Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1742s -
max time network
1750s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
91gdDQwGKUL._AC_UF894,1000_QL80_.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
91gdDQwGKUL._AC_UF894,1000_QL80_.jpg
Resource
win11-20240221-en
General
-
Target
91gdDQwGKUL._AC_UF894,1000_QL80_.jpg
-
Size
116KB
-
MD5
c6c5a4f28db3aa2b4102410edeb31657
-
SHA1
44d6e049c546b066c38bd098f133c1cb7f39cac9
-
SHA256
d061b8a2243961af30ace9badffe4035c812741f0a05b4e099fa10e2beffc29c
-
SHA512
675073de7d67f9e9445ad2d6198c71a08d0ad129c3fd50e2fa7bc2c31255c98df02dd43a02d479b84bf66e8eeee6152759809adff8740b0d1113b39a1aaf64c4
-
SSDEEP
3072:jClKVuf0tkpiHOz/Y2xEQtx3UzmnAhCmeLfy:0K4skpiH4gBQ/EoA0TL6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-513485977-2495024337-1260977654-1000\{221A2D80-51B7-45E6-922D-8A4EC6FBF3BD} msedge.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3520 msedge.exe 3520 msedge.exe 4316 msedge.exe 4316 msedge.exe 840 identity_helper.exe 840 identity_helper.exe 2272 msedge.exe 2272 msedge.exe 4044 msedge.exe 4044 msedge.exe 5100 msedge.exe 5100 msedge.exe 4120 msedge.exe 4120 msedge.exe 4988 msedge.exe 4988 msedge.exe 4688 msedge.exe 4688 msedge.exe 3276 msedge.exe 3276 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 220 4316 msedge.exe 110 PID 4316 wrote to memory of 220 4316 msedge.exe 110 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 2724 4316 msedge.exe 111 PID 4316 wrote to memory of 3520 4316 msedge.exe 112 PID 4316 wrote to memory of 3520 4316 msedge.exe 112 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113 PID 4316 wrote to memory of 2428 4316 msedge.exe 113
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\91gdDQwGKUL._AC_UF894,1000_QL80_.jpg1⤵PID:4888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc91c46f8,0x7ffcc91c4708,0x7ffcc91c47182⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:82⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4052 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:12⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6652 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11071665719067764383,32321556704646646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1008
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5c6a845a100075c569af2f43170316247
SHA131c2ddce01529422debf676afa936ae20bb4d4d8
SHA256e0a23c6fcc7bd0bf618f52965311b276c2ac3737ad1473808227ff3184c54105
SHA5126743f1c3daffa68889041b7083914ba03c11c66c9e81dde413691c189e371447b7e96eb1fb22b3496e37e5a852e6d730c7ea90264b7db01d0346e04eb8651c44
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
3KB
MD58b66096915304a0fe8c7263fa70e7918
SHA13770bca58e35433eee7f8f1646aa523287ad2284
