Overview

overview

10

Static

static

10

2026-10-01...ry.exe

windows10-2004-x64

10

2026-10-01...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 08:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_92e32697e56a65e54935fd74b6492200_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
  • Size 9.6MB
  • Sample261002-kpgysaec34
  • SHA256 f5191ffa9fb7436870ffc17b452f741a254b42338c8af15d34a798822cfd878f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryfuturaxspywarestealerworm

Malware Config

Signatures

  • Family: Futurax

    Futurax is a Windows worm written in Delphi.

    wormfuturax
  • Detects Futurax 1 IoCs
  • Detects executables packed with MEW 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_92e32697e56a65e54935fd74b6492200_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_92e32697e56a65e54935fd74b6492200_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5400
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"
        3⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5472
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffe79b7c188,0x7ffe79b7c194,0x7ffe79b7c1a0
          4⤵
            PID:5916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9956241714146991968,5086415478261167536,262144 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:2
            4⤵
              PID:428
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,10100455784375871579,14342233496075905872,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:11
              4⤵
              • System Time Discovery
              PID:4160
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,5944240640725185936,22483982423662688,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
              4⤵
                PID:5020
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,10437602304778553768,14039177091880771294,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                4⤵
                  PID:876
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,4242841658027595529,15109391715479902694,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
                  4⤵
                    PID:1528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7081002319935096410,12541325452844803668,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
                    4⤵
                      PID:4492
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,4736624824797687940,5436184298074723748,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
                      4⤵
                        PID:4868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,4333138353024271392,15172933828603757334,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
                        4⤵
                          PID:1168
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,11055201945904934165,6414888903429687477,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:14
                          4⤵
                            PID:236
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,13161828473428922178,16128256257002770147,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                            4⤵
                              PID:2880
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12635432736208154393,14009445933408466606,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                              4⤵
                                PID:2804
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12635432736208154393,14009445933408466606,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                                4⤵
                                  PID:772
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,7698965730959176722,14986774785348254308,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
                                  4⤵
                                    PID:468
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,10594088665066242724,7517000972731076473,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
                                    4⤵
                                      PID:4740
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6436,i,16159841304700851481,9339748562056876660,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
                                      4⤵
                                        PID:3984
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6644,i,15291811284084774128,15421670875008362576,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
                                        4⤵
                                          PID:2592
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6052,i,7993966196173102996,8786280987567626472,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
                                          4⤵
                                            PID:256
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,77338552035783039,15886574840207966239,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
                                            4⤵
                                              PID:5436
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11433322079963769694,14032307955596259570,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
                                              4⤵
                                                PID:3252
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6043722132290846942,16094404954891058929,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
                                                4⤵
                                                  PID:4520
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2416,i,8143915768993207475,4730588165321357540,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                                                  4⤵
                                                    PID:4248
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,10851141113336461668,7108139508472573084,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:14
                                                    4⤵
                                                      PID:4080
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6265267079864327645,8767550413686076821,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
                                                      4⤵
                                                        PID:2644
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16186215454166782134,6995521676451502082,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                        4⤵
                                                          PID:4876
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,662801981312804015,9163654821427811982,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
                                                          4⤵
                                                            PID:5852
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,5907125255210842394,5610384532928032975,262144 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:10
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5676
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3564,i,5709463221981056347,5348999433470363172,2097152 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
                                                            4⤵
                                                              PID:1544
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9051567636378336097,12537882135463575082,524288 --field-trial-handle=2808,i,2069831520179740425,8793683814080701723,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
                                                              4⤵
                                                                PID:2612
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:4036
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                            1⤵
                                                              PID:256

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  7zFM.exe-
                                                                  • Path C:\Program Files\7-Zip\7zFM.exe-
                                                                  • Size 10.5MB
                                                                  • SHA256 10fb5cae1d9462ce465ab6c0748ce173b0738cfc3b1653f9d9f226e5bf280f1f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  4195a68d-78f3-46a3-832d-0782d4a9d2f8.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4195a68d-78f3-46a3-832d-0782d4a9d2f8.tmp
                                                                  • Size 33KB
                                                                  • SHA256 9579e4de3afdf0530c6b8c4dba04298e6e464873c6d8511fd91926e3e3b7d750
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  47167875-ec57-4e4f-b56a-52cdd7e95942.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47167875-ec57-4e4f-b56a-52cdd7e95942.tmp
                                                                  • Size 33KB
                                                                  • SHA256 64e4acb67bbe3bbdd99527439090e41a9dd12f123fba693e506703c09c3ca9a1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  4d7a6d65-9bc0-4095-83e4-4a23b6c39fe2.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d7a6d65-9bc0-4095-83e4-4a23b6c39fe2.tmp
                                                                  • Size 37KB
                                                                  • SHA256 9e52436aad909477b789f61b03f880fae541787f0d35110dd7d73532c438433f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  7d3fa6df-f41a-4135-be18-249e63dce857.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d3fa6df-f41a-4135-be18-249e63dce857.tmp
                                                                  • Size 11KB
                                                                  • SHA256 8ad517c7555aa4faadafd74e30398338e7baf21e57892c88d55cabbb29e79adf
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  804d6e4f-127c-45e1-b444-fef68f6f4d90.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\804d6e4f-127c-45e1-b444-fef68f6f4d90.tmp
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  9a8f21e0-9f58-4446-88cb-d4eb7d00aed9.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a8f21e0-9f58-4446-88cb-d4eb7d00aed9.tmp
                                                                  • Size 11KB
                                                                  • SHA256 2566f771bad924b917f31eedd581e20c18174e20c6f137011bca66586e925b0a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  temp-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                  • Size 2KB
                                                                  • SHA256 bec261a0375ba931ec537c5f0720eb36e3d5b59d8e73fb8ca61ee5f04f2f5d37
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 2KB
                                                                  • SHA256 9a8950a579ecfc7833ebdd5ae5d5a52529fd50fb91bbb572f91514388c35ea4e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  13de4032-1d81-44bb-9cb3-f1e6d72733c3.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\13de4032-1d81-44bb-9cb3-f1e6d72733c3.tmp
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  1e9ab08a-54b2-4934-9c27-0dcd24e61f21.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e9ab08a-54b2-4934-9c27-0dcd24e61f21.tmp
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  340a7931-a30b-4ce4-9370-f8985692f13d.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\340a7931-a30b-4ce4-9370-f8985692f13d.tmp
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  3cc428fd-5b76-4c92-b375-45df01bd53da.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3cc428fd-5b76-4c92-b375-45df01bd53da.tmp
                                                                  • Size 2KB
                                                                  • SHA256 824e9fced5d8d98c9e6ebf100f004feb997af24adbf0c73e2c220392b8e5734a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 29KB
                                                                  • SHA256 13a137077361c8c73f9fac41187e2c3438d60d0c1848b211b8b59f2c1451fd8b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fce17d1c-ce4e-4774-9330-08c6866b4307.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fce17d1c-ce4e-4774-9330-08c6866b4307.tmp
                                                                  • Size 11KB
                                                                  • SHA256 0d37eb1b77046b04cc3fe0e9a9183d5cd399f76a27747df0488caab423d57712
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  8a8dc7d4-3758-4cd8-87b9-3b0f99812716.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8a8dc7d4-3758-4cd8-87b9-3b0f99812716.tmp
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  b7c31b28-b9ec-44ef-bb24-7486b295d52f.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7c31b28-b9ec-44ef-bb24-7486b295d52f.tmp
                                                                  • Size 37KB
                                                                  • SHA256 8d41444c9b4711a36de2403ccddee9dd0fdfe2288b3ee1955f824a9bc3c0f091
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  0349cfde-2351-4dd9-acaa-6c534df27e85.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0349cfde-2351-4dd9-acaa-6c534df27e85.tmp
                                                                  • Size 492B
                                                                  • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5c574f7b-5ddc-48bd-8d08-0cdf884eb442.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5c574f7b-5ddc-48bd-8d08-0cdf884eb442.tmp
                                                                  • Size 372B
                                                                  • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  8dc0fa41-8a22-48d9-9cb1-01573564c23a.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8dc0fa41-8a22-48d9-9cb1-01573564c23a.tmp
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  9c6e5061-5525-4b01-a402-30b4b4f6d058.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9c6e5061-5525-4b01-a402-30b4b4f6d058.tmp
                                                                  • Size 252B
                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  7bb09b13-9b77-4cab-a8d2-465f3a618781.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7bb09b13-9b77-4cab-a8d2-465f3a618781.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  fcd9779e-3b05-428c-a267-3d052de07f55.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fcd9779e-3b05-428c-a267-3d052de07f55.tmp
                                                                  • Size 33KB
                                                                  • SHA256 038028b31ddc1a530e2042d4c2b196c0c5d663c6966c4b8853443d2183fc51f8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  932c5b03-16fe-4c9b-a6fa-c693a90a2771.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\932c5b03-16fe-4c9b-a6fa-c693a90a2771.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  c2a352d3-4832-4bad-8fe4-92b96c4c956c.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c2a352d3-4832-4bad-8fe4-92b96c4c956c.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  content.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5472_521412771\CRX_INSTALL\content.js
                                                                  • Size 9KB
                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1020354307\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1338212715\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1669368395\manifest.json
                                                                  • Size 165B
                                                                  • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_48168096\manifest.json
                                                                  • Size 160B
                                                                  • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download