Overview

overview

10

Static

static

10

2026-07-06...de.exe

windows10-2004-x64

10

2026-07-06...de.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 01:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_ace778c96f72176dc30791b63f64512b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
  • Size 9.6MB
  • Sample260707-b2e6aaft6w
  • SHA256 272b12bb8f2e60a440615f2041301d5d4f16d0c78d7cb42a2f310f8accebe6b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryfuturaxpersistencespywarestealerworm

Malware Config

Signatures

  • Family: Futurax

    Futurax is a Windows worm written in Delphi.

    wormfuturax
  • Detects Futurax 1 IoCs
  • Detects executables packed with MEW 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ace778c96f72176dc30791b63f64512b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_ace778c96f72176dc30791b63f64512b_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5524
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:5776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffaf28bc188,0x7ffaf28bc194,0x7ffaf28bc1a0
          4⤵
            PID:4328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8731326384569428532,17337012138216253372,262144 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
            4⤵
              PID:1960
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6322742918777533007,15734222091935847576,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
              4⤵
              • System Time Discovery
              PID:5616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,2699647465972227521,8971703040056656002,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
              4⤵
                PID:1952
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,17464693241837782994,2641834871124047890,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                4⤵
                  PID:2036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4487660336403256739,5006313766999246624,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                  4⤵
                    PID:5436
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,1488646320076234750,6233359554438395886,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
                    4⤵
                      PID:4044
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,15114080815332751894,17267450449432390724,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
                      4⤵
                        PID:5216
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,391227545592960301,14512968847112868889,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                        4⤵
                          PID:1148
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17568298697634975963,13453799999188061274,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
                          4⤵
                            PID:4288
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3892206029575308515,15004681597480359373,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                            4⤵
                              PID:4252
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3185791177475908938,15409480013881054071,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                              4⤵
                                PID:5828
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3185791177475908938,15409480013881054071,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                                4⤵
                                  PID:5040
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,16874474596368351633,3356508016172446454,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
                                  4⤵
                                    PID:352
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6736,i,15562242543386229212,1434244958766884580,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
                                    4⤵
                                      PID:2836
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6264,i,3230362908630140332,9653913672108709001,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
                                      4⤵
                                        PID:4132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,15010381674727596876,17756698978510909265,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
                                        4⤵
                                          PID:6084
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6104,i,3201470242646883644,13229287905695389608,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
                                          4⤵
                                            PID:4592
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,17804880161826658920,1088534316746462912,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                            4⤵
                                              PID:2320
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,3726452850713756391,7956206222580537325,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                              4⤵
                                                PID:5236
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1211329458286544207,1443577710994772529,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
                                                4⤵
                                                  PID:1696
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5564,i,9633501633119927039,11685866738930194870,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
                                                  4⤵
                                                    PID:4424
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,3089794613219270981,14780034632345054936,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                    4⤵
                                                      PID:4928
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,9307087700206643490,16863912714179201516,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
                                                      4⤵
                                                        PID:3448
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=952,i,17514619953385100122,9352729863510420914,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
                                                        4⤵
                                                          PID:1508
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6826634286634360104,15914132538011573803,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
                                                          4⤵
                                                            PID:4592
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5096,i,18427302259045447570,5098608584765944125,262144 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:10
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1980
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7104,i,4907445555462510132,13616825576941338684,2097152 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                                                            4⤵
                                                              PID:5728
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,16658899786982322068,17668492711553418810,524288 --field-trial-handle=2540,i,2635609539570542773,15705880517250461811,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
                                                              4⤵
                                                                PID:1884
                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2752
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2964
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:5828
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:5936

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  7zFM.exe-
                                                                  • Path C:\Program Files\7-Zip\7zFM.exe-
                                                                  • Size 10.5MB
                                                                  • SHA256 0bb60a71d43bac44dd1396a0814d8df0bfe384ce9b9c787b408b10162a602fec
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 2KB
                                                                  • SHA256 192f9e31cb04ff12ad15193d4ee62ba59fcf29980a352f60a4037c7c37964050
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index~RFe5a01a7.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a01a7.TMP
                                                                  • Size 2KB
                                                                  • SHA256 9344f3ddb982e9aa78c4513aaa144d60833c48381fe674bbebdbdefd02a064ff
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SiteList-Enterprise.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Edge Profile.ico
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 2KB
                                                                  • SHA256 44df77cb4020d61e76ca79cbeb1cc367f3519e08307d9168d0fc4e03ecd08d54
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SCT Auditing Pending Reports
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Sdch Dictionaries
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 14KB
                                                                  • SHA256 79cc2ac420690b905310f63fef8593b34c522701979c4441d080cc4b62ca95d9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 14KB
                                                                  • SHA256 6006674c44bb7e2db4734451825a67397522f2999737fb8010514c9a4b3bec09
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 14KB
                                                                  • SHA256 89fbe34832aaa29e024d4105907359815aa769ae1fc56be03f3999da6facbdce
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 30KB
                                                                  • SHA256 06ae72f3c61dd9001724042565e711266f1d9e9e16630e0f37f5429ad6fa9575
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig~RFe5a9c8f.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9c8f.TMP
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 38KB
                                                                  • SHA256 e01bc9a478b8a6bf94cbf4ffa44db4ca44142cf07e3f40277f913ec6cae7543f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 38KB
                                                                  • SHA256 4cca1fd269e993fb2b55ac10a8a067fa651ec1e7c742b6387cf1a8ae9a9bf203
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 35KB
                                                                  • SHA256 f8f82cefd75c2aaf073ae65869b7c2e31922854b122492eb012fefdad1f83848
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 372B
                                                                  • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 252B
                                                                  • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                  • Size 599B
                                                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                  • Size 595B
                                                                  • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  content_new.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1637877599\CRX_INSTALL\content_new.js
                                                                  • Size 10KB
                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  memory/2752-10-0x0000020400000000-0x0000020400100000-memory.dmp
                                                                  Download

                                                                  memory/2752-25-0x0000020403690000-0x00000204036B0000-memory.dmp
                                                                  Download

                                                                  memory/2752-11-0x0000020400000000-0x0000020400100000-memory.dmp
                                                                  Download

                                                                  memory/2752-12-0x0000020400000000-0x0000020400100000-memory.dmp
                                                                  Download

                                                                  memory/2752-59-0x0000020413F70000-0x0000020413F90000-memory.dmp
                                                                  Download

                                                                  memory/2752-45-0x0000020403A70000-0x0000020403A90000-memory.dmp
                                                                  Download

                                                                  memory/2752-26-0x0000020413AF0000-0x0000020413BF0000-memory.dmp
                                                                  Download