hxxps://gofile[.]io/d/Dloc2QJ4

Analysis

user interaction
yes
max time kernel
126s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/Dloc2QJ4
Sample260820-yncvbsvakg

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	api.gofile.io
27	api.gofile.io
23	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317293426161250"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{CB27264A-3F41-4A71-B1F8-FCFF0C360D6E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2128	2504	msedge.exe	86
PID 2504 wrote to memory of 4192	2504	msedge.exe	87
PID 2504 wrote to memory of 4800	2504	msedge.exe	88
PID 2504 wrote to memory of 4800	2504	msedge.exe	88
PID 2504 wrote to memory of 4800	2504	msedge.exe	88
PID 2504 wrote to memory of 4928	2504	msedge.exe	89
PID 2504 wrote to memory of 4928	2504	msedge.exe	89
PID 2504 wrote to memory of 2304	2504	msedge.exe	92
PID 2504 wrote to memory of 2304	2504	msedge.exe	92
PID 2504 wrote to memory of 2304	2504	msedge.exe	92
PID 2504 wrote to memory of 2156	2504	msedge.exe	91
PID 2504 wrote to memory of 2156	2504	msedge.exe	91
PID 2504 wrote to memory of 2156	2504	msedge.exe	91
PID 2504 wrote to memory of 3676	2504	msedge.exe	93
PID 2504 wrote to memory of 3676	2504	msedge.exe	93
PID 2504 wrote to memory of 3676	2504	msedge.exe	93
PID 2504 wrote to memory of 4980	2504	msedge.exe	94
PID 2504 wrote to memory of 4980	2504	msedge.exe	94
PID 2504 wrote to memory of 4980	2504	msedge.exe	94
PID 2504 wrote to memory of 4664	2504	msedge.exe	98
PID 2504 wrote to memory of 4664	2504	msedge.exe	98
PID 2504 wrote to memory of 4664	2504	msedge.exe	98
PID 2504 wrote to memory of 448	2504	msedge.exe	99
PID 2504 wrote to memory of 448	2504	msedge.exe	99
PID 2504 wrote to memory of 2108	2504	msedge.exe	100
PID 2504 wrote to memory of 2108	2504	msedge.exe	100
PID 2504 wrote to memory of 2508	2504	msedge.exe	102
PID 2504 wrote to memory of 3388	2504	msedge.exe	103
PID 2504 wrote to memory of 2852	2504	msedge.exe	104
PID 2504 wrote to memory of 3388	2504	msedge.exe	103
PID 2504 wrote to memory of 2852	2504	msedge.exe	104
PID 2504 wrote to memory of 2852	2504	msedge.exe	104
PID 2504 wrote to memory of 5360	2504	msedge.exe	119
PID 2504 wrote to memory of 5380	2504	msedge.exe	120
PID 2504 wrote to memory of 5388	2504	msedge.exe	121
PID 2504 wrote to memory of 6032	2504	msedge.exe	127
PID 2504 wrote to memory of 6032	2504	msedge.exe	127
PID 2504 wrote to memory of 6032	2504	msedge.exe	127
PID 2504 wrote to memory of 5884	2504	msedge.exe	130
PID 2504 wrote to memory of 5884	2504	msedge.exe	130
PID 2504 wrote to memory of 1744	2504	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/Dloc2QJ4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84a22c188,0x7ff84a22c194,0x7ff84a22c1a0
