Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 17:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://getgamez.net
Resource
win10v2004-20240226-en
General
-
Target
http://getgamez.net
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 736 msedge.exe 736 msedge.exe 4872 msedge.exe 4872 msedge.exe 2432 identity_helper.exe 2432 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
pid Process 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe 4872 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 1916 4872 msedge.exe 87 PID 4872 wrote to memory of 1916 4872 msedge.exe 87 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 2480 4872 msedge.exe 90 PID 4872 wrote to memory of 736 4872 msedge.exe 91 PID 4872 wrote to memory of 736 4872 msedge.exe 91 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92 PID 4872 wrote to memory of 3292 4872 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getgamez.net1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb90f246f8,0x7ffb90f24708,0x7ffb90f247182⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:12⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:82⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:12⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:12⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:12⤵PID:5384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:12⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:12⤵PID:5760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:12⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:12⤵PID:5172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:12⤵PID:5508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:12⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:12⤵PID:6124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:5984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:6008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:12⤵PID:5892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7704 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7932 /prefetch:82⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:12⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7908 /prefetch:82⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5824 /prefetch:82⤵PID:6124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,6904277211252683062,5253404020653436607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:12⤵PID:5852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4152
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
Filesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
Filesize
27KB
MD58d327694df3ebcbf19980f6553fe85a4
SHA1ebee1e2e1c18a7df8be0cae7981770823e4db97f
SHA256476cdac0e6b6f629fe3ef9716991455b515d87dda1651c3be37df4f3d3bc9a36
SHA5121fa16800389256b0a70a4f519fedcc658ece5971f07c363bcb77b7267b1e9c3991b7f74be16db6223ad3b442029e4014e46ea7c87719c25f795204d2967056cc
-
Filesize
49KB
MD57450bc3c7420bc5c1de8a4b5ec2d0cef
SHA1583a1dc7f6b2750c0749633ad589442c15676267
SHA256eb210b6abc60e5bb93d2a62f6467a74e9c7ca917dbc43e64b9125c5f2af2224a
SHA512b4cd6182d040e971a25bb64ddf32b817ddd80df0f18363c9ed373b246f571f421014cda6fd5fd468715a183bbb0ddf3a62a4ba3f78889489d2b3344d7bf596b3
-
Filesize
39KB
MD5f3bae3b15f77db74cd275fa7a488df45
SHA185e480d39c687b19e52b489026ed2371dae162bf
SHA25654d917679905046a903918cd3f57c3cfdd8bfa8bf6460bfa58b47506acee88e2
SHA512c438b79e3dbbb4c74b6f6471cb429283f2347b2b16176fe3b72a3ec8351064542939bd1ff20b7cc94e8651499deaf5c00f91cab3dd091ee35d4b5340c4127ef0
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
29KB
MD53bca66397f0e4b3861a1ef5db9167c67
SHA172e352d710edbd5f1ceeb81ba64b5ee8b17b8644
SHA25633fe45396e433acbab55814623ac74c9b61084546892cd407fb19d61a9810e71
SHA51201249e3aa63e77e15a1df025e1de2c6ac10385db6a5dc1156de605829a3551348f948b9a0ff5c6203ee21f2f4f378f98d9a9548d8a9798e057f8aee8ed47d801
