
MD5 77087f83e3cb9810cf26e5f6795ad592
SHA1 4206a6007605a6dc73696ad98f62debd1410e7b2
SHA512 a7f0908c9cefe7c5b0e136d46b36fa251d5d31cb7d3234b3654216eb955574ab7cf0af5556398df4e4db7ac9658fc712c328c41037ae30b7df9e85796f793caa
TLSH
T136411A4CBAE91148B3B7AF5AABF668AD487EFC772E06D05E00110D4E4B62A40D971737
MD5 SHA1 SHA512 TLSH

Submit Download