Analysis
- user interaction
yes - max time kernel
899s - max time network
883s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 12:45
General
- Target https://eden-emu.dev/download
- Sample260420-py79jsax4q
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 53 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 8 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eden-emu.dev/download1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff939d2c188,0x7ff939d2c194,0x7ff939d2c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,14643575371283683021,6185287733033132069,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,15845711277340465879,3886337903958912148,262144 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,6177280151831989085,15179106045408371121,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,16436225064879204953,12436045752222537578,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,12516251154743782997,8172281950844746557,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,11577725290553688751,200859042959299038,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,11000205419981784010,5884452202551926734,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,2036173211172559097,14976280030708254131,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,2303127317511901416,9183486382257808134,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,3830002187157927592,3540429604088681116,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,4550666050326029215,957644464794455837,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7624457160532659835,10141956647785369618,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5584658389345567546,6705677198809055905,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5584658389345567546,6705677198809055905,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5059059325315351046,11739818401424030793,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,7325698716148881039,11793312881622172540,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,13849187613867419834,3637934613889457331,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14850057247504859158,14640286178384988117,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,13789824421411021277,18239392346647631703,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,9337916928058170829,11569862011615782671,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,17354163874215055335,10461010009433555743,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3109146375793155959,3793889196561363700,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,18187270908057454006,15027301264799645387,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,11174480508365437316,5348452895671299460,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,4934363289586907130,13184070940411035455,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6772,i,8183868961793119085,9639136633916582734,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,12329217180542036481,7401332142146134071,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6632050284020325256,10416795474557071328,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,4530369835162736710,11917141222967424714,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,11776362897203897414,10950419131614720170,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,10746074765066637421,17060931968943161314,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,12403508760695229408,5957050434933927547,262144 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4944,i,9386508166251686944,2493899763574147517,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6624611383797254766,6198945425546977251,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=1572 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,4335296101267736185,5171891129075790028,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,12475038217903059139,6825360112049353341,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2716,i,8706672592438647161,3068035236310048075,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4911390172952361366,1692516052775889089,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,17671973607446888185,1054038921723824873,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,10761271229137767099,14533128388822209295,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,1178082743675837767,7245710506095229493,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5408,i,13784680006770474057,10137996111340456067,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3803817767851046443,4133500727483159522,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4196,i,457827576915683292,8821652538119854738,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,18114370359017020366,5035405777990614183,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4448,i,15822454020793629474,17954109325346581014,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7468,i,445650465625594719,15408788970645673184,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5380,i,38030775926910602,12254360475249353075,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7692,i,11811755538490631939,8222641130203605080,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,9860951810817274039,1374968667393368279,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,15269609126577297322,17770412823454950986,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8172,i,14171452973160825689,5474325179610832716,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,7516294770373721453,10075340156133106926,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=6044,i,15865405383612792893,2623442935556072967,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7612,i,11891547810449434019,2968438221543422217,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5348,i,10934723215769072275,253022548921251902,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7508,i,6460499909148299601,11167400675151054985,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=4972,i,14331649202160560762,9977599563160137507,2097152 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,1761216934370266012,6155177201514497865,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8260,i,6933957465317210756,2920290181625994537,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18045052452305522615,6035692119766414517,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,8194044096093280610,342323701112996047,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8072,i,11919587825926852353,16544714785730669858,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,14881751054893074472,14261947402990381597,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11756270476482903606,7995876872977937156,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,9811601754663994164,954095923960986852,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8216,i,6763234354387682868,1387658857627452332,524288 --field-trial-handle=2200,i,11575072796753827895,1249993190915024091,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe"C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exeC:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe2⤵
-
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\Winword.exe"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\README.md"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"1⤵
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden-cli.exe"1⤵
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe"C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exeC:\Users\Admin\Downloads\Eden-Windows-v0.2.0-rc2-amd64-msvc-standard\eden.exe2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\root\Office16\Winword.exe"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_eden-v0.2.0-rc2.zip\eden\README.md"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000ce
f_0000d0
the-real-index
the-real-index
the-real-index
the-real-index~RFe58911f.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5cb28e.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5ca688.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5cc665.TMP
the-real-index
the-real-index~RFe5ca909.TMP
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe5cc1d1.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
the-real-index
the-real-index~RFe5def64.TMP
index.txt
index.txt
index.txt
index.txt~RFe5d9e46.TMP
domain_actions.dll
data.txt
c9354dab-d66e-45e6-8291-178010016219.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5c62b9.TMP
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
well_known_domains.dll
nav_config.json
2513dd0a-ad49-438d-954e-f96b4eaad2f4.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
1c8ab879-c2a0-4506-bba6-ea0d56c5434b.tmp
Word.CampaignStates.json
Word.GovernedChannelStates.json
Word.Settings.json
Word.SurveyHistoryStats.json
9B1D995C-23D1-4C9C-A1D9-28D528A6AC7A
mip_sdk.miplog
winword.exe.db
6224b0f9-5ff2-41db-8057-831a954987be.tmp
f8ebaf2f-91a9-4ffb-8226-648ae7acf3c9.tmp
51f6ba68-662e-49fc-bcc6-5b250401a43f.tmp
content_new.js
index.dat
ccba5a5986c77e43.customDestinations-ms
qt-config.ini
profiles.dat
Eden-Windows-v0.2.0-rc2-amd64-msvc-standard.zip
Eden-Windows-v0.2.0-rc2-amd64-msvc-standard.zip:Zone.Identifier
Eden-Windows-v0.2.0-rc2-mingw-arm64-clang-standard.zip
Eden-Windows-v0.2.0-rc2-mingw-arm64-clang-standard.zip:Zone.Identifier
eden-v0.2.0-rc2.zip
eden-v0.2.0-rc2.zip:Zone.Identifier
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
Staging
manifest.json
manifest.json
manifest.json
memory/844-729-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-674-0x00007FF9164F0000-0x00007FF916500000-memory.dmp
memory/844-676-0x00007FF9164F0000-0x00007FF916500000-memory.dmp
memory/844-728-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-671-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-730-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-673-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-675-0x000001EA1A170000-0x000001EA1A180000-memory.dmp
memory/844-672-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-670-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-727-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/844-731-0x000001EA5A0D0000-0x000001EA5A87E000-memory.dmp
memory/844-669-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/1504-677-0x000002695F930000-0x00000269600DE000-memory.dmp
memory/1676-732-0x000002C619140000-0x000002C6198EE000-memory.dmp
memory/1844-742-0x0000024D93A20000-0x0000024D941CE000-memory.dmp
memory/2476-747-0x0000015B72480000-0x0000015B72C2E000-memory.dmp
memory/2520-2755-0x000001C9449B0000-0x000001C94515E000-memory.dmp
memory/2520-3091-0x000001C9449B0000-0x000001C94515E000-memory.dmp
memory/3180-741-0x0000022EA5820000-0x0000022EA5FCE000-memory.dmp
memory/3280-652-0x000002763CFF0000-0x000002763D79E000-memory.dmp
memory/3764-3047-0x00000000012F0000-0x0000000001A9E000-memory.dmp
memory/3764-2447-0x00000000012F0000-0x0000000001A9E000-memory.dmp
memory/3764-2484-0x00000000012F0000-0x0000000001A9E000-memory.dmp
memory/4152-810-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-861-0x0000020C9D170000-0x0000020C9D182000-memory.dmp
memory/4152-812-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-811-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-815-0x0000020C54700000-0x0000020C54710000-memory.dmp
memory/4152-809-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-859-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-808-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-858-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-857-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-856-0x00007FF918AB0000-0x00007FF918AC0000-memory.dmp
memory/4152-860-0x0000020C94660000-0x0000020C94E0E000-memory.dmp
memory/4412-2175-0x000002F96D8A0000-0x000002F96D8C0000-memory.dmp
memory/4412-2449-0x000002F032D00000-0x000002F0334AE000-memory.dmp
memory/4412-2036-0x000002F838E60000-0x000002F838F60000-memory.dmp
memory/4412-2174-0x000002F96DD60000-0x000002F96DE60000-memory.dmp
memory/4412-2152-0x000002F85CC00000-0x000002F85CC20000-memory.dmp
memory/4412-2150-0x000002F96D0E0000-0x000002F96D100000-memory.dmp
memory/4412-2146-0x000002F84AA00000-0x000002F84AB00000-memory.dmp
memory/4412-2094-0x000002F838CA0000-0x000002F838DA0000-memory.dmp
memory/4508-822-0x000001996DBF0000-0x000001996E39E000-memory.dmp
memory/4660-622-0x000001A0299E0000-0x000001A02A18E000-memory.dmp
memory/4756-254-0x00000287D5520000-0x00000287D5CCE000-memory.dmp
memory/4764-607-0x000001C098B80000-0x000001C09932E000-memory.dmp