-
Filesize
32KB
MD5ebd94e7766ab1038ebc2885064da3471
SHA1f23e91fc975dc8377365f5b653300db3c52eff85
SHA256a90132d0c3ec0a1cd36bf50e490740d1562bd1c836573116c5dca932b25c9a52
SHA512556e154c6e95b6063d8f41c0d507a2a7f426ad8ced09df7bb6a4622e81326c675deed1316768f77939eab653806b972eb5bb08ee83e03f74c3a050ba25792bd2
-
Filesize
75KB
MD5af7ae505a9eed503f8b8e6982036873e
SHA1d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
SHA2562adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
SHA512838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize648B
MD527732a62f2d24b689c41701ba7d8c9d9
SHA1a2f983ef2353bc0d194e8bce0f28b018b148beab
SHA256a0d82f22906ec0e5912410934b699bd6d7f28055676c4c462ce46016d5d8d96b
SHA51259f80d24e2f5f45160b2991c8b6c2f624e584afd04f057ecf541b2831584bed85d1205d5b05f5ca1475ff444b3a381b3dfa300d30dc2cd91eafbfc4f87a3ebbd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wheebsadree.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
3KB
MD5522640ceedac31823e00bb44968d2a2a
SHA1a74908d0859ee0cc427d70d7f1f8edb5bfef9c3a
SHA2565a4e73882454ef64df4136cd505c3823b50fe239a995053cb6c81894219da2d7
SHA5121d8854cf4939c8929df0ce5a0992a53f5950a1acdcc56c559cd1302fac7d700166674c6260a11f2d9ab2f6630dfd7b6ca4a3d5b12ef56e6a2454a9e8ca5092ce
-
Filesize
7KB
MD53f3c9340d774c3c9969356e073715b35
SHA10d67333a5bd4d070e5266f93fa7dac66e9112f71
SHA256ca7bcccf422be7f08a29397e852a17230be43d410ebdb51809434883456c4372
SHA5125369d8a08fb00f74620970f82dc46a3991c2847bb8cd0a8421ffeedb213e52d46ac0b06782c8123171c98ceaca4452efddc53dca2a552cf417d092bf96735165
-
Filesize
8KB
MD59c3b14701be7ff693c464b378bdd9fd5
SHA15ef0f05a11338658974288f126dab84b5bdccf5e
SHA2568a88f354aee94b0a9f9c37000c68dfd0c71eb097d819a8729e2d08ccbb9435be
SHA5125f4966b5d6e5d9887f0f86661b24b7042d1d0d928644d8d8b7fdc5dc1ef93f34fa229a532d3a1bb9da81002ad4f9ea94bce8a144ee6cac006ec5370dbfead6e8
-
Filesize
9KB
MD5d94acb44b7baaf6320b2a6265f498a47
SHA1eacc5011c6cb0a4f6a5e031af48aab04fea4b8c3
SHA256392d5988f4821f886872e118ec6ea07f8f37362d2b64738832a4fb1b27caed9e
SHA51264db831ed833b7d9591c82da2478e663b39f386f9150e402a5f3b6ca4fc0638055803b32f76b72ebab47f1cc03a380195a2b93df4476e5415469ccddf6984a57
-
Filesize
10KB
MD52a0fa451d02a8ffd346651b0c9f4ed18
SHA1e54d948f0435bd0369b3446df6afb496d4f3c923
SHA2564a863bdbc28d499752222b4aa2145606f22befb9ba5989c29d89d77a82b51fc5
SHA5124bc1d177b5d8017f8eb909b3d0fe1f62b35487b8d3b37270621e34e3b34ae80ff56b61b4c2048d2cded002df3b0144e9629e01aa9e016831c72be4012c114558
-
Filesize
7KB
MD58543a80a5eec0b0586b61117fb07410f
SHA16cf267be032ab7da0c6c7f25dd5def16e4016e8f
SHA256f3dd8311474b7b6646ff4ea8c4564a6f7f6461f74bf40a63227245ab8025814b
SHA5121590af845c9f2f43df12cf2d181ad3a37352032d72dff7d16511620d1ef085a410962f565fcf90d6c03d0e6df29ca7108ec1f8cfa74b0a47c4c0b270518b68ca
-
Filesize
9KB
MD5e7f92d5e8fd4dbdc5dfd350cbc6c8b49
SHA13b344f412acb3488e144e643e883ee0ce9d2510b
SHA2569d9472b82f77a5ea4ef388a8707c3e0c2e4653c5ed8604b4a818e1d816a9e254
SHA512c5a623eb22ba94fd8970f840f3d580fc4682f31ece4743618f63e517437ed7303b280b7e5f1ea8d2ee60e0bc3e0aa6c597aa0e672dad16ad69b6af9274c6c07e
-
Filesize
10KB
MD5104c1f909eeac6297d4b5f6ead8b440f
SHA1898c9daa3a26b60e10d829573377f0b8017a8b53
SHA256059621d608143c86eb131701f1186e83de9986569dc05bc1cd952d982ff5ab65
SHA512fcda1d82328948b4a4bfc3dba3cb5feef10a75543939d6ab9f25e198e1aa5eb5e2275d8c68058cdc20c4d05f0fe99bfbcf813f65206add072695d88eab568c21
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD501d20f2cb49197588da38c18aeb4ca31
SHA16e8e8a1ffc467a4827c1ffd8a34639f03669dfc3
SHA2568d0c4679866f6432bffde335f8fb11a53d2e43c1559a76760efb0e639daf47af
SHA512b4d08cc04a05b003a5294717249f9a764f2e51712dcec903216c01ab66259981f3bf7c53ab560273acd6022aa6aeaecc7efed52065bcd54310d66e3063f755b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD5b66a09a583c63bcf4adf6662e3688450
