hxxps://gofile[.]io/d/9XIGfS

Analysis

user interaction
yes
max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/9XIGfS
Sample260813-ymgrwsxdph

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	api.gofile.io
45	api.gofile.io
32	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311244540199187"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{470099DB-C4A4-4C52-A798-83EAAB47B735}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5220	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4704	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
5220	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe
4704	OpenWith.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3148	4708	msedge.exe	85
PID 4708 wrote to memory of 1104	4708	msedge.exe	86
PID 4708 wrote to memory of 4376	4708	msedge.exe	87
PID 4708 wrote to memory of 4376	4708	msedge.exe	87
PID 4708 wrote to memory of 4376	4708	msedge.exe	87
PID 4708 wrote to memory of 5052	4708	msedge.exe	88
PID 4708 wrote to memory of 5052	4708	msedge.exe	88
PID 4708 wrote to memory of 2028	4708	msedge.exe	89
PID 4708 wrote to memory of 2028	4708	msedge.exe	89
PID 4708 wrote to memory of 3724	4708	msedge.exe	90
PID 4708 wrote to memory of 2028	4708	msedge.exe	89
PID 4708 wrote to memory of 3724	4708	msedge.exe	90
PID 4708 wrote to memory of 3724	4708	msedge.exe	90
PID 4708 wrote to memory of 4284	4708	msedge.exe	92
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 4284	4708	msedge.exe	92
PID 4708 wrote to memory of 4284	4708	msedge.exe	92
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 4484	4708	msedge.exe	97
PID 4708 wrote to memory of 3364	4708	msedge.exe	98
PID 4708 wrote to memory of 4484	4708	msedge.exe	97
PID 4708 wrote to memory of 3364	4708	msedge.exe	98
PID 4708 wrote to memory of 2388	4708	msedge.exe	99
PID 4708 wrote to memory of 2388	4708	msedge.exe	99
PID 4708 wrote to memory of 2388	4708	msedge.exe	99
PID 4708 wrote to memory of 1372	4708	msedge.exe	101
PID 4708 wrote to memory of 4260	4708	msedge.exe	102
PID 4708 wrote to memory of 4260	4708	msedge.exe	102
PID 4708 wrote to memory of 1748	4708	msedge.exe	103
PID 4708 wrote to memory of 1748	4708	msedge.exe	103
PID 4708 wrote to memory of 1748	4708	msedge.exe	103
PID 4708 wrote to memory of 4696	4708	msedge.exe	107
PID 4704 wrote to memory of 5220	4704	OpenWith.exe	116
PID 4708 wrote to memory of 5584	4708	msedge.exe	122
PID 4708 wrote to memory of 5592	4708	msedge.exe	123
PID 4708 wrote to memory of 5600	4708	msedge.exe	124
PID 4708 wrote to memory of 5948	4708	msedge.exe	129
PID 4708 wrote to memory of 5948	4708	msedge.exe	129
PID 4708 wrote to memory of 204	4708	msedge.exe	132
PID 4708 wrote to memory of 204	4708	msedge.exe	132
PID 4708 wrote to memory of 3864	4708	msedge.exe	133
PID 4708 wrote to memory of 3864	4708	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/9XIGfS
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,5575600494494694296,6984349798785125975,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,9180430199366349564,11896555736878710611,262144 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,2630410854341660105,15690361262876162960,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15777995141796435405,18361384856223095306,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11716539315628696239,16197351575517801990,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,15704482607069196601,4584567290293863633,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,2042613784775646921,6936344436458491766,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,7286371803967900742,7437338043799943804,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,2563768610656479160,691216613116336268,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5724,i,17828871265587916121,13283608018758760059,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16844691079919064364,17734058316554185126,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,16844691079919064364,17734058316554185126,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,1423729926917400039,7534421843491149203,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6496,i,10730910715866581045,17903792549109866391,2097152 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,13576091581390889882,12629759615782038063,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,7749871042818954474,11995066060056380350,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,8439731605292619117,17678151141911493180,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,4333376231328563132,14277882522409470651,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,12515069542117214844,2781396436859995291,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,13901035865861540700,10821194396838207792,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1135940341153346157,12712298013189274385,524288 --field-trial-handle=2604,i,5377619962526898625,9151274494810460307,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CrosshairGamble.cfg
  2⤵
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

