asyncrat | hxxps://github[.]com/gh8054w-pixel/ntk/raw/refs/heads/main/bloxfruitMatrix[.]exe

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/07/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/bloxfruitMatrix.exe
Sample260718-nvacnsdv7w

Score

10^/10

default discovery asyncrat persistence ransomware rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

bore.pub:44337

Mutex

xYWG8nqHHXFf

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001000000002855d-74.dat	family_asyncrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	3640	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
30	raw.githubusercontent.com
31	raw.githubusercontent.com
39	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288485685736335"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{680E5FFE-1BBD-480D-B6C0-71E4457E277F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2788	4068	msedge.exe	83
PID 4068 wrote to memory of 3640	4068	msedge.exe	84
PID 4068 wrote to memory of 2408	4068	msedge.exe	85
PID 4068 wrote to memory of 2408	4068	msedge.exe	85
PID 4068 wrote to memory of 2408	4068	msedge.exe	85
PID 4068 wrote to memory of 1668	4068	msedge.exe	86
PID 4068 wrote to memory of 1668	4068	msedge.exe	86
PID 4068 wrote to memory of 2312	4068	msedge.exe	87
PID 4068 wrote to memory of 3940	4068	msedge.exe	88
PID 4068 wrote to memory of 3940	4068	msedge.exe	88
PID 4068 wrote to memory of 3940	4068	msedge.exe	88
PID 4068 wrote to memory of 2312	4068	msedge.exe	87
PID 4068 wrote to memory of 2312	4068	msedge.exe	87
PID 4068 wrote to memory of 2024	4068	msedge.exe	89
PID 4068 wrote to memory of 2024	4068	msedge.exe	89
PID 4068 wrote to memory of 2024	4068	msedge.exe	89
PID 4068 wrote to memory of 4412	4068	msedge.exe	90
PID 4068 wrote to memory of 4412	4068	msedge.exe	90
PID 4068 wrote to memory of 4412	4068	msedge.exe	90
PID 4068 wrote to memory of 5016	4068	msedge.exe	100
PID 4068 wrote to memory of 1852	4068	msedge.exe	101
PID 4068 wrote to memory of 5016	4068	msedge.exe	100
PID 4068 wrote to memory of 1852	4068	msedge.exe	101
PID 4068 wrote to memory of 4312	4068	msedge.exe	102
PID 4068 wrote to memory of 4340	4068	msedge.exe	103
PID 4068 wrote to memory of 4312	4068	msedge.exe	102
PID 4068 wrote to memory of 4340	4068	msedge.exe	103
PID 4068 wrote to memory of 4340	4068	msedge.exe	103
PID 4068 wrote to memory of 4932	4068	msedge.exe	104
PID 4068 wrote to memory of 4928	4068	msedge.exe	105
PID 4068 wrote to memory of 4928	4068	msedge.exe	105
PID 4068 wrote to memory of 1324	4068	msedge.exe	107
PID 4068 wrote to memory of 976	4068	msedge.exe	112
PID 4068 wrote to memory of 4716	4068	msedge.exe	113
PID 4068 wrote to memory of 3396	4068	msedge.exe	114
PID 4068 wrote to memory of 3900	4068	msedge.exe	115
PID 4068 wrote to memory of 3900	4068	msedge.exe	115
PID 4068 wrote to memory of 3628	4068	msedge.exe	116
PID 4068 wrote to memory of 3628	4068	msedge.exe	116
PID 4068 wrote to memory of 1564	4068	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/gh8054w-pixel/ntk/raw/refs/heads/main/bloxfruitMatrix.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9c0adc188,0x7ff9c0adc194,0x7ff9c0adc1a0
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8302843549380981011,1253357757459290707,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,9615844829805764258,6226555800706390256,262144 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,16584274843902652754,13037217858679003439,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4185981286786414953,18337187888783830968,2097152 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2348773070759389078,13844889213598053072,2097152 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,486290401143195087,2659421772190025180,2097152 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,2300350428597735937,17987689273358729223,2097152 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,17469829815651541418,3286495207919886286,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,2050607025179973746,12229880135890838429,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8249620249958111180,8659510912792498467,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5212,i,17707586665678414884,7787642723322679702,2097152 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,11651597969607246780,9524826356098415743,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,11690259720117132019,7932294423658578193,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,17622035432422263437,3601251791460290866,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,17622035432422263437,3601251791460290866,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,9364276493530528523,2947651093900725174,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1933704745286579159,15453048029163262261,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,16325752340047247219,6583932862719370854,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2922324995081540146,1979754308923356789,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,7322112912805773605,3113130794612729137,524288 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,3709797881584467790,1987948104657715884,262144 --field-trial-handle=2360,i,14466810651977060401,9628168837194095549,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce9a45431fb053f46812395470c2ff6c9ccd1803075551fd01e4a51c3c4ecd4b
MD5 c8badd2ef76875dd0b2d479d596fe3d1
SHA1 e23e952ecb4d88e34cbd5328967dec2f0f4c9504
SHA512 049fd794e8c8698f9a3908ef9cdd577b41b7919eab42ac9ba4c6f3c4ba05742d9a6be6ee3b7daed591a94beeef3ba099eaaa2b4dcec22661479634920a672af6
TLSH
T16DD080333B1A7000D7955171D423C715533F446574838611F114C84DEDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c0f239c7ed32f1c492df19d463edf2073ad4d721081b4a3b14c372062cca32ba
MD5 c315998145f0e2e943e87f7e58d6d900
SHA1 33d11ba46613900b72e84b37dd01a1855d594067
SHA512 bb251b0b7711a8694b23a7203d473d97a43c26db6edaffb49e2fa8046fe77babe795a833ff93e67f2984697d704d9d6ccd1f8ce0d2024615aa3c0d6e5d7ba75b
TLSH
T114D080333B5A7000DB955171D422C715533F44657483C712F114C84DDDF51D953C2193
MD5 SHA1 SHA512 TLSH

