hxxps://gofile[.]io/d/7VIJ8Nns

Analysis

user interaction
yes
max time kernel
57s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/7VIJ8Nns
Sample260909-rwce7sfp21

Score

8^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	2368	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
5924	Gamehook (2).exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	api.gofile.io
32	api.gofile.io
36	api.gofile.io
27	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5324	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334379401193487"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{097E1C0F-9235-4AFE-BF22-2DA824C692C0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5924	Gamehook (2).exe
5924	Gamehook (2).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5924	Gamehook (2).exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4924	4336	msedge.exe	85
PID 4336 wrote to memory of 2368	4336	msedge.exe	86
PID 4336 wrote to memory of 3556	4336	msedge.exe	87
PID 4336 wrote to memory of 3556	4336	msedge.exe	87
PID 4336 wrote to memory of 3556	4336	msedge.exe	87
PID 4336 wrote to memory of 1672	4336	msedge.exe	88
PID 4336 wrote to memory of 1672	4336	msedge.exe	88
PID 4336 wrote to memory of 3692	4336	msedge.exe	90
PID 4336 wrote to memory of 4948	4336	msedge.exe	91
PID 4336 wrote to memory of 3692	4336	msedge.exe	90
PID 4336 wrote to memory of 3692	4336	msedge.exe	90
PID 4336 wrote to memory of 4948	4336	msedge.exe	91
PID 4336 wrote to memory of 4948	4336	msedge.exe	91
PID 4336 wrote to memory of 2924	4336	msedge.exe	92
PID 4336 wrote to memory of 1420	4336	msedge.exe	93
PID 4336 wrote to memory of 2924	4336	msedge.exe	92
PID 4336 wrote to memory of 2924	4336	msedge.exe	92
PID 4336 wrote to memory of 1420	4336	msedge.exe	93
PID 4336 wrote to memory of 1420	4336	msedge.exe	93
PID 4336 wrote to memory of 3280	4336	msedge.exe	97
PID 4336 wrote to memory of 3280	4336	msedge.exe	97
PID 4336 wrote to memory of 3280	4336	msedge.exe	97
PID 4336 wrote to memory of 3844	4336	msedge.exe	98
PID 4336 wrote to memory of 3844	4336	msedge.exe	98
PID 4336 wrote to memory of 2868	4336	msedge.exe	99
PID 4336 wrote to memory of 2868	4336	msedge.exe	99
PID 4336 wrote to memory of 4208	4336	msedge.exe	101
PID 4336 wrote to memory of 1612	4336	msedge.exe	102
PID 4336 wrote to memory of 1424	4336	msedge.exe	103
PID 4336 wrote to memory of 1612	4336	msedge.exe	102
PID 4336 wrote to memory of 1424	4336	msedge.exe	103
PID 4336 wrote to memory of 1424	4336	msedge.exe	103
PID 4336 wrote to memory of 3792	4336	msedge.exe	104
PID 4336 wrote to memory of 5716	4336	msedge.exe	123
PID 4336 wrote to memory of 5724	4336	msedge.exe	124
PID 4336 wrote to memory of 5732	4336	msedge.exe	125
PID 4336 wrote to memory of 5924	4336	msedge.exe	127
PID 5924 wrote to memory of 5324	5924	Gamehook (2).exe	130
PID 5324 wrote to memory of 4512	5324	cmd.exe	131
PID 5324 wrote to memory of 2292	5324	cmd.exe	132
PID 5324 wrote to memory of 1036	5324	cmd.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/7VIJ8Nns
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffcee24c188,0x7ffcee24c194,0x7ffcee24c1a0
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,8806292278353951213,9269851766138870937,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,620976990523521867,1027222159612322514,262144 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,5960208541882603384,17860069575316416785,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9535411775497365137,6651640309299140214,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,6101834135276884926,8210794788394503674,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,7219106340425418736,17168958015990937156,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8176530042236388734,7665386679352467520,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5136,i,9444116394332569915,5062308266112477624,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2353171272484452365,4902051615229375147,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12795706317935358272,5028575939632118715,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8537812907948892429,7147316049504013116,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8537812907948892429,7147316049504013116,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,14495025840208365291,14877731771720535559,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6336,i,11147227923193447845,9353886463621544802,2097152 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,1628746743671268377,3483882625325490951,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,9927750959722216534,3288355663894829667,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,7317734551711021401,17629149336663236613,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,1329487707061838987,12518272503904754409,524288 --field-trial-handle=2320,i,16982966781669964882,16487785478776938210,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:5732
- C:\Users\Admin\Downloads\Gamehook (2).exe
  "C:\Users\Admin\Downloads\Gamehook (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\Gamehook (2).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5324
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\Downloads\Gamehook (2).exe" MD5
      4⤵
      PID:4512
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:2292
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f123cb24103d11a4a35bdd993632425e8e0ebf3b3ee692f638daaa626f2e68bf
MD5 cdcf669eaf253b8037a5e4c19736f80c
SHA1 50167b126afae844df013bab4b744d039699bc91
SHA512 0ff81850bb77506722e324ab4fa8f8e3dcda3c08b141774183c0ba7ff03ba2659be7404e49be64609ff2af87c32f27a84da00aecb07abe38f70c518c1834ad76
SSDEEP 96:3OLrRNC7T3VhYgKafiGmKCiFC3fiA0bSBS:3OIhNJPFC3fiAsS4
TLSH
T1C9A15036E48882F5DB15523852E34B7678F7D8DCF40B3EFA2197A8B537147222325187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b4f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4f3.TMP
Size 3KB
SHA256 0d089d81123e1222d0913cba79bd7933dc47de2d996cc434b0bc581ebb7b3c58
MD5 aaf7ed4b9c2d8d7a2e40530b9276d52b
SHA1 be2e5e71b5050b734e0c99e70130fc8d4bee63ac
SHA512 10acbb4edaa3e08112289fabaca9e00051de7f6eb5fc5abea9b966514f2b2a7f8921f22f519d8a85b17cf297e0f33cb48302c4d3ff93b0183e10184eee134034
TLSH
T1A8712936E90081F4EF15523190E3177578F3D0DCF8072EF212A729F56B28736636A28A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da9866e13d382fb994d73938c60d17919729ef9ce47d187f5b14a9781c2a6e6c
MD5 9c647eb4d20ff3fcc4f0dcd932607822
SHA1 32cdc3ba18dddee7933b7560585b7704fb436866
SHA512 9b03a58b1099a80fcb30efaab26972b3fe2b387e94a4f961f28011ed8a5ccb15698a79a0275e5c34f6e003d12a76615454dd3a48a46f8a1e18c5daad0afa75d4
SSDEEP 192:sxZkReyM/jK1Ml8MnE/fesogIdpjlsYHW6+WNegg/YCMWrKEIgrJ:sxZkQvE/fesohpHbu/DF9
TLSH
T12E42E9116A349977CCCBD20DFA51BF93D6F94572A6940E549AFC8A1C04E7AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e784e2bbe3c30203bdea217423c68572fb988935ef36a8a552f371086047e234
MD5 4b1b208097865accd063cd70d50f79ac
SHA1 9b754398b02d7edda866acf0e3f8e6f6aeea6c46
SHA512 a69e2bd0ed32849d0668ae9d8e24faad6c04f3ad900b7c89ee585e86fbe120d10fcf788d2329ca1e75463c4708e6bbf410392584c90f998de2f84db8f8c5ed9e
SSDEEP 768:vo8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVIroV0:vo8bqn+WvSCt6u1jaCZLbWVzV0
TLSH
T150D20A3B280CCB7E4F845E5DEC266F966DD801CB67988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f3be514658841b5fcd09ab8c04c2bec9bb4f420c11837b6b068418f28902221e
MD5 903ca5e954e6abaebea57747752e0be3
SHA1 0d066e63abeba96fde0bad1569c1a6f26d4524a1
SHA512 3b9a8308fb81913ba88ff49975933e7a67dc2cba4fd3f89869b5a9e95e0f13fbd096b6f840cc565d13ba9358b51e8e0ff6172e94ddf58063d11aa764f6a29661
SSDEEP 48:KM8IHKlucvyVXIxKkIObI5KEwkvy95IpKicf:KM8QKlu2OXiKkIObeKEw+256Kicf
TLSH
T165A18465713A4381383DEA5C9275862F0E4136A33508EA6F3FB811620FABE525CFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 3ac0a5f94331e69f59fbf572a0d2ad5a336ee2def0156c1747d2c45299cb09db
MD5 52dd1920ba9feec320a97f1f0add3121
SHA1 90ddcd46ce3516ea0dcc85ee1cb12f248e8fc4ad
SHA512 6dbbb21f5e39e73c8273e897127ca9cafae2ee83cc828d5b086816571752a326445a0072374410c410533d0b099f6a0dab8195ce36c768a9f448845a2c7f565c
TLSH
T1B62153C1A3AE50E67E89EA85C22D950764B13F172B0EDA71372D54F45F84C1A0E3F929
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 357d487ca01e102d1a1e19094274279e4a5e502d043d3fcb168400a7917a1d53
MD5 b31c7fc0f06e8179e52837b1eabb9d5d
SHA1 e5b888d1e510309d3fdb46fa300718b8bdc13bf8
SHA512 e602bd2d483872b6cc52811b0f6f551c198bad392352c349a54f009ebf9439e4624722718f2d320e1b5a608cb8bd894973a4f7275fb3a48e0abb260cf24946e4
SSDEEP 384:sZcIhsN2+fNjGhEa+mO7+JHhX7O6R2FeoHh7U7o+:6hZKanO7oBX7TR2OZ
TLSH
T1C1827C326C785C366DF6E245F94B36179FF88063DA896A90D5DCAF1D04DAA9C130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c5b82784eb809b4607a704545334098f1464f94d5d9762966673b46513f85a1
MD5 43fd8db2d5a3dff4c7be65b10a97904b
SHA1 6363a2c031d2913d568de10f4cebf9c6710833d1
SHA512 bb9ede3bf7ea6376f2e061bed14893d85bc852f021ca8d22f13a043e3dba5b2da4e1f476ee61d11e376a06c8f4b88ed77ba03e0164ac1df469362a9faddd70c9
SSDEEP 384:rZcI5sN2VfNBGhEa+mO7+JHhX7O6R2FeoHh7U7o+:z5iKanO7oBX7TR2OZ
TLSH
T12F827C326C385D3768E6E245F94B36179FF880639A896A90D5DCAF1D04DAA9C130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb161518a745758f04f82a2a452d87fac89d78836b7f83c051314e908f7f7c96
MD5 36421d426dd8ad0315edf063bd114676
SHA1 804f82c06e6e5f5b4923b2cef0ef053560e5ee84
SHA512 e23506cef171782c7f0cf084419d463dbd13801d703f1215c4e657387c26e340f750fa91f4dc6b0bdc6006aea7c3048d409b140156aca4c127cfd13bf9d1fc87
SSDEEP 192:vON56Db6QmiUyw/HBa+jyOmM+HRgmaH1U6:vON56uxHBa+mO7+GP1U6
TLSH
T1DF02D835693C6C7B9EA26E49F88B37279F94203BD9562B94D6D81F0C00D765C234B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 257d2cf85632abae699758a9aa2102a89effd3c87388c30fc072dcaf3f316538
MD5 77c0584a59dbcf1919b32b2bcf50ec2c
SHA1 06ec6faae2465fefa51634d40a7053b9688d855d
SHA512 122ec293c56d5b82b92ec97381be7ef5faf406fba8149ba21f39f1d4f51408e265f4b474d1679c2a6e0be19d5a6df460b1965341184bf37a7d567b5dd396c1ae
SSDEEP 192:rON36DboQmiUy6/TBa+jyOmM+JEQFahPNzjqcNU6:rON36whTBa+mO7+JHiXU6
TLSH
T132121836682C5C776DE26984F88736679FA85127EA4A7B90D6DC1F0C00DF65C130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58d8ad5a-3222-4185-955a-ad9640916e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\58d8ad5a-3222-4185-955a-ad9640916e50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a81a0ad4e46c9ec0abd79be6ecdd729a84cb8a238b38aa9322d2c18d3e109c5
MD5 2e28b5ff8209234052566ca3e4c6cde3
SHA1 f0b09d1c457ab741be67accdc817b5c24aee3183
SHA512 f9dcf427515a8308c94b81ac9b4ba9554c758af9eb3ba86f9d461d67f6f23653726a258da68346db79ddf9c4bd29bda4797a8d4307e5c84e554abecffd62230c
TLSH
T143412648B6E51148F3B7BE5A9BF6A86D887EB8372E07849D00010D4E0A23B41C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

Gamehook (2).exe.crdownload

Path C:\Users\Admin\Downloads\Gamehook (2).exe.crdownload
Size 24.0MB
SHA256 934f3335106622e3c9b9eabc54670ecd84b4b1e935e70aba6dbbd265dbb996f4
MD5 d3da31a06f06e457d2dea05eac3d5beb
SHA1 471683e637251a816b25b9207bf9e11eff44f5ab
SHA512 0930b6cafa9b87aa32e582d239053d93eb5e012e38f0eefcdfeeb02c3d7d5a0839980413b528d566bea6f27290bd1898acd507e3c78ca1921d4c5742938e7328
SSDEEP 393216:oPI4ffr8amLeMEDSHBF1vzEqT2+1JFn+0vQIqRBL6UfjlHMGqUZMFxC:eIEwamLeMHvzXT2Y1NVQL6uhHMgZMFxC
TLSH
T162472392A9DA62F4D3EB8F0092C6214DA393B2F96B5A560D15C45C032A12FD78F4DF37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5924-284-0x00007FFD0A1D0000-0x00007FFD0A1D2000-memory.dmp

Download

memory/5924-285-0x00007FF7681C0000-0x00007FF76AB0A000-memory.dmp

Download