SHA1b04c4ed6b48f16b9b33c56e640c1c62984bf280d
SHA256e63c64aa1a98adee5d6a5db6f9dc4d94a8c5ce454d4b9717a4100a477dd95ea6
SHA5128ea9518862de335dbfe8dc69e692814156cbe87b7be7b964b2a5f37a224f9e79aa659a1e55df8e9f0b3945152d17250f647ec42755b4456de2b5f7068b41207f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5a96d5d95d7ba960d5bc5bf382debb15e
SHA1637168ce3eee551ed8363635d8a3dc15f77303d9
SHA25673f95d48774df9d959e512af49b5f6905bd2585d3385b69d772f833ac7e8cb79
SHA512963e51344b8e7f706b88ca4fbbc22ac05e8d1aa6eb5884fe1d7a25497324aa4df2f7391505f070efa014c7927fe9165da571d9ba1684422dc6392fcfe4e92bee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c592.TMP
Filesize48B
MD5786b53df264d7c6843485e4139ab7594
SHA1f2a60b7f5c46368c08fad264739fd39c09b92d68
SHA2568d57251f4422793e706ead8dabfb640bca7c4e1bbad0da5fc9c4737917af4831
SHA512f49bbcb7bce2263bd8c57775af9b63bdda6dfaaac8d798e47a3ad4fcfc19c937606b9d40093648f410d2ccd656554a00c99585ed04d9532e780478a9ead5ac38
-
Filesize
1KB
MD59de94c28c74721367416323b3eb11406
SHA1f03ab127df768e022546be2eb8132346536285a3
SHA256f37ebed0f632638a04a30ac7e2ff93526975217836be6715c8ae8a87db525d9b
SHA512d6d41ae3d747fceda1e66a3f6ad316024f595998ccae860018bd36e171df3796ba751f40cd66a146fb30ac79b9ef89e4c813685b3b221d1de4ba360bd59d312c
-
Filesize
2KB
MD541b779e5a1445985448680934598419e
SHA1454cbd80d0354fa9425a5d5fe1b873107aa8daca
SHA2561ad4a5fc0935d317693cf1ee2dbe45d5d37057dfd6520d905ec3ef6fd391e18b
SHA5127f9b8562a96c543873db598e842266b9106b3d485842c97d2d250adb8976d363c9c161320843aee33928c0b8af13cedd6de3f0725472737a38538a4eff5b740f
-
Filesize
2KB
MD51190934b95676bcd042165afca5a82ee
SHA1fc99fb9ee58c81ba375c092e249ce30d22b99819
SHA256e7b78333e41f01f8af23b4366c19b326e12b1decd27de022e3afb2210ba7a56f
SHA512373ce5736d8c93678a8059531a014869df2d6aa26249f377ea6c94c2b64d9525803fd3c03c88c41cf3e8ce975f16c7b6bf671c9204190e0d990b50d117bbb2ee
-
Filesize
1KB
MD5acd1bc25709f6f1c4d26b09c4a2c54b6
SHA1bb6fb6ec34cb7df8754bc06b30f6f5b76f24074a
SHA256d777469fdd091694d55a8f9bcc90926716153b57a22540d71d16a7852954a9b9
SHA512fc88ee70502547f447bb3381555b84ea68a6c66c7b036d9a5e1979abae0ffa39031af1d99a209639bd16f4b6262738094d8703865c00315fcc745e2a9c70ddf9
-
Filesize
2KB
MD5db8aa81edf98054874f6608629c16703
SHA10ed74dfdc845ee5a89dd21d4c29a6d05a3018502
SHA25694dbb1979dd4760220d7c53caa8715c9f345ac6addbfc7ebfa89180a136ca6e8
SHA5124157f50aad4a9f478bff8600a3059228ece12f453970681d5c0d48d203b10b014d2cbb558c5835d5fc7372c4fbae892ea5d5e5d14cce4915d73a616dd163d240
-
Filesize
1KB
MD5ab505f2435e547ad2af07a956ac1b47e
SHA1e112ada46cc222aa9ad5a169c977674a10c45a6d
SHA256a308ef549fe8311523bc65d744471407e9177a3f6b19406f3455c27a48a6b197
SHA512d9991f46ccf96f31e69df54ac27a542dca783b0ade80ae8fc8e4dcf2f1bd0e7f5a8950c0c292bd16cb0c317090b461bdb8fb15b568381546839210f42ccb8787
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8e3aa97-fa30-4dab-ad66-95ae2d0d5531.tmp
Filesize6KB
MD572a90e77e69ebe2f06c72e176093325d
SHA190966ec08cda4dc96ce59dd60881275201861d33
SHA256607f2785e6b0396fb526f5ab0975ffc660f97a387dfd9aa6b50c62de71654eb6
SHA512676a281c54634fde70e0805cb648cc8e5a5b71b67afaea40cd5e2a0d7e420aa071002b02828a17045ee6763ce8ff8c912583b68ad3404d5ea0f5cce28ab9fe14
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD597681cc42403273adb7a981ea3d2a16d
SHA1fef065f897cdbc3d43f746614cc3b3ef66e640f1
SHA2566f812ca9324e96f39f88da52b272492d511de36a3c52887e7b800c1a7aa5764b
SHA512c230fdc36974f360d3d614685eba0c3d8bff3171dcfd48bd3ad276dfaded1e6390cde1511b66c4de68ac1ddd0d15bede5762955a9f9a5583aa8ab7068ed18f10
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize12KB
MD5c7632539273f9c935fd83b86fdd39de4
SHA17821085888d994fe9b4a53a7fd2a05b01ffdfbd5
SHA256a6708e8fdb68d4fc02df866a02547fbed160c0f2c54c370e2214d8a8d49dfa2d
SHA5121856f5ab09335d67e427002e1045e4cd7bc3e5175639006f662970877e57653a3ee1c9ad09ece9d7de793682753bdff04276f82510e21c38419099c4d89c562f