Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3Shadows.of...OM.url
windows7-x64
6Shadows.of...OM.url
windows10-2004-x64
3Shadows.of...OM.url
windows7-x64
6Shadows.of...OM.url
windows10-2004-x64
3Shadows.of...ly.dll
windows7-x64
1Shadows.of...ly.dll
windows10-2004-x64
1Shadows.of...in.dll
windows7-x64
1Shadows.of...in.dll
windows10-2004-x64
1Shadows.of...bt.exe
windows7-x64
1Shadows.of...bt.exe
windows10-2004-x64
1Shadows.of...ut.dll
windows7-x64
1Shadows.of...ut.dll
windows10-2004-x64
1Shadows.of...io.dll
windows7-x64
1Shadows.of...io.dll
windows10-2004-x64
1Shadows.of...io.dll
windows7-x64
1Shadows.of...io.dll
windows10-2004-x64
1Shadows.of...ed.dll
windows7-x64
1Shadows.of...ed.dll
windows10-2004-x64
1Shadows.of...li.dll
windows7-x64
1Shadows.of...li.dll
windows10-2004-x64
1Shadows.of...lz.dll
windows7-x64
1Shadows.of...lz.dll
windows10-2004-x64
1Shadows.of...z4.dll
windows7-x64
1Shadows.of...z4.dll
windows10-2004-x64
1Shadows.of...ma.dll
windows7-x64
1Shadows.of...ma.dll
windows10-2004-x64
1Shadows.of...pw.dll
windows7-x64
1Shadows.of...pw.dll
windows10-2004-x64
1Shadows.of...io.dll
windows7-x64
1Shadows.of...io.dll
windows10-2004-x64
1Shadows.of...64.dll
windows7-x64
1Shadows.of...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
290s -
max time network
383s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-es -
resource tags
arch:x64arch:x86image:win10v2004-20231023-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
22/11/2023, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
Shadows.of.Doubt.v35.07/IGG-GAMES.COM.url
Resource
win7-20231023-es
Behavioral task
behavioral2
Sample
Shadows.of.Doubt.v35.07/IGG-GAMES.COM.url
Resource
win10v2004-20231023-es
Behavioral task
behavioral3
Sample
Shadows.of.Doubt.v35.07/PCGAMESTORRENTS.COM.url
Resource
win7-20231023-es
Behavioral task
behavioral4
Sample
Shadows.of.Doubt.v35.07/PCGAMESTORRENTS.COM.url
Resource
win10v2004-20231023-es
Behavioral task
behavioral5
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/GameAssembly.dll
Resource
win7-20231023-es
Behavioral task
behavioral6
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/GameAssembly.dll
Resource
win10v2004-20231025-es
Behavioral task
behavioral7
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/NVUnityPlugin.dll
Resource
win7-20231023-es
Behavioral task
behavioral8
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/NVUnityPlugin.dll
Resource
win10v2004-20231020-es
Behavioral task
behavioral9
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt.exe
Resource
win7-20231020-es
Behavioral task
behavioral10
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt.exe
Resource
win10v2004-20231020-es
Behavioral task
behavioral11
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/Rewired_DirectInput.dll
Resource
win7-20231023-es
Behavioral task
behavioral12
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/Rewired_DirectInput.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral13
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/fmodstudio.dll
Resource
win7-20231020-es
Behavioral task
behavioral14
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/fmodstudio.dll
Resource
win10v2004-20231020-es
Behavioral task
behavioral15
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/gvraudio.dll
Resource
win7-20231025-es
Behavioral task
behavioral16
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/gvraudio.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral17
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win7-20231023-es
Behavioral task
behavioral18
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10v2004-20231020-es
Behavioral task
behavioral19
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libbrotli.dll
Resource
win7-20231023-es
Behavioral task
behavioral20
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libbrotli.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral21
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libfastlz.dll
Resource
win7-20231020-es
Behavioral task
behavioral22
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libfastlz.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral23
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/liblz4.dll
Resource
win7-20231020-es
Behavioral task
behavioral24
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/liblz4.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral25
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/liblzma.dll
Resource
win7-20231020-es
Behavioral task
behavioral26
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/liblzma.dll
Resource
win10v2004-20231025-es
Behavioral task
behavioral27
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libzipw.dll
Resource
win7-20231025-es
Behavioral task
behavioral28
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/libzipw.dll
Resource
win10v2004-20231023-es
Behavioral task
behavioral29
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/resonanceaudio.dll
Resource
win7-20231020-es
Behavioral task
behavioral30
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/resonanceaudio.dll
Resource
win10v2004-20231020-es
Behavioral task
behavioral31
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/steam_api64.dll
Resource
win7-20231023-es
Behavioral task
behavioral32
Sample
Shadows.of.Doubt.v35.07/Shadows.of.Doubt.v35.07/Shadows of Doubt_Data/Plugins/x86_64/steam_api64.dll
Resource
win10v2004-20231023-es
General
-
Target
Shadows.of.Doubt.v35.07/PCGAMESTORRENTS.COM.url
-
Size
202B
-
MD5
420715a04de8367bb8d37d57ce1d6d41
-
SHA1
710369a636391e43be7149416d8e9b390863babb
-
SHA256
c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
-
SHA512
8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3360 msedge.exe 3360 msedge.exe 3144 msedge.exe 3144 msedge.exe 2172 identity_helper.exe 2172 identity_helper.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3144 3584 rundll32.exe 82 PID 3584 wrote to memory of 3144 3584 rundll32.exe 82 PID 3144 wrote to memory of 1508 3144 msedge.exe 84 PID 3144 wrote to memory of 1508 3144 msedge.exe 84 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 2860 3144 msedge.exe 85 PID 3144 wrote to memory of 3360 3144 msedge.exe 86 PID 3144 wrote to memory of 3360 3144 msedge.exe 86 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87 PID 3144 wrote to memory of 1540 3144 msedge.exe 87
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Shadows.of.Doubt.v35.07\PCGAMESTORRENTS.COM.url1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pcgamestorrents.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc406446f8,0x7ffc40644708,0x7ffc406447183⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:23⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:83⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:13⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:13⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:13⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:13⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:13⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:13⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:83⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:13⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:13⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10488975795579773087,12928818391042735876,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5976 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD5126dd58a5663cc2cfadf4af92e0e0bf5
SHA12095ee39119662a92d0b588532273f347b927c64
SHA256b2a13c3a8dce67e029c4b5ff242077d0cae055de81c2ee78ec512e6449ea778b
SHA512783977defbcc38fb3c70346868e3ecba2d7e7db86250081a0e21e5f92e23a99beeabbafc9d98aaebb795aca67eaa1155c2224631e3bc56a7eb56786412e57ab3
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5fd88d4abb2264adaa5971dbf3ac0146f
SHA19ca9da304c31aa50492a899fd7e1253fde027886
SHA256391eb23a27e032f071b8418c407c5d908dac5fbc52720e8335d6b5c2cc701a5d
SHA512c735f922d8905378e20709d5bf32c250c1db752a6506ea3f87513679cd01ef3c99eec8de556eb60ee3bfbd3cbc179d028bbf391d6960b7b96a88eb432a63a675
-
Filesize
5KB
MD5a770864a84b7fc194589697e8423dfb8
SHA1f79660578af0a255159c51d095e574c1b14d29c5
SHA256529995c53b906a224ad07e6f824def0499d37fa7ba3092eebcd86fa70abd2913
SHA512e092e97b6b9220d62253112480e6ebec08cbd08323f637a962ad977c6f6cbb6453a3985fd48340ebd5a4549b4fffc0b6182ee9d50f70738b3f84a8999ad15f5f
-
Filesize
6KB
MD527ca6cc599af26f3c0a483195aa9bf5c
SHA1130bffc2186c2e753a0a8003bb42c4bf1ac9898a
SHA256e226084d309852adda77a078c3f3ca3c052c9eed6242085bafe3cbe137693ddd
SHA51292dbb31413304ddd266c76bccca1b6ae27765e2a2b451155f727f97c904a23cb585dd03b2526e54b3f9cb6650d30d1ffa96347e9cd6eaa86fb9ec36bb954308e
-
Filesize
24KB
MD53a748249c8b0e04e77ad0d6723e564ff
SHA15c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA256f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
SHA51253254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5fe5d21405d4532f0faecaca78d9785b8
SHA184abadba6688d3c9ab7895f7f03cc1f2f718750e
SHA256143c796e840fe6d084eb7a29f576e26d276f3c4f950979bddeadd42fcab96a5b
SHA5125e7adefe895ca7105e7d461340115f6f7a97f1dc89296f334619c133987523fd962676c0a8aaf197b748c323146a2eb8aea3ee8ddb6e364e84edeb0df3b12cd7
-
Filesize
10KB
MD58815c5b15d421777e39cc6bc2d38ffe8
SHA1dafc9b1dbae455287ab78ae4b98eee775ca93dec
SHA256840f7a7ac51db1cf0cd2d5dd0e36c128af40f27fe588c5a748988452fdf57ad2
SHA512199867a00cfe554db78b82d798f6c2c01a66f34a0be295c93b957a2c0e623abfea36347b935fa0ed92eb646e6597242cb23b2a011c0b4ba50dcfe77cc0e3a129