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1467701120836054183,1413291990589601034,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,15335554737314151089,14118124718144858827,262144 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,14617574184735040009,10391858049532790530,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17620565433992631396,13397620428584618394,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,16170948768920819824,15704374375642427348,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,10986610116626779668,412354511713522210,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,1611049220454362866,5318629053397651001,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,7913698609431296394,8955616660968319466,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,7812801572366336001,14718740469436064221,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,3722199210693254032,7851329390687870546,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2865477780689938923,4683079666908748065,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2865477780689938923,4683079666908748065,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,10228210538823571366,14794412294027007319,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6452,i,12992243515878116671,15875270806763236605,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,8892175049921476619,11156018809273395974,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,2222587020402276629,8929570176913742161,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,673467588250562355,2111983552744673523,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4284,i,11263646602631353574,6793100975288583969,2097152 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,13817812797110152262,12167981707586736224,524288 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2932,i,16485929498806571004,16938120948372038808,262144 --field-trial-handle=2220,i,9919319104780795762,4159929412028741837,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fd216c7727d0e3760ac73bf83bb499de618d7844125d442fcb806cf190a9112f
MD5 1c25701f6aa1871452be6fbdbf44de32
SHA1 adbca18385edea50558f139093af9f6ec67cd1c4
SHA512 604a80841f4ae113add4d3c6f25908aa8d9b9a856b9e189c5eff3a1d8a90ae3c28b1ade6df2c2a9ea00a89e26b2168614e8bba470f48f2d26d1bd4fe09b5e20e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8c936d6f823548a136098a1b540f0f528068b47ac9b6ae2e98415fef98e0b3bc
MD5 29580b5c18cff769965c2b14e72ed89a
SHA1 6ce6d9763be0a408c45e2d5f7b27b7a042786276
SHA512 456e9681b127c3c94aaaf69ec51338940da031e693bb57f38a30faf2d8558e3880eeefc9fa682606c50311a8f91936399bd9d7a020549a7d1fbcd08953e2756d
SSDEEP 96:C1Pnr6/NzxB8SWWtt9vodEJDE3y5zf64uVpzumGaZtoxVhCibyJ2rBi3jPQRts3z:C9UNzx5WWtjvod6DE3y5zf64ApzumGaN
TLSH
T183A1A22A71CE6811DB368E33D8C0C1773C326B9F2A177EA17296643E09B5BDDD874486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589f96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589f96.TMP
Size 3KB
SHA256 9a2124e2bcab61d03f30b8b479e5a99c97e1ec693354bbae41ffdeb04d3b6519
MD5 d93a39e1e58bbf31e0c5ae1732ab3466
SHA1 13c146479e232efec1edccfa21c226755b848e6c
SHA512 fdbb35c18bd9b9eecf99bacd0bde20d716c3cc7106d238623fe7c3cb623fffa3ca649b662badff3a27ed2728f8a8932330378b44b20762ed4b63f650e3cd1ab6
TLSH