Submit Download

2e6ccf92-e07d-47a1-a683-9fefdeb1df64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e6ccf92-e07d-47a1-a683-9fefdeb1df64.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 727ca45e6e0914661c2185e7f842c94ffe22702ddcaea96d9b9eb26630ce379f
MD5 9f1410c6ab9358ba0d9cb8355bff046d
SHA1 b63a73282197f11a42107107984ba1b0f02d1dd5
SHA512 6dec4d7c62d7096c345e6196560ec612aa7b21c69ac2249e62cfe31acbebf96e039612cf02540df1f324070cb58c8752665dd26f0660d29007288427a812f8bb
TLSH
T17171B19B117187E0E793C238A8C9E6293D32CE71A7332E45E1661CB1391F7728E17789
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587347.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587347.TMP
Size 3KB
SHA256 cf22204eb2497ede2bb3bb548418b120720cad7a729e6667dadc1f0c3f2b52e6
MD5 33bad00203aaa9dd2a790b5a5c7012d9
SHA1 84b193b27553f0fc85a6eb793f6813bb3861af3f
SHA512 3df4af5129afa3238b77323b66738393131d8c5c7f7462624aecf2caa22674387c0f055d28ddeebabf40d2d7f3527ac2e99063fbf842af25a7c51cf94ba15b0c
TLSH
T1CC71B39B167187E0E783C17498CAE6293D31CE7197332E45E0661CB1391F7728D17384
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bca233e991df354aa5d5d1d21fdebc693c583aca573cf58864a135ccd6eb368a
MD5 8e968b4c373058e302f8544c33e606da
SHA1 e7cabb20f4c821711760eb569adbf6fb26163f8a
SHA512 4d0184b3d372c26041c0713c827a672f66964703864f81d3e6ca7a7b6f370df0cb662aff644d062e7b8fc20165ec7f90c67ea75ec5969d2f2b5a05a77fe09f75
TLSH
T1DC219DF787E1856E8E1156F0AA14AE1BCF2D0515832C7C2A89E4BF1BD3E3461E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4a86085849a304dbe21d14b145c2e1721287a6e04999dc8bdf007cb231d501c9
MD5 cfaf4a06e9e28dc4d7bf363245bf0acd
SHA1 4ce114b906c0957a1728cd779b9f9335e6aa287a
SHA512 dde8d9b12930f5cf9137a95b75e2632dca3a12d4cf219492f34845ba37a7a37851b10f1a325d64959fd3f46e192ffc31ed718d8b55a7b7dc96044782417727ce
SSDEEP 192:sxZJRxyM/jK1Ml8UQ296/fWs4oxYvGIdpLHW6+WNGYnnw6DhIg5sJ:sxZJdqQ6/fWs4oxYvnLHbG0By
TLSH
T1C152E7126A349977CCDBD209BA45BF93D6F54473A2901E44AAFCCB0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ffdf470120123a7ffd3f9f3c7027b379abce5819f4d4d339c9c0aac26d960ea
MD5 f3e3756d69c0e08bfef7e1a49fb289ff
SHA1 300c2bf606c260729e688b77b5eda0eb0d24a44c
SHA512 b4bfed93f8a19392f6fc346c568b27b057a4dd98bafb0079c5a88d43890fd651f63481681b574c4bdd877df3337489f97bde06a56402d9eb3a4374aede51439e
SSDEEP 192:sxZJRxyM/jK1Ml8M96/fWs4opvGIdpJHW6+WNGYns97DhIgrJ:sxZJd16/fWs4opvnJHbG3B9
TLSH
