| URL: | go.go1go.sbs |
| Full analysis: | https://app.any.run/tasks/90f0fc8d-0ee0-4a67-b1df-272224577aa4 |
| Verdict: | Malicious activity |
| Analysis date: | January 30, 2026, 15:46:47 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 8384EEE70186A30A068829DEE3D9BAC6 |
| SHA1: | EBA4F7BE6377949D6DF338F657DF123649F607F5 |
| SHA256: | EE719929E7906D273B60C16B72D9C0BB81A49574647F8996F7238077698908E9 |
| SSDEEP: | 3:0hn:0h |
MALICIOUS
No malicious indicators.SUSPICIOUS
WebGL fingerprinting is present
- msedge.exe (PID: 8004)
Executable content was dropped or overwritten
- OperaGXSetup.exe (PID: 8684)
- setup.exe (PID: 5160)
- setup.exe (PID: 5216)
- setup.exe (PID: 4212)
- Opera_GX_assistant_126.0.5750.36_Setup.exe_sfx.exe (PID: 6996)
Application launched itself
- setup.exe (PID: 4212)
- assistant_installer.exe (PID: 6820)
Starts itself from another location
- setup.exe (PID: 4212)
Process drops legitimate windows executable
- Opera_GX_assistant_126.0.5750.36_Setup.exe_sfx.exe (PID: 6996)
INFO
Application launched itself
- msedge.exe (PID: 8004)
Executable content was dropped or overwritten
- msedge.exe (PID: 4292)
- msedge.exe (PID: 8004)
Page contains obfuscated JavaScript
- msedge.exe (PID: 8004)
Reads Environment values
- identity_helper.exe (PID: 4660)
Reads the computer name
- identity_helper.exe (PID: 4660)
- setup.exe (PID: 4212)
- assistant_installer.exe (PID: 6820)
Checks supported languages
- identity_helper.exe (PID: 4660)
- OperaGXSetup.exe (PID: 8684)
- setup.exe (PID: 5160)
- setup.exe (PID: 4212)
- Opera_GX_assistant_126.0.5750.36_Setup.exe_sfx.exe (PID: 6996)
- setup.exe (PID: 5216)
- assistant_installer.exe (PID: 748)
- assistant_installer.exe (PID: 6820)
Drops script file
- msedge.exe (PID: 8460)
Launching a file from the Downloads directory
- msedge.exe (PID: 8004)
The sample compiled with english language support
- OperaGXSetup.exe (PID: 8684)
- setup.exe (PID: 4212)
- setup.exe (PID: 5160)
- setup.exe (PID: 5216)
- Opera_GX_assistant_126.0.5750.36_Setup.exe_sfx.exe (PID: 6996)
Create files in a temporary directory
- OperaGXSetup.exe (PID: 8684)
- setup.exe (PID: 5160)
- setup.exe (PID: 5216)
- setup.exe (PID: 4212)
- Opera_GX_assistant_126.0.5750.36_Setup.exe_sfx.exe (PID: 6996)
Creates files or folders in the user directory
- setup.exe (PID: 5160)
- setup.exe (PID: 4212)
Reads the machine GUID from the registry
- setup.exe (PID: 4212)
Checks proxy server information
- setup.exe (PID: 4212)
- slui.exe (PID: 6400)
There is functionality for taking screenshot (YARA)
- setup.exe (PID: 4212)
- setup.exe (PID: 5160)
Reads security settings of Internet Explorer
- setup.exe (PID: 4212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
194
Monitored processes
44
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 508 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6048,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 748 | "C:\Users\admin\AppData\Local\Temp\.opera\e77f7d47-1322-4be4-8537-f8300427ffb6 Opera GX Installer Temp\opera_package_202601301047121\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=126.0.5750.36 --initial-client-data=0x264,0x268,0x26c,0xe4,0x270,0x456bc4,0x456bd0,0x456bdc | C:\Users\admin\AppData\Local\Temp\.opera\e77f7d47-1322-4be4-8537-f8300427ffb6 Opera GX Installer Temp\opera_package_202601301047121\assistant\assistant_installer.exe | assistant_installer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera GX Browser Assistant Installer Exit code: 0 Version: 126.0.5750.36 Modules
| |||||||||||||||
| 936 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5400,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2244 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4676,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2292 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2392 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7096,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3020 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7836,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 3584 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3976,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4212 | C:\Users\admin\AppData\Local\Temp\7zSCE1DA5BE\setup.exe --server-tracking-blob=OWQ4MTk3ZThhNWI4OWM1MTRlM2U0YTIzMTdmOTc2NjEwMGQwYjg3NmIwZmMwYmVmODY3YWZkYTVmYmZjYTRhMDp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX05MX1NWUl85NDgxX0REXzQ2MDEmdXRtX2lkPTI5MGQ3ZDU1ZjU5NDQzNTY5OTI4ZTJhNDM3NTFkNzMwIiwidGltZXN0YW1wIjoiMTc2OTc4ODAyMS4yMDU4IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzMy4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xMzMuMC4wLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fTkxfU1ZSXzk0ODFfRERfNDYwMSIsImlkIjoiMjkwZDdkNTVmNTk0NDM1Njk5MjhlMmE0Mzc1MWQ3MzAiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI3NDQ2YWRmNi1hMzRkLTRjMWEtYmZiZi1jNTAyNDQ1NGU3MmQifQ== | C:\Users\admin\AppData\Local\Temp\7zSCE1DA5BE\setup.exe | OperaGXSetup.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera GX Installer Version: 126.0.5750.88 Modules
| |||||||||||||||
| 4292 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2340,i,16855645748125376014,16663401079574631970,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
8 416
Read events
8 413
Write events
3
Delete events
0
Modification events
| (PID) Process: | (4212) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4212) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4212) setup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
17
Suspicious files
45
Text files
299
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e4ef8.TMP | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e4f08.TMP | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1e4f08.TMP | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1e4f27.TMP | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e4f27.TMP | — | |
MD5:— | SHA256:— | |||
| 8004 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
105
TCP/UDP connections
87
DNS requests
84
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4292 | msedge.exe | GET | 302 | 188.114.97.3:443 | https://asvof1.site/click.php?key=8dnyknk5j5cxzix2txuc&sid=M7601181640999567412&cost=0&pid=5684-e6c6d885&pub=5684&campaign_id=424211&app_name=unknown | US | — | — | unknown |
4292 | msedge.exe | GET | 307 | 99.84.91.112:443 | https://my.toruftuiov.com/7f0b2a01-cae9-4429-83d2-21b908f96729?zone=9700482-3288116759-0&ban=24030388&ssp=&campaign=456512220&advertiser=158134&country=NL&org=Clouvider&platform=Windows%2010&ip=45.128.199.218&device_make=Unknown&redirection_cost=&clickid=176978801610000TNLTV47634144904Vce96d | US | — | — | unknown |
4292 | msedge.exe | GET | 302 | 99.84.91.112:443 | https://my.toruftuiov.com/7f0b2a01-cae9-4429-83d2-21b908f96729/2?zone=9700482-3288116759-0&ban=24030388&ssp=&campaign=456512220&advertiser=158134&country=NL&org=Clouvider&platform=Windows%2010&ip=45.128.199.218&device_make=Unknown&redirection_cost=&clickid=176978801610000TNLTV47634144904Vce96d | US | — | — | unknown |
— | — | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | US | binary | 313 b | whitelisted |
4292 | msedge.exe | GET | 200 | 150.171.28.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:CI9huRp2862oVMFCm4y_vQz8nXsaU7tjCa3CsN3OVow&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | US | text | 101 b | whitelisted |
4292 | msedge.exe | GET | 200 | 104.18.23.222:443 | https://copilot.microsoft.com/c/api/user/eligibility | US | text | 25 b | whitelisted |
4292 | msedge.exe | GET | 200 | 150.171.27.11:443 | https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 | US | text | 446 b | whitelisted |
4292 | msedge.exe | GET | 200 | 108.178.23.118:443 | https://go.1bots.top/?utm_medium=cf3e5ce1c15292f05df1c6214ac87e51fa0009cf&utm_campaign=Smartlink-hui&1=hui | US | binary | 10.4 Kb | unknown |
4292 | msedge.exe | GET | 200 | 92.123.104.59:443 | https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json | NL | text | 128 Kb | whitelisted |
4292 | msedge.exe | GET | 304 | 150.171.28.11:443 | https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
8124 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
9088 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6768 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5568 | SearchApp.exe | 92.123.104.58:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
5568 | SearchApp.exe | 92.123.104.61:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
— | — | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
4292 | msedge.exe | 150.171.27.11:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
4292 | msedge.exe | 150.171.22.17:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
th.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
go.go1go.sbs |
| unknown |
api.edgeoffer.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4292 | msedge.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
4292 | msedge.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
4292 | msedge.exe | Potentially Bad Traffic | ET INFO PE EXE or DLL Windows file download HTTP |
4292 | msedge.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
Process | Message |
|---|---|
setup.exe | RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable directory exists )
|
assistant_installer.exe | RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable directory exists )
|
assistant_installer.exe | [0130/104726.090:INFO:opera\desktop\windows\assistant\installer\assistant_installer_main.cc:170] Running assistant installer with command line "C:\Users\admin\AppData\Local\Temp\.opera\e77f7d47-1322-4be4-8537-f8300427ffb6 Opera GX Installer Temp\opera_package_202601301047121\assistant\assistant_installer.exe" --version
|