Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/04/2024, 04:19
240411-exqb8scb28 1Analysis
-
max time kernel
289s -
max time network
298s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 04:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.mediafire.com/file/61yyz8mjn63l3z1/flashplayer_18_sa.exe/file
Resource
win10v2004-20240319-en
General
-
Target
http://www.mediafire.com/file/61yyz8mjn63l3z1/flashplayer_18_sa.exe/file
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 flashplayer_18_sa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz flashplayer_18_sa.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.f4a flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.f4p flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe\" %1" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spl flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe,-205" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.swf flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe\" %1" flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe,-202" flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe,-203" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe,-204" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe\" %1" flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-817259280-2658881748-983986378-1000\{38A62F4B-626E-4C94-B013-9A2A8A3204D7} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe,-608" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe\" %1" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer" flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer flashplayer_18_sa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell flashplayer_18_sa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\flashplayer_18_sa.exe\" %1" flashplayer_18_sa.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5128 msedge.exe 5128 msedge.exe 4644 msedge.exe 4644 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5836 flashplayer_18_sa.exe 5836 flashplayer_18_sa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5128 wrote to memory of 5680 5128 msedge.exe 138 PID 5128 wrote to memory of 5680 5128 msedge.exe 138 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5988 5128 msedge.exe 139 PID 5128 wrote to memory of 5960 5128 msedge.exe 140 PID 5128 wrote to memory of 5960 5128 msedge.exe 140 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141 PID 5128 wrote to memory of 6080 5128 msedge.exe 141
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mediafire.com/file/61yyz8mjn63l3z1/flashplayer_18_sa.exe/file1⤵PID:1384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5712 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:2488
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4680 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:3048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5372 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:2960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5916 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:4916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4176 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:4736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6136 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:3004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6172 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:4420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6444 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:4008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=5792 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:4156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=6720 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:2208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=6908 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:2084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6920 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6704 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=6096 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:1328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7708 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:5068
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=4600 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:5144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=6340 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:5216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=4652 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:5300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=7800 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:5376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=7620 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:11⤵PID:5544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=7596 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:5612
-
C:\Users\Admin\Downloads\flashplayer_18_sa.exe"C:\Users\Admin\Downloads\flashplayer_18_sa.exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=7880 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:5616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.92 --initial-client-data=0x240,0x244,0x248,0x23c,0x238,0x7ffc70e95fd8,0x7ffc70e95fe4,0x7ffc70e95ff02⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2244 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:22⤵PID:5988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:32⤵PID:5960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2484 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:6080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:5476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3648 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=2248,i,17260415845366816605,14172144706796894783,262144 --variations-seed-version /prefetch:82⤵PID:4444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5fcb8337b17775ace3a6e045650935b0f
SHA1b011ce48258345411c28447d687241e9c2149044
SHA256def50f04645e03090166f6453692c44187f56c3686a1bcf410d817e76a88f29d
SHA5128faef75e73a4b1016a1af70987251c124943cca69aba694b39310aaf0bff9dc24ef86e658b0539754dded4d087f3ca5b162d9025831d84fb331a505bdc3d0e94
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
15KB
MD57dc1ebfeecb021f991b2d1a12641c8f6
SHA160f7a8e15d6300d460763cabc7e9bfb441b1158f
SHA256c1fb1dfce613bb04f51e2def8ada57fa1ea22b58bd2843a5f41eebd6be7bc0ec
SHA5129cddcc67783b15ae8ea8781efb1c1989b44c48f7e3359888a0cf94c3d404ee08caba7b19eaf580e42dc2e90f2fcf8c3818588946db3c67c4b17660cd3e2cf08e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
15KB
MD56efe6482c0130c3d2e9d01077b4a7556
SHA12198a1c8759a024866c2e412da86ac81898aa6b3
SHA2569b0308a714711f66710c200d8bffd0d5ad9089b709d5ae2588b9f9347be26443
SHA51247551e8e71773b074b4cb398f0746a44dbf4c380020768f1089d2c9f5a1a8391333d478da233a2ae888496ff7e1e8abf36f8c1b3f681bc063be1597914d39b5c
-
Filesize
30KB
MD55980a9307e620de3dce25e5de086625d
SHA1389181e991c3e3e8501516a0fa0dc8546475bea2
SHA25644f5e1fa1d3ab763ff6cb6354b9da13622d21344dda4ba9893932c6f466deaaa
SHA5128c110e8ca4e7111e3a45520f08ca4e02b0e9aa5383c3cbd353acfbdf9cc2a1cfbbec19e907ab1001b2c81d5365799dcabbb69b42e1e34b700b7ad5acbd538976
-
Filesize
78KB
MD5d4e0190b8da890224865aa0bcdda8b82
SHA12b940d3e1b8b0513730873c27f7fbe4c1d90042c
SHA2560bc576b13e98fdf0da9fca121839c39cddddb2cace55f54929ea880d921b4269
SHA5124e87c40b3931459322735c59c4c96360d93cd006ffcc6e03fb4d1fc61dd43cab19a98be11ca6f940fa1cc502f93fa6087577e00ce7a590d7f72fac659fe5167b
-
Filesize
68KB
MD5238ea955a9534814a26ce8eebd68a622
SHA1d7becd56d9e3eefbed406cd6b8ef2a86254ba023
SHA256a3e0f0045d44eb7d3fbb5b65616c3df6064edf40c9f663db2b09718f3aad5323
SHA512b8617cea7822b84f92ea61c0f3162ef31e87da446f16f1e704d045679d81cde9378c162009b28a4c394c6513fda5401483edfc60601c775010cbc2c356b9f8b0