T1CE42D7126A349977CCDBD309FA55BF93D5F94533A2901E44AAFCCA0C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 027f570c4d6964b2f10b7bb0ecd7ced37332a5e08f97a1d0a3ef03cf18c96baf
MD5 4b92b3a918fc57acf1d70e4dc80ada15
SHA1 60aee8ce3a332a3cd8e8c76cd903c82e04c57aee
SHA512 3fcef0e9c235d2b2266621190ce3d158dd812f6bf11a4e0d5e18bd4283ed938e6c239df45976414f55e039baf0e913f758899782e64a85daa07392fe3f789411
SSDEEP 768:7iQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshkro/zxDR:7iQRMvUWv0sTgu1jakTLROhv/zx1
TLSH
T120D21C3B284CC77E4F841E6CEC2AAF976DD801CB67988D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 23b2f06727e841a93ad1d0b1a69bfd013455aa1cb9824a0e2ce431ca7d0f832d
MD5 832e1cfcbd5f1b8045bb473125858454
SHA1 ccd73625fcdedc4d39b8fe8cf472c2792325d29b
SHA512 8620b2ec35209aecef061082153b3673a6c256edb62bb01db2b7fec5cf32b7a9dfb2e17c706333aaea831d9b5fed29957c475f145e93a794c7a0dbe214652a95
SSDEEP 48:KceIXKz6YLyi/IBK4QE/y5WIvK/agNSBMwScq:KceEKz6m5/GK4QGKWkK/aG
TLSH
T19F912813303B02C138BE2909A6A68B372E46F1773515E96F7BAD50670E66E110DFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591004.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 01b2e8382e6b610217518b7918a78b7555862bc5ae240c425dd90f5087e72618
MD5 502a50bf1a0593b5d59064263f63ced4
SHA1 8faa9952731f24994189e485dacca606c72f0695
SHA512 80554bc7c8188c176556510fc2847c2b3826c983ebc75b88be8e1f5b2f1efeba6fae17775abf844a918e244274519a9127d426a8f2ee526df253c4e42abc8310
SSDEEP 384:UiF1tNn/s3n9S6zsNN8TUNTUlIlk3uecSbX54atQJ2RB0YoBLEOObjI9G6w7H:vF1j+9Vswg/IDxmJkKZE29MH
TLSH
T134A27D339C64997BAEE38A95F54B3A079EF4527BC2C17A94E6DCAF0C01DB1DC030A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 660658af7672cf435d0926f7e0d49ee6b42e9e5004f92caed7e2b14561816d5e
MD5 7ac8df16cfb6cfd95936324aec7ae232
SHA1 8caec38014875ef1781221eaee1527fa253ceeb9
SHA512 130ffd96509e7cc72de508670d54f086a1fd5524fae03d561032a11e7431e58801eda4776a59e119f3d58f664582cd5bb9d3645510eaeffa72e59f4dc319fb0e
SSDEEP 192:CONB6G+bgQmiUy+tDE54aP1QJ2p4W8Oy2pU6:CONB6HgLDE54atQJ2WmU6
TLSH
T14702EA35AC783CBB9FF3AD45B4872B136F98112BE6916B84D6E81B1C41DB28C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 987072c8b543f92f15b1253d1c002e5353cd0fcf09e61e7f68f2a17b876b0d53
MD5 2219e569b7bc4eb87236383e8f3a55dc
SHA1 1b8e096d1a243f9a49292443d14e436369e1d08e
SHA512 8e6871161e1884a0fa4e389a6709586552115131ee41e6a2c5852ba4ae0c60c581794bead784d12e5dfbde181cf1da9f38ba2da21da8a78e81cc2de9ef26f9a1
SSDEEP 384:htNn/s3n9SfsNzk3uecSbX54atQJ2RB0YoBsEOObjI9G6w7H:hj+9U+IDxmJkK6E29MH
TLSH
T104928D32AC346D6B5EE3D595F0473A1B5EF8927B93C53A84D5ECAB0C01DF29C0306619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8ef185230b16127b263210925ad0b4da57251d5a13ab18cd8380abb8e35f4883
MD5 15dc2f0cbb94401b9a5f988e4fb368c1
SHA1 6083e8b113746aec122bbbb9e5460af51b16aed7
SHA512 4f539291efd21220ed5c792a9d8348069b5b6102d04cd6f18cc805182e946b818f4b02b45de21eea8a1a9213b6f15a678448b39d35a4ed8c7e81c1f43ea176ac
SSDEEP 384:YtNn/s3n9SfsNzkWuecSbX54atQJ2RB0YoBsEOObjI9G6w7H:Yj+9URIDxmJkK6E29MH
TLSH
T1C1927E32AC346D6B5EE3D595F4473A1B5EF8927B92C53A84D5ECAB0C01DF29C0306619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbdd659dabc01fc52a3056e8328596b9e2ad093ebe982fb62be1c94a67f65d14
MD5 ec05603e9889f2737d9caad66b868940
SHA1 d69c49348611cd4471046afd126d9a1edc754292
SHA512 3308c017b34df5dce53cc444dfd8803847e42407b0cfb214f2c1a2963387c17aaf86818503ad469eb94d8f9f376c8969092206f7fbfd02b21db2e938293a725a
SSDEEP 192:4ONO6G+b6QmiUypt5E54aP1QJ2p40BujPwoBX8ShSrq7QU6:4ONO6H2W5E54atQJ2RB0YoB1EU6
TLSH
T1A5120B36AC787C6B5EE399C1B48736076E999327D6C57B8086EC2B0C41EF25C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b60cb7fa-fe48-4c4f-8083-d3770fcb3340.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b60cb7fa-fe48-4c4f-8083-d3770fcb3340.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a5c70ff9dd65171540b291bf89817acad807f289a5d35e83ffd69dc7e36d28bb
MD5 edcc238bbd6f2a0c42fd9688b538e4af
SHA1 172a6d168459026f9c4f089987f82b0726c21638
SHA512 a967075e5d7f5de2bf3a630b1bf26e6c1d0fa7c311ba773ba1dfe37021802f4889fb91fdb1dd2c886ff5addbba0eed0c6c3696be1022a9ea61a40062a45c8736
TLSH
T1D9412A5CBAFE1158B3B76E56ABF6A86D487FB8372F06D45D10110E4F0623A40D861B33
MD5 SHA1 SHA512 TLSH

Submit Download

bloxfruitMatrix.exe.crdownload

Path C:\Users\Admin\Downloads\bloxfruitMatrix.exe.crdownload
Size 45KB
SHA256 d03349ceb8281115ad088d8d66b36a790afd29ca2541f97020b57dbd338b35f6
MD5 4f0f7c411da3b8ac625fcf49f24f7cd3
SHA1 974b7d0ff05e3ec0cee04b6531c978fa04762480
SHA512 e6bad3d9b67fae88a9f93057852f379ba008fdd27bb0e53f74c06096e6c402ca689e73887aa55e1a27988a343f852f9cf47c925a85b3cc629d749868473f4bb4
SSDEEP 768:OufxhTXbDdbWUn7yqmo2qRoKjPGaG6PIyzjbFgX3iIm3xqSVdJ1BDZ6x:OufxhTXnN2vKTkDy3bCXSTntd6x
TLSH
T1F8231A003BD8822BF2BE5F78ACF26145457AF2632603D6491CC451DB5723FC69A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download