1e383967-5bbd-49c9-b7bc-6d6559ef3458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e383967-5bbd-49c9-b7bc-6d6559ef3458.tmp
Size 12KB
SHA256 da0e9331acabe1c6eb31adef69417af90e241fdb2891be3610203dad70d80d59
MD5 8c42d36e8669dbff8c59c4010e3fae87
SHA1 6b843b6c9769f6fab7f2560388bf30d729e6fa76
SHA512 5f39d4979932688fe6debd09f5ee5600afd7d8209ed87a76277464698d83dc28d9dc5ced28a5fe4a8a7410b8282a05b661adf800f613e52f66d03ff67c8e29dd
SSDEEP 192:sxZ8RGyM/jK1Ml8M9t/fNsJ5gV/IdpjlJHW6+WNe/b/YvGijI7IgrJ:sxZ8Q1t/fNsJ5/HHbE/ga9
TLSH
T1DC52D8116A34A977CCDBD20DBA55BF53D6F9057292900E44A9FCCA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fd59e4e2dd2dc0449867825c0aa5a8af36e47410723bcd50133b5047fb20595f
MD5 bead822ae0978c74d503289a28f80574
SHA1 63985518bb4c84b1363fb73ebcd34c8481f6a58e
SHA512 22d5cc2f46b9ef702de7c9f0d4fa944a1582a08aa44b3d3a893214f36be6c5d83ba81472e552714b20e5bff35c3d3c6869c18becff2c18fd50ffd3ee7b8ec674
TLSH
T149E0268446C9DB7FBE90648B5168874CCBA1360ABAC8BB1A2705A9C572421D0F2C36F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9d60f841fd62d84a87548f5d9a9064c57bab99eacb63d7494f7f58ca83721a8a
MD5 4365ee9472a28db0d9bda2ba19dd5a8b
SHA1 b1bd72388f690fab0e1f1f70e39bcfc9222806d3
SHA512 4f8f9ba179da12bbf662f6e47d33bcbb7a8069f6f9f715045c15aaed9a7af5616bf5137cf78e4c558e7eac892280c3643289b17546894544e9a97c31537e84ee
TLSH
T162E0209456C8D73F9F50664791A4DB4CC6A0360EA6C9BF05170499D6704128463877F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ab6e60faad9ca11d34969d414eeada25bacfd0c7b73e7bf2507f4537108ec5c4
MD5 f71f80f2da99e9eab87d6d5829c31063
SHA1 0f89fd2d6facb8ff1dcf40f2ccf462ba9827983f
SHA512 fb379c7a714277fe896ca13f829c520158d8c802df23da75e4fcc598d71fda97f7ea051b55fcb40f6ee528ed9207a3a77193a5d6cfb07cab2fab797c7533a458
SSDEEP 48:zw5gNXP1k1g+q696mAFFUtbun2Zbh8w43WkBzigO5FB2AxZhsfL5fwshUhCY1K:zw+RVK+Fs/TOegSB2kZhsfNVhUo
TLSH
T1A991D771CAB21379DF16CE3296CC0198377681F3F9175E8A8B414D33A62231EB2149BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589dd1.TMP
Size 3KB
SHA256 5360db4a54321ae86f25a479004b84d04fa2e2ce3a5b78869581bc9b294934f8
MD5 51a2d78bbf8c41227e13adde644e223f
SHA1 d2e7a76d05d1dbb9c6f0dc3663f3572282839e4c
SHA512 6ca7c38c76360a55d83204599ebdb1972f549491ad583c7564b17caa85c201520c5b0e385ac14a1a122a99b54034d083faba49d390197680ab00cbe85ecf2fd6
TLSH
T16761A4750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990805633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cd3907ecaf93fdfbff6835c1277d87d0e7d28d29c843e891f9048c3cc4ef4331
MD5 ffacb0af801a794a837d3517be073109
SHA1 10e375f4864c72f1e6cd86f25aef8c1aa38e392a
SHA512 6c25d33de488a504c0a228fe53e5df5f8fc1c9418f8a326c34cfaf709f071b477edb9de2c9f4839c16b3892a9ea7c6c703397390a5e7ab766500945c1c0f4b52
TLSH
T13541ABF3C3EC957D8D2252F4AA14AE1BCE5C1416832C7A7A8AD49E07A3F3821D10564F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c827fb298b15f73fd33f718d5639a9b4227650d96385ec83c4c18bf1269c0282
MD5 c98671564ffbb09c2143001392b0837f
SHA1 60af7f0aea6dd69439db16e8273697aa56a9525f
SHA512 478552597c038309fc7460cee834226942a1cbbaaad27840344d4d350d470cba08a21e9e565691dfd2b0ac5d6235ce89fa3b634faffda0ba0a8e0f22aed74189
SSDEEP 768:i8seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppJroZQ:i8seJ3xWvhfynu1jaVcL88piu
TLSH
T1E5D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d9b4f6b7d5722c0938886787d0a2ae21f810c76c5370cdcf5aa0204dba207cba
MD5 b8e941e94dd7ff69cb2f9a71c2c990d1