SHA2564472b5009ac3fd7a9257b8bd47c0a2d31daa46cc6debe6a9b70b7f33f9c6e681
SHA51278b7f415ee8d65af603b9b19eabce56db384d36bf04053a5d162e172b17aa8cbabd02f95423b379d8e52fd7eb836bcb1ff03cf602a87bb2607147bf7cf711f48
-
Filesize
3KB
MD53c348f29a54f887b8c37c2b466b20b3f
SHA164e7263d28674be91a93bf013298395fa5163c6e
SHA256ca4298d671551103954bd357b7194371bc2bbffa85ec6ce64a7adb0b5dbddd2e
SHA5121f6b4ae41d31ddf52ce182844180fda051f79e22dd22e8c7f1246d7e781cbd95b560ba786b775c2a8369a82435dff336d7d2c2957438903af2f6361637c8c972
-
Filesize
4KB
MD57f12d3d503498f5fadc84ee4f33e7827
SHA1a1043c33f2a027b1679c468b8807b57d45a7b99f
SHA256a4b99c03fb9fe75b862cfc76184fc516955560521571a526ec971a5c1e88fa70
SHA51285a58160b1f29e493fe58ae6c7004420f358bebbebd526c5d0a83dd05d8c61ec0cb29f1057555bfd94377d947bd0aed7be070dc34f4014faa7111d3d6fcfe9cc
-
Filesize
6KB
MD5c9637e3379a6953d99cf5bb3951b317e
SHA120beaa5552f1c7cc28b3d5da7827207f989e58af
SHA25604881896f82a8df91db5913dcf7ddd40409674fc2bb25cd4989bac09ac6509b6
SHA51218678c4e35d7673a518a080207d5aa2aa9f114b701d167296093db20b814c9b5a634371f9c7f0041431849592848193013e1101d5ab911911f8cf45df9280e45
-
Filesize
7KB
MD5ec0834589a6c80716bd255a497453381
SHA102d7b045644e79892e7cf6736eff8eca0f37a46d
SHA2564b3b6762743a97f666929caccfd142ff300a414bb111539f9ce3e6a715ad4dc4
SHA512d6e7a780dac5efe22c6c5c39882b9cd0dd15f6cd3fe5789151cd117ceefdc2e44f0ed26568f80aae13a01ea59e41f0dd7c52fbd6d1bfeee13a0abe33f1a98b5a
-
Filesize
6KB
MD56d490f6c7829be1b8be00755e8b15760
SHA1f0f0a9b416306ff3881ce1da6e0a61a1030da77a
SHA256c40bbb949f04a6aa766871be2df4e441edc1749d68cafddc9b986a3e9b0f53af
SHA512d174639a2ae7d199586eaa49df64d55fbc6f66ee3b3e2b66bc3b9e2add9448b8aae9fd92bd3dd48435488c715a5b0dcfb8760d824aec5f16d015b0654b72c4b8
-
Filesize
8KB
MD5fae6642ed3708ae9bdc3d79ef7f824fe
SHA1480fa1bb0df81e0e164ec1d534164bd654e9d079
SHA2562563ba8d869fb0699a4a2dc974c129715c2dcaa5407dc76d9f97d6cae16f570b
SHA512bda6c55d093f7d62eb3ff022233c3b3719e04fe7b0bdaa5bf29b19b926aa1f1a5b3eee2c0d4af15dbc35d2a53fe6e6844431b5c19b317df1442885063d286b71
-
Filesize
6KB
MD53d38d69a41b6fbf5dbfe7e306e93e8c7
SHA11c9bbb64dd3d03893f867fb671730b0a11f95473
SHA256ce5f21bedf5491ebf57e74dc4d81da1517c1d42b90f9c8756642dad19046319f
SHA512c463c9239e395caa8d513cb76b5766cc3f6344b4620110ed6579707b8fb581c6be32f18a5d12a8fa97fd13fe30f58723042baf6278c4eb540b8249780667585b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5cd5bdc5510ae34810db627ec197e6c5f
SHA147f5ba3d8081202ec15a99adab1ea0bf60ecb607
SHA25616095278fa352b0b4e16a8cf0072b97296a25ae5160ac24e453c775b46f5b4f7
SHA5122e1268e0664207e94c352da8d97ce294ce9623cbae3d0a3ac92fb03577a0f290b61c90c00707e47d389c3633ec99cac9c75a27f2451e301f726b8b5a11a2b46f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5afe08.TMP
Filesize48B
MD5c2a81bab484aafd5c931ce129b0b9818
SHA1069dcd66de37944d037a126b94b5cd8f29ced932
SHA2563f73b9090a96f3fa31f218a4bb69db4338ae67fad860f7c61ae6c84f1c396f66
SHA512f260f91f6261dd72e4b7b083407134c37d20df049556aa5bacaf512036854f3300aa14b82a634357249cf16278b8b9f17b0f44fab93a9290966e442764b393ca
-
Filesize
873B
MD53d24d3542d3c0cb6d5a3b3ef35a9cef0
SHA10c067697c522d4e8df9dce5c04e9e27f3c4ef11a
SHA2567a0c0ad0e983a3057e3390e827e9a32074c5c071067c5a213684f884b1f3e366
SHA512cc55a0a3fe2ec00c32ab668075b643882f44fd179ab088be6647f1d4a109bd67c3f31db1b7d9b9199719af9ef4e8565111ab334a4be5651eaba9da07047089e1
-
Filesize
1KB
MD58fb59b7b5524101fcd886bf45c6dad35
SHA18858b690364782fff46578f66500988495be118d
SHA2563308e027c0118130a593615c20d874d0a7032bc142f8f7d5b1b6e7a91ce2a0b5
SHA51238d50bee566220a27261dc2cee4b1dc35f7af855be313fee8ce311056f1c1de34a69d4e0d354ddaa363e9fa15de98a97d9f6da201844b0be5d32e69c97d14b94
-
Filesize
1KB
MD5b3c56c9e95a9636259ade7bba0d0f59c
SHA1f22ad2c005e49f7ef234d7105836ad02a38964f1
SHA256dfd7329857e852145d14a880b5933b58ef34a677139f15a0127f19b302bb862b
SHA512d7cf55e11649e92a739f2709f4ab2e98597d0b8b0d1ccd9987fe591327ed0b7467297923e21dd8dfcdd4f7d85aabe6fe59c1e9ff00e91cb685b13511b698899e
-
Filesize
538B
MD5ab5da57045568b7c42e8b52b92c126d9
SHA1c374a8136402af6cbdc8de64b87af9fda44f010f
SHA256f577c910e97fda41a0bfbcdce73997aca24fa1395458e43cb5e1aa31855f4576
SHA5127b7494a71a13324c11cf80b17c0c4fc5c95f15ee3c8c7ed2923cfe70f01b43e23f91450254abc84e6aa46aa48b1daebc050017ba1f43b7715f75e5518e1bd5c4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5dfc7ecc2457af8df7522600403010c79
SHA1a145dd3f87355768fd587ab3c1bcb5ea9a255aea
SHA25661dc53103933edb8f50fa608d911b8b2f8284cfc1676f70d52550235889f443a
SHA51211e8f8bb33f1a843aa16105ea43cf972adf81db02e836fbfa6121ae11b109196406653728da52bef8929110fb3bfc09be80c03366724b291726ac6165c101022
-
Filesize
11KB
MD5406c098f18cede9dacb1982ca66e094d
SHA1ec7e6126c298452595123c6f837c4a156e1c53ee
SHA256c148ac29be5b549a1b291abaacc3a70ca7a5e495288cdbf9002f9faaafea99d2
SHA512d0b0804b3a48fcc9a40520d1b15fb378722beb6c7f49707942c6101c349abd08e9849fcbab3c9014e42821e68ec0a2a97d134e4a0ed7ff317fd70a407502a992
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD57337b0b994c1336ad3114b3ac3be4912
SHA137546952474bbd61548adfc787c1edebb0c4338e
SHA2560610fecf0b2a1bb590d4d076961a538f77acf4b4bcb48ce5931fe4c14e869791
SHA5121678479ae740383c3b06b8f7872af244ca2cbfcfbdc719e21bd2f9e12926c257f9543666945aec61c40a7e5e64d3b4aedc01419721c6cd871818efb18fb398b9
-
Filesize
1KB
MD5ca69bfb44da428214e77cfce13890bae
SHA187d66b1c2dc5a70c33c43a77e65607464ab2eaee
SHA256e9ae9020f4ba234dfe7d2dfdadd6dd6b9b773eceb8e9ec097d65c6a97626ec5f
SHA512be2dc55d60ba2bc0dc2d6e98727f4f78778e1a6d154e99f2478d3865610bbedc96bef654834bf957b216f51d0d1a1d57f60e6bf2f8272ee9024d53b42e6f3792