T12D718F2875C20441D73B1A32E9C0D0363C72A3AE366BBFA192D6B53F05B6BEDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 27969fc26c4b0cccda70182beb222492e653622f3d2fef7623aa7550fec64198
MD5 178cce43cfd97f48a3ab4c87bd1446bb
SHA1 9f79417b002c9b94e773f815b835eed9b1fac9fe
SHA512 1d6adf0e364b32ac0bf35d24faffd5411317442cf830cabc10831eec5412889184cf84534b54c51c7b98950f96243fc951b48c87c3e7ceb8d90aaf8163b916fe
TLSH
T15A41AFF3C3E8956D8D2652F4AA14AE2BCE5D1415832C7D398AD4AF1BA3F3431D10564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 73ec8922da164a23ffa445c306a333c7e25e5823062367115eb430fe133f1875
MD5 b1fc3a018e329ca7c2ddd8cf3b7f444e
SHA1 fc55c7e84749909533cdb1d3f250067fd17a3d54
SHA512 586a5fdd5539d14698652349a7655eb36eb739fcaeff401491d52c85aad83140bc0e4cba9df2c5fe2446716ab6fa145798526defd0dd12ecaac1248fdc550fc4
SSDEEP 192:sxZVXRryM/jK1Ml8M9r/fhsR4tkIdpjlEHW6+WNewZMa/YwrSsk9IgrJ:sxZVXZ1r/fhsR4t9CHbt2a/NK9
TLSH
T17C52F7116A34AAB7CCCBD209F951BB53D6F9447292904E44ADFCCA0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 420ed1383e6511463dda21679b1f422a292a52fcc72c7658128f49867665de35
MD5 e739905894798d93ebd038fc10b34214
SHA1 ef19f8c7c720b1d2beccf737489a7fb5d40ed84f
SHA512 30601303061c717b0d9b4c7558b36b5a5cfa175489f0e03515ab02aab1f8ccd5188df90404a795ced7c4a7a56ab9c157d263345b8c63bf955a9cb5bf12eed7ac
SSDEEP 192:sxZVXRryM/jK1Ml8UQL9r/fhsrXtkIdpRlEHW6+WNej/NYwycQ9Ig5LJ:sxZVXZq5r/fhsrXt9QHb0NS3
TLSH
T12B52D711AA346A77CCDBE20DF951BB53D6F9447292905E44A9FCCA0C05E7BED222381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 774b413997b1b89db02080cb16a4aaf13bea20dcf12e60a7ff400f5e4adeadec
MD5 e4106f1a2e3a188b77a5bd0f4230f46f
SHA1 b39df3a50d1fa9fedc705c8823d8bf541da4b74d
SHA512 a6d79b8c093dc70cd7ba2e93986b48d6221141e81191556bef7fb46ff0d149b13065d5e23b7ce5461723c904fa91976d473381d0733c769b933a938ba9fc3435
SSDEEP 768:rM4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dMrohZcYa9:rM4jeXmWvmKLEu1jacPLZQdX4h
TLSH
T1F7D2093B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 68b058f837ac60c9b3d8b57b40080b9ffcc593970034f35d0e06ceaf22a45f59
MD5 44359ef1306471b201cfe7482f52cdc0
SHA1 5302e2d184ccdbc168980b79b8f50169dd5302a3
SHA512 eba91a664301d6dea750f3b0563c117fe37b82d4e244ce6cbe0b80091080cbfca681ca54285613f270899c6ef804c6c1ff4b349cd4301becc0a759e182188d6b
SSDEEP 24:KdqfdmXaMdg8Y4IU+LIjCYKi7ha0Y1ECISm2Mf8K1yXYOfhSTaAdUws4EQ+3IjWX:KwjIhKE4svytjIlKsEogeI3Kvacjyn
TLSH
T1CB91710131BB22013C7E29189690D62B6B52B563355CF86F7FA874B20EA7E240CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592b1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592b1d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fd9bf47b396916a417b7c81ce9714fa8a6dbac2bdc538d062a782cc01e14c819
MD5 e741b101918bbceac13964844ab7e3c1
SHA1 f39f5c3160e7962cbd95fdf2ffd3da02166af7e3
SHA512 258c65816d957071a9f55b31e908743cf5929f4cc32cfc9332b696ca2fe2ac9ea24149ce3d951e4103418b5eaed9b9f11aac3d6bf1afa22066b705f04dc354f3
SSDEEP 192:uzLsNe9Q4IkpCrZE2rQmiU1rqr4H/+jVx+Fd2YH8FEm95cFTc1qFU8:4sNe9bI8zuU0f+0d2YHRmIFckU8
TLSH
T1A73219316C68BC274DE2A645F04736539FF4512B9ED87FC4A6EC5B1C00DA7AC231A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2830b125137add20b0b36366c8218439072824867927cf5502a141d8ba1baf5c
MD5 fa62975223daefd636c678590257819c
SHA1 9464bf53660519645f91eef188cf71994875074d
SHA512 9629b61bd3f1b0195c35dd2eba5936fa7ce0e5ad7b629f3785dd0df0a4a77c173a5155707fbde5e8b1d075e29b8122d08eb69e588f23eb97bcb3719ece0de710
SSDEEP 192:uJGsNe8Q4IkpCrZE2/QmiU1rqr4H/+jVx+Fd2YH8FEm45cFTc1qFU8:bsNe8bI8ziU0f+0d2YHRmjFckU8
TLSH
T1524209316C68BC274DE3A545F04736539FF4512B9AD8BF84A6FC5B1C01DB7AC231A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae95363147c66d4858f5c4b52bdc43ef76b61f4cbc22d53baed931603e60dc5c
MD5 0e982c0636093c75b17fc9207aad621a
SHA1 5c0c7da306d2c6c07863e4e4b7e62da1bf12a7cf
SHA512 290e15c8b3371168d201bd721709e4626b092d796df397c443f32bddc080587bbc27e5e601abc33ef158bebacae1ea6cbffc43bdcea946a8f7664e2600d1a0a4
SSDEEP 192:EONY6hZ0QmiUyDXpc/+jVx+Fd2YHC5wOZccnU6:EONY6oUpu+0d2YH52cqU6
TLSH
T1A702D935AC687C778EF2AE05F48777235FE4116BA9A56F84DAE81B1C00D769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97672792fdb74694e331f80d99c6f4ff3009d909de4bc095e9a7ae6acf0ae2f2
MD5 ab8c6bd126c8ebf21304b5489eea6615
SHA1 3d145ec3b0988bd3062454d1dd9b0fb9f40727e6
SHA512 7a99a1e091b3a6a47333ffaec85cc12b588664c9b54b52be68b6e0bbc9e2edd631ad61ce31dfd73db01b948610423d942a80231d1e40693323959ae9d8b73180
SSDEEP 192:8ON/6hZlQmiUy8XUc/+jVx+Fd2YH8FEml5cOqc1qFU6:8ON/6f5Uu+0d2YHRmA9ckU6
TLSH
T1B012FB316868B8374DE2A941F48736134FE45127EED9BFC5D6EC2B1C01DB6AC231A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 57b8ff8a27b5335b7f5b7f5e0eb8d26a86f7395f537428278d09e7c4da39cc18
MD5 a639ea91b771abbd58c0892ced00fec3
SHA1 1fc78b486b0736b695f9b862caf8570021057d82
SHA512 2dd3c7846068d76cfc189d914843349be2fc16090989de361776bc29a5cd94200fba414bd765ae5a850c512322492920f1401b9fb3a22a11c80d9517486b9a60
SSDEEP 192:uJXsNeYXQ4IkpCrZE2SQmiU1rqr4H/+jVx+Fd2YH8FEm45cFTc1qFt4/tyAjn7k:SsNe6bI8zRU0f+0d2YHRmjFckivjY
TLSH
T120625B316C78AC274DE2E545F04736539FF4502B9ADCBF94A6EC9B2C01CE6AC2317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 65f5e7197371c49a8e94622faab5c00bc57993323312ba7cae47b693a7837f83
MD5 db676215b22d63f76d00cffae0ff19bb
SHA1 a5c301858053556f8b3a4a1a92ba9b6ce2ca399c
SHA512 0b820ea8e6168367ba1b3cdfb441f9fc3733b43c4cee9243cbc252f62c966168600ceeb1374a956c350d0fa4e3f643c6d2c7aa28c5306b45bdc1c3720f15dde9
SSDEEP 384:aiFPZcI0sNu8TUNTUlIl7bI8zRU0f+0d2YHRmgFckivjDoE:RFH0jwgtaUhtHckiXP
TLSH
T1F3A25C324CA8E87B9DF6DA45F54A32139FF44067D9D9EB90A6DC9B1C009A2EC1317C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3255ef4-85c1-4299-bf10-bf35816c25df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b3255ef4-85c1-4299-bf10-bf35816c25df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9fcc06bc68a3f432fc0cbc2340a1fc663fa269d0dc38467bc5d121f4c32004a8
MD5 b2d15c89458a2fe26a69dab42ef4b253
SHA1 8931fab8d3f6e5e88e25b671146f91729b09ee70
SHA512 69d8d2cd648b4fc10c84d8626cbe2076339940a1e7ed311adfe27db8f8d892661938f721256e9a2ca3f8b1bf9109afc9bcfecdeaeed21102a4522b0a0662bd39
TLSH
T13041285CAAE91148B3B76E5AAFF6696D487FBD732E46D49D00110D4F0623B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download