SHA1 cbf3a4af2617b967a8d2c36f908fb907bc69af06
SHA512 b9814e1f410cdd40b021dacf8ffa2cfab24911305d9d4aa71894cf36f924687e45a7f60a8f5ffa19dfd41fc1c34de1a92b7d7600dc8a3b0f9778868dea0ca02c
SSDEEP 48:KYHIhKggkXySdIxK+cMjyB+IuKCM0bytz:KYH+KggmBd+K+ciC+1KCMSmz
TLSH
T1E191A602357E13023CBE284CB2AA96374E4271A77059F5AF7FB844925E66E510EFD9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4d595ca077d6ddf302195a2b387eee9e2d44b469c442d24fb3038a07d3189a18
MD5 933d9957970cd518b1e057e2b56fac12
SHA1 483894ed555e6b0ac78f8a72209ed49b5ae4f2b2
SHA512 2fb427d591dfc6ec8584aea207952a694d63fd73aaa26457e4c40da2945dcf1878642779b15e214b9a92e6c6f53dc81440cfd38fdf483c3f881f111004031d9a
SSDEEP 192:uPm+xasuheOwQxMGsNosQ/FVSM7r/xQmiU1JrW4MTobWCIK++Wyim8z1LXqTUCYy:pZcIhsNosMV7LPP5zFIKPlaLUUo
TLSH
T1F0626D726C68DD769CA7F145F48A36134FF8816BA7C45B40E5EC6F2C00DA56C131792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e95b55708a53560a26d1f68f2c525ccfd4abe1f204ac6bd43a62684f70948437
MD5 11864b13221f87fb31a6ee00522bbc16
SHA1 7083bde2c1f9fd620cecc549b8358a3a84b7da48
SHA512 1dd7962bd6f0d62366fdfe4de32d8ceaf0b063b8db6ee5fe9f646e1074f0cf880ffa45a3aed1be0d8efb8f3f4ba5d0c72f2081b4e59f5ebb92b7a0a01d549130
SSDEEP 192:uPl+xasuheOwQxMzsNoYfQ/FVSM7r/IQmiU1JrW4MTobWCIK++Wyim8z1LXqTUCN:8ZcIMsNo4MV7LoP5zFIKPlaLUUo
TLSH
T129726D726C68DD7A9CA7F145F48A36134FF8816BA7C45B40E5EC2F2C00DA5AC132792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 df5ac28d3ca57098b82992080c9f77638f0586debb941af5e26fc36c3a193814
MD5 20a732efea0e74c112d961b42e96ceb0
SHA1 e166b366e7ff09bd020e9ddcd89c97e24c76158c
SHA512 2c04dae33d153d92dd4c3120616e1cee7d14fc07f88277b5f79d9c5e8f2757017eb1a53af1eb9e7691a9aaf6f748be9edf42347b56d22d7d42759479eb3497d9
SSDEEP 192:u1l+xasuheOwQxMlAsNoYMQ/FVSM7r/IQmiU1mxrW4MTobWCIK++WyiA8v1LXqT1:cZcInsNoZMV7Lo4d5zFIKPlCLUUo
TLSH
T10EA208F168E79836D8AEA343A37D2E124EBCC157B6845A40B7DC2A1CCC9617FD317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b5c9922d2099064b99be1d46fc7ed4d1a612970c4883d2f405450509defe2a64
MD5 9866204b36429e58bf5df393a56f6819
SHA1 ba872cf89513f1a83fbbbc9109f4b5c31b4b3eb6
SHA512 1f6f01744ccb0d6b11b161eb36d400a849d20af18c2102e5306546dc01b38b827c92a833334bb933c8790e40da346a94a8aa4de327caac9c04956bb2e924da42
SSDEEP 192:u4l+xasuheOwQxMzsNoYMQ/FVSM7r/IQmiU1JrW4MTobWCIK++Wyim8z1LXqTUCN:NZcIMsNoZMV7LoP5zFIKPlaLUUo
TLSH
T1B5725C726C68DD7A9CA7F141F58A36134FF8816BA7C45B40E5EC2F2C00DA66C132792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72a3ae9bf3b5ccc640fd3fce759d1dac7826e3d6f3e55fcf598331b6ec115920
MD5 1c917d27c54d7701331047fdc2e54441
SHA1 34a89c22277dce6e8e5018c3d33cb5336158f00b
SHA512 2dbf5d87ac9a2300f5cbfad4aab2223ba932a3d37c1c48e1fec0517d490adf8c322c5f70f8dd59229c337b942bc8e08f6fa753056c6c036ed72d3978b036da9f
SSDEEP 192:lONG6vMtPQmiUy56ThTobWCIKp847LaLU/u:lONG6UtRPTiFIKRLUU/u
TLSH
T1CE020875BC686C7BDEA3BE45F48E27171FF411ABA5905B50EAE82F1C00D765C2303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f20a9b7914797b568055dfeb28c645057c879932345b25bc9a8afeb2e2e7bcaf
MD5 5f05a3b58f49de00cdea640afd08b2b1
SHA1 a8826f3d99e8f07bb458f53458cfb64a5fcf8e8f
SHA512 8995e5df21db8e9f1fdee28893529185590aeac720947693c552c1f7459ccb4b069d05e56ac8bfd4e1298a02e5d494ab77e907f7fa66db5c29feaa343217e7a7
SSDEEP 192:gONh6vMtPQmiUyu67hTobWCIK++Wyic80ILXqTU/u:gONh6UtRW7iFIKPlULUU/u
TLSH
T1B5120A72BC689C6B9D93B551F48E32131FB4926BEA84AB50EADC3F2C01DB56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

707b7e8b-9814-42cd-bb6a-2d6ba0235d33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\707b7e8b-9814-42cd-bb6a-2d6ba0235d33.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 70934373d993d021116727a1c46221f041b6aa0f5616d4db357949e8c91c18cf
MD5 6ed2a9bc24a5b20cb70b114f4ffc5dd1
SHA1 bdb15824f812996eeb1e167dd9f93d714eddd71c
SHA512 cb5345c02b008f85437a265b5d7221a528646d81864de5d485ff0d45fab66fe7565e2d66c5e6ee66aff6a11834097f4125a4a66c3dd5063e9f1fa3227c5854a0
TLSH
T144417A5CAAE91108B3B77E5A9BF7A86D847F7C332E06845E40010E4F0A37B41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

CrosshairGamble.cfg

Path C:\Users\Admin\Downloads\CrosshairGamble.cfg
Size 1019KB
SHA256 16c990da9b3659df0c407bbc11657c025194badecac6cba11d264ee85d36628c
MD5 41fe7aa6367a33fc6125d4de9fce5ba0
SHA1 a30f9523864af54ee6394f0a1fb57cb79c82e9e0
SHA512 a447d63fbb695f8d86f2c448247a39494f025ad77e0fb746ad7675850417b2bdd5ed1cff990a53876e21eabef2a13e8d75af4a0d30c18aa0bd733f6178d15c3b
SSDEEP 768:+K0oGKqzNktDzIUsI4MtkEb1YApUFxc3Y3jKi:UT5CzIUsI4MtkERYbxc3Y3jH
TLSH
T1202512A8D1B109AF1E83713A32AE5A56E09486FBCF064AB1716D5F40097C29FCF4D787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads