hxxps://gofile[.]io/d/PCvAfOUI

Analysis

user interaction
yes
max time kernel
7s
max time network
46s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/09/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/PCvAfOUI
Sample260912-pbc5wsbd26

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	api.gofile.io
26	api.gofile.io
66	discord.com
67	discord.com
69	discord.com
19	api.gofile.io
20	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{F4444460-D43C-4438-A47C-2C50CC975C86}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1364	4664	msedge.exe	80
PID 4664 wrote to memory of 4960	4664	msedge.exe	81
PID 4664 wrote to memory of 4728	4664	msedge.exe	82
PID 4664 wrote to memory of 4728	4664	msedge.exe	82
PID 4664 wrote to memory of 4728	4664	msedge.exe	82
PID 4664 wrote to memory of 4912	4664	msedge.exe	83
PID 4664 wrote to memory of 4912	4664	msedge.exe	83
PID 4664 wrote to memory of 1332	4664	msedge.exe	85
PID 4664 wrote to memory of 1372	4664	msedge.exe	86
PID 4664 wrote to memory of 1332	4664	msedge.exe	85
PID 4664 wrote to memory of 1332	4664	msedge.exe	85
PID 4664 wrote to memory of 1372	4664	msedge.exe	86
PID 4664 wrote to memory of 1372	4664	msedge.exe	86
PID 4664 wrote to memory of 3608	4664	msedge.exe	89
PID 4664 wrote to memory of 3608	4664	msedge.exe	89
PID 4664 wrote to memory of 3608	4664	msedge.exe	89
PID 4664 wrote to memory of 688	4664	msedge.exe	90
PID 4664 wrote to memory of 5864	4664	msedge.exe	91
PID 4664 wrote to memory of 688	4664	msedge.exe	90
PID 4664 wrote to memory of 5864	4664	msedge.exe	91
PID 4664 wrote to memory of 3252	4664	msedge.exe	93
PID 4664 wrote to memory of 1588	4664	msedge.exe	94
PID 4664 wrote to memory of 3032	4664	msedge.exe	95
PID 4664 wrote to memory of 1588	4664	msedge.exe	94
PID 4664 wrote to memory of 3032	4664	msedge.exe	95
PID 4664 wrote to memory of 3032	4664	msedge.exe	95
PID 4664 wrote to memory of 1728	4664	msedge.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/PCvAfOUI
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe0f6ac188,0x7ffe0f6ac194,0x7ffe0f6ac1a0
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,8001229225677247427,13738032379951692890,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6004656921159191009,1118735847207167100,262144 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,10060465389998099443,10767205151543768020,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14227788221591006387,2134462624394091886,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11310911727202206115,5468847067147276623,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4976,i,1904480415404112249,7035031478033820062,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3584684293210979060,16834746467123706430,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6028372862680827405,9227428422486508266,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13861487419477785676,8248231611240225538,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13861487419477785676,8248231611240225538,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,11482206335073805882,15011881643200217261,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,5685283224617636052,2493425185360382084,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,14032158954758822240,12257677618308776171,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5032,i,17670638021700604443,2631788370989180660,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6920,i,14253533923905454629,12647537882756581680,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6940,i,1761058636016199628,6938711534592771543,2097152 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,11983952100309641084,17051852604116815080,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,5438252546436786061,18152778354398967872,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,6691061605643519305,15856929217072321661,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,2407666194249332328,9233234596003704148,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,6719095965608313730,6037034971532249827,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,18319761713611338738,17544882836060426359,524288 --field-trial-handle=2396,i,3795792950381291858,5634705979992202712,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4040

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Free-Ass\" -spe -an -ai#7zMap16481:78:7zEvent28597
1⤵
PID:4720

C:\Users\Admin\Downloads\Free-Ass\Free-Ass.exe
"C:\Users\Admin\Downloads\Free-Ass\Free-Ass.exe"
1⤵
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/yusei
  2⤵
  PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/yusei
    3⤵
    PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a90bea09e212134dc17388b25f224d71e49ca39dcc69bc19702622e77398e31
MD5 1b78c171c4c68630e5b7ebb32c84e785
SHA1 91cf5dd71c41350998b7d2281087fdcfdebe69c1
SHA512 ea0518551e5ebe409c443be54112086677308fdab24beab120e4553deb487efb00bf47a7a850d5952ae98f894136b4b665897af533998d21b0bdebe2ab6f9313
TLSH
T130D0244CF5FCD054D413103FC3304F4033C5C5545103F001C04433550C477030754050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5edd90b1baeb2e089f20776064e97b90615f17d249e44b7a9c0602ff76486d0a
MD5 9d29809c2652c8f7dfc1714b2ac1a04f
SHA1 28fb378c24d9aac9ca93b7f2fca1fbc0a530d7cb
SHA512 c345ef3a531aa93d7824ddea36d18622a1570ee297cad7b5d96e1ae939f7d3707f43de0eb45199d3a54bf405be219fdbc9945a0fd027f574d395ff53007aeedb
TLSH
T124D02B48F9F88054D402103F82604B4033C581545103B001808422650C867020A54050
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 43480bae4c6dd622536f23d3915937806e0aeb88d68e7d69bde949352782ca8a
MD5 cc0b7d7053e6f3bf053cddb957e8957b
SHA1 cb0d7f978edb7ea97465abe7d47ea933c99c4fb3
SHA512 7fb7e547b93787a28156ebf4a6ea759cb5a0d4cfe4d408fc3cf01d39b45557724891853246842f19e7d113205f39c679ce47cbb2865d39190e04e52e02810fc2
TLSH
T107E02BF9DC21EC2B08F80B5854948A45E74113572781854F3B3D420E8FB5A3B4696C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 1.8MB
SHA256 1d89ebeca771dd28ec297dfc7072bc91cdfc4f085e3a38a02da1663d8e4fc728
MD5 7880e27dbf66707260d56610dc8f8662
SHA1 d673e4376ce55d7fc7ef636becaee3cbd4e101fd
SHA512 3ec4bae3c4cbb1d2b846f96778d2ed0bfd7c6055055fc66d4fb72a3b79cbd7ba13875eab53c16a3db72a0fc8a052cb472a8fd4dda048db76d2fdf0500f4b2984
SSDEEP 49152:lP/ul+76oAv2kcVZdMrD1vks+yjbFhNRFum:lP/m2TwVMyjbFhbwm
TLSH
T1A98533DB80F5189728552678E2CE481F18B86721EE7BF8CD2E06BDB577BD662BDC0404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c9d40c365be20c753c0a9545dac0d006086142facc8ee967f1aa9fc1cf9a6b27
MD5 6176f2eed26638091f49cef2f09c3387
SHA1 4eaebdb84833c586312c76f2c64bb42cb5de40de
SHA512 48f5b1926c8bba83bd319de54e976585fb6da0ff540872008def71d01e0c37af3657ee43b7db9a4b58a476532add3f3604320acb3e57a47941712ddf10454233
SSDEEP 192:sxZXR29k/fQs6we1sVzodpRlFHW6+WNeqx/YMosLVvIgjtlJ:sxZXGk/fQs5ePRHbB/ntjtP
TLSH
T1C742C7556D28A93F8CD7D209BB15BF93E7F95033A1911F48A6FC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7d1b5dcb49680e294d80daed458d514d3f94f855042fe386914af89cabeaef98
MD5 9217895182cee47cb799687b981fb073
SHA1 1693099e4ed9d69389b232984a5edda771f2f12e
SHA512 f4e103f707c874293f86c8f0d5d6710176997cda1bea8407e433889f62e329dd3f0768c69d9c1e95dfadeb9ae4edfbb4ac5038515ff5eeceee66704917464e99
SSDEEP 768:HaaazDVWvZTyo8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdLLlCQcmMroWP8:HaaazDVWvZTyou1jasLLwVmXWP8
TLSH
T145C2E93B244CCA7E4FC01A9DDD5A6FDB2E9802C7A6588D4087FE984C02D77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 23a96c1254dd28fe566d8773096651390b355d188f93c93809c133362fab9a7a
MD5 30abf3e0726f6d79c1970bbd880faa0e
SHA1 db6da581d60a0af21100373597afea48e31f3c0c
SHA512 2d9fa5157e9ffcb7874d994f88c984c66e19488e8fcfc641267185424cb6c1a382d021cdeb7d801827cd1ae528e133eac6b0236f5e8845466950d9e8fc9142e8
TLSH
T18CD0A76BF9650551EB674B434A3220AEC7A52CC458C2D48CD41320BE54B0B97E222E97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 cd01dc5199232b49f6937565e17824e0f84975f2fa925aa8e4c93c1ae5108701
MD5 9bff4c26b6561e1a7675264f006a46b1
SHA1 b41f4c98fa10fb40a39630fdd30b4b745a5f03ed
SHA512 a57c54f95f6152c0e64ecd35f70866c1c72d5a25f862df23c7d3129ed1040c23ebf09a7f2f416475bce26c4165cd547e31bc8e4f3f9a4c0821ea7e56ce2d1511
TLSH
T1B8D0A76BA5684551EA778F420A32247EC3553CC458C6D48CD41300BE5890B97E112E97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590db2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe590db2.TMP
Size 138B
SHA256 c13f6e1c67dc7bafa03b5893714b7ac564f9d5e74de104e2693f40b527676ec3
MD5 8ed8058fed0f2622e2a2008b9f640cce
SHA1 b14c3c9433d72167edc081f62446421965df8c0d
SHA512 ef9b5b70f76c03eea74ca62eb639f86fa4e2b2c1343a1d456453b374fb40c23b16f502503937129001f36d4e14a32a1c986a490fe92d575e51720ab8c20411fe
TLSH
T1DFC08CB7A14801009A1206420632211E43042CC81CC2908CA56330A510B0B373202ED6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 63f5c5fc84abbfab05ed656f2435212db73786f74c8ffec38c2aad1ef236559c
MD5 5d636719047b0f321b84da99605f2ee8
SHA1 e885b7f7410c26ab9ae932c4e166293b63bb24f5
SHA512 1d529698339f22adafd5b62b3b94221a75372d07152cd147940e1155461a955866690a0a8765bddd6fc75163f464175220b0075f206334e3d7dd69f5919cd951
SSDEEP 384:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9WeDdERN/rviDuRlJ1lnKVl+HYHUFDTkdK:q5/FO5XfrQnWaAqOrm1KSoGlUB4Q9We6
TLSH
T1D4B2F41170BF0240787E2D1D81B5972EDA4272A33168EA7B7FBC10A68E66E045DFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ea7e137c898e6e985155fd85a6b4deacefee0a139067d8adf11436ea974122af
MD5 360b0be1c4b0df77ac55a620c2c5cf1b
SHA1 2e5910080af05123b125ea97033df42c9e8fd7ca
SHA512 a7b11f4816f16b0568cbed50d5d1c0a790893b33d26a9c6c46bc680aed83c2a0f515c81327a6e73bea16c4f301bfc922783a10cf09aad57269db9c09ec19fa15
SSDEEP 384:nCiFiZcIZ3sNO8TUNTUlI4k4tDE3aYH2tBfFBdjbVJsURufXaYsa+VYGd7UPgL/Z:JFQZ3fwgyQfuBxTxRUXaYhg1Wm
TLSH
T16EC23A72ECA4DDABECE64BD5E74A7A03DEF05163958C5AC4C6D95D0D009B19D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce1ae9e334a8ec4e340abcd971a1daeb14f5cb48748d03d249ce11f52869fc80
MD5 0a48a2ca50abf8fff3b2efd3cd253be8
SHA1 e5b0ddcb6aeee28de70dfc520ddc8b791398360f
SHA512 410f7537cf8b8fce0c090b09290ac67d3eb60f54f9bf310d695d14520398dbba94afa686622d7f809c48df1a9ebb3900061aefae5eeff2e928a6a427d870afda
SSDEEP 384:nCiF6ZcIg3sNO8TUNTUlI4A4tDE3agO32tBfFBdjbVJsURufXXYsa+VYGd7UPgLB:JF4g3fwgWQw3uBxTxRUXXYhg1Wm
TLSH
T1BBC23A72ECA4DDBBECE64BD5E74A7A03DEF05163958C9AC4C6D95D0D009B19E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ee44eacb53928e020bb9ca7de5a916f66d976cf58dd0f1b55150063c8ed1b8b3
MD5 5e402afa171969714a9d272e89b6f79d
SHA1 4bf8ae031ffc7f7853932272b47f62f2906e9f30
SHA512 4d8ee151f970f43d9dae4093c9e70a85ac5f76e0399d4f494f34abd93cce218bfa6a0ff6645f0b6718f90edf23cf042da149be760fe35fec1bd7d9ae98eb9fe8
SSDEEP 384:n8iFiZcI63sNY8TUNTUlImkfE3a+S3tBfFBdjbVJsBa7O6R2FeokqgL/7IzvoD:nFQ639wguqlBxTia7TRc0
TLSH
T1ECC24B72ECA4DAABEDFB8FD9A74A7A13EEF01163959C4AC0D9D81D1D108359D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d6a3571b6e056482e8f9637066e81c9ef1e6459a813d35f48e9e167f0b56465
MD5 bb2ea7816ae8d7f7c8b90403d795b1a4
SHA1 5477ec2ad9f64ea65e2bf520c344d08b9efacd14
SHA512 fd5ec4fdfd71ad89ed4e79c1384fdff298f462fb0822eb3bc679a77038183f569f814eec4004ef2e03020b966ffd21b9133744be1a7cfe7f34b2779ae7bbbdba
SSDEEP 384:nCiFbZcId3sNO8TUNTUlI4A4tDE3aAH2tBfFBdjbVJsURufXaYsa+VYGd7UPgL/Z:JFDd3fwgWQFuBxTxRUXaYhg1Wm
TLSH
T186C23A72ECA4DDBBECEA4BD5E74A7A03DEF05163958C5AC4C6D95D0D009B19E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d9bee5e119ea878a2e65d5366584a4dabecee3bff88044deefcbca257274d24e
MD5 1f33c9abd0afc6e162e2b3b7d2b2e040
SHA1 b062a44ef39bad3443f01b3626e0b8108d1915ed
SHA512 d9f0caeea40b6c4e57a5812aab28de3e1a30ba18a6c259d0c22a9e82da9168f849d9056da01d451f712ab5da4a2bfebfd358722af5530403d05a3370c73dfbeb
TLSH
T195415B5CBAE91148B3B36F5A9FF7A86E847BBC771E06D09D10110E4F0A22B40D9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Free-Ass.exe

Path C:\Users\Admin\Downloads\Free-Ass\Free-Ass.exe
Size 4.9MB
SHA256 b7f2ab5e19939551473fb3a0ce4a58e2c5920c3670a6a2896d44b547fa1ae4f9
MD5 175dec94d31d27d55c5aeb6174884b86
SHA1 7d463cde8f7262eecee86e91ee4fb788aa578f4e
SHA512 6cb404380fb51813986d74ae25c263f811cb5a190b4d46826661f553707839e4694a6e7eddcb98bff0e0727f8e9b0085c0ed1e5b763225778453e9158629e7b8
SSDEEP 49152:mv26ptxcvMjPAz+3qh34t1i1Vl3VCQWN1OnNdkQO8PTdl+FViiMzQRldUykU/S7d:uFV7QNdW87dkMzQ/dBo1Sr
TLSH
T12736BE06B2658168C067E13DCE83EA67E672BC011F6197DB3285BB5F2F737D04A7A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads