Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe
-
Size
896KB
-
MD5
1edc0b6e9cd19e499dfa1384b6b0d170
-
SHA1
79804ac0aa18b423b97449697fe3f7b07b8d3ba0
-
SHA256
59abf461861b9f37e82e4c1bd05ada6764335ae3fb7ee7b9a4d219969921e1b3
-
SHA512
f94b588e3e4d3c4c5ec9852e4787fccbae06e1b30c5619d768a5afceebca088d8cda3ed2f68579ccf0d67a1cbfb377abd1293e867788c921d2f77b91597d696d
-
SSDEEP
12288:fqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaMT/:fqDEvCTbMWu7rQYlBQcBiT6rprG8ac/
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 2660 msedge.exe 2660 msedge.exe 4356 msedge.exe 4356 msedge.exe 3964 msedge.exe 3964 msedge.exe 4784 identity_helper.exe 4784 identity_helper.exe 752 msedge.exe 752 msedge.exe 752 msedge.exe 752 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 4356 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 84 PID 2864 wrote to memory of 4356 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 84 PID 4356 wrote to memory of 2276 4356 msedge.exe 86 PID 4356 wrote to memory of 2276 4356 msedge.exe 86 PID 2864 wrote to memory of 4896 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 87 PID 2864 wrote to memory of 4896 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 87 PID 4896 wrote to memory of 4800 4896 msedge.exe 88 PID 4896 wrote to memory of 4800 4896 msedge.exe 88 PID 2864 wrote to memory of 2140 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 89 PID 2864 wrote to memory of 2140 2864 1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe 89 PID 2140 wrote to memory of 2680 2140 msedge.exe 90 PID 2140 wrote to memory of 2680 2140 msedge.exe 90 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4568 4356 msedge.exe 91 PID 4356 wrote to memory of 4928 4356 msedge.exe 92 PID 4356 wrote to memory of 4928 4356 msedge.exe 92 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93 PID 4356 wrote to memory of 3816 4356 msedge.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\1edc0b6e9cd19e499dfa1384b6b0d170_NEAS.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda0f946f8,0x7ffda0f94708,0x7ffda0f947183⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:23⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:83⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:13⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:13⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:13⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:13⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:13⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:83⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:13⤵PID:5436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:13⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:13⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:13⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6087419593504207996,12356128381086545196,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video2⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffda0f946f8,0x7ffda0f94708,0x7ffda0f947183⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12084839536149391006,9397999245767665417,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:23⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12084839536149391006,9397999245767665417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffda0f946f8,0x7ffda0f94708,0x7ffda0f947183⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9650678836184817616,8392473472025268883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3276
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5b516e3bb6b522cf07e0248df15878ae1
SHA1278443f553437f6095ffe29b06b5dccd7ae1de69
SHA2564a923aec33060adcd59c646091a496f8c8002a664277a9a9d443c06e300539ab
SHA512292f820843077bf32d78d6f1d85d9b6b7b2324fecd774ea855198036f6e99de181b7c3c852367b50de5d146e95816c9d60fee81c0d592e0aff8c2da435037edc
-
Filesize
2KB
MD59c0d2d0213209f81caf1e912c328009e
SHA138757feb67c09abfe91cd646c19e1ab24e0ef777
SHA2568a7c57ce2c9f3a66c8f830f28d71cc53aa7555d707bee46018a6a7a1ebaf9fd4
SHA512b1d1022d51b58b649df14c118a4e84fd94a9c7a6f5c51d61441adf35881067eae67bc27799409119be5aad37bd32efef62588a9b39fbd3158952bf9725fcbbf1
-
Filesize
2KB
MD59a526fb3f73178766836b9cc4942ffee
SHA1231a8c6fb052811b8d863577e5efaae4c6aacc73
SHA256eec9bac9d58073473e2a8abdcdfe802149f2f7077fae8b42efae0ec21e080177
SHA512327c73e47f2351f61c687cb49274f045e2103c64c9f1a7e3bb003dc6acf09c2db47568edcd317162e426219bd622854dde27a22186eafed87d0a07a6dc2ba6af
-
Filesize
6KB
MD5df15a7f18a053fe0ae3607463270cfaa
SHA18373329b7e63e866f24072167c25f9a4be207c78
SHA2563df261bbfde88d5b71d7b36663098af6e79490fde1cb6fec4ea91ebb21bf7173
SHA51214e052bdb49029dd847867be700b7b18f404ed88ebd322c792ded351dc84053f288d733ea6a952ea697fbf63173f1e0f3bc86b414ce51366c0ef720eb486507f
-
Filesize
7KB
MD5da8fd6e56487635e83f87acfa68daede
SHA1074523e9552b8b45d7697a3d52c3dbb37edef139
SHA256194fe8636e7ecacae167d1460e36e8d2ecb1501321e25cba3b219c8373a27df2
SHA512c7b201440a42a6b64ad5b98a023a4261a539b66cfa9b10c539ce3f1071173429845c14f75e7de6a5d37dff1cf56cc308700998058f66cf52847858add56d00c3
-
Filesize
707B
MD5cc2b656d0fdab043f1ab22b82d6c228f
SHA1ba135553ddf1c3e50892f2fb57db913820c3de8e
SHA256f84a1c797481704d26466705a0aae7ea1b736da51dbe31a722d297002ddf0867
SHA51204ae516f6ff006b56e694795fa488229ece1ddc4b5a3763fbd80e3202c7d70153e92521fe7e751837b58903d0c8430c3b0c56ddd5ac2c85bae2e3f61fd68450b
-
Filesize
707B
MD5df9ef066309daa288de8593de74c5f6d
SHA1b76d3a3b0453acb4537aa0bd5f6c642789d4dba0
SHA256e9d3f88e218ce87da4d347d286e20c4cbf7334cf7923eecd209f07a14976e3c0
SHA5127d1a672155d0a22d056e80160c06039ccf9d1fa8c35a6c66e2d90710751f9240d44474eb51d36b737f6334f4b37fce5d7e9fa615b0425abeced96aa75257bfe3
-
Filesize
707B
MD582b488228f5e8d7f064cc22f59704cfc
SHA11f232f756d262f96e524b4310dd98564d9a33a88
SHA256e46ee25ce663e1d671bd633f5ad8409e77b32f695f02b407a4ebcde5717ce118
SHA512293e5205f4fe6d23ddee6a12391ed33466b2cd07cf1b332f9fcc536e311e8374113ac17c32bf382eede46a274e784e59658408c8f029f682264322578cb02bde
-
Filesize
707B
MD5b6b27d97a269a2a620114b7cc5d41736
SHA1d21bd4aa07ba7d3290f90440475dbde6ef6b96f0
SHA25679c4d356fbdc76371e1d216627b6e336bf8d34c9c05c0880e37d55a32deec31c
SHA512d07fbf3b2bc901370cb4320a144c978ac44d8cec857c6467b6bddc90df136e7de39115d4d9b6d2516b4b7d40d4cc0a74e9e4f6cedac17b67676b5087612b3afb
-
Filesize
707B
MD5f374f8b898f0d8336b627cd7eff1fda7
SHA1825a0a6e1e77481d9704d29dae767df0ea76808f
SHA256100286253eb5c5e2f57a809ca26196dde5a558bf07a3316c18c1eb9752bea29f
SHA512230cc9eb7613125b4e1ad6b8a7e63b4d003d963841ec414b4eb7f5db3ba1ecc8c9f31eb80880fa09016313661a3ac927fc850ae0843255756f76d5498bdbbc82
-
Filesize
707B
MD5f28958b4d381d7ada471c2a00c863893
SHA1c8eba4eebb3cddbaa4464adb1aa0e881b0de8fe2
SHA256b1e5e9d7dec269e5a2dc617c6f5d556961fe08b65cd9f12f37be61e2f92dcc8e
SHA5123b26e8eec73694a354c0b2c4f6ef1c5375c80bb22d1ceaf93cb4ed00fe5b82a5dd542353f72beafde298e4d02613c3000feb69fb92fa77ef2c7b954339dd04f7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD54f96d3bc7872e0ab11db0d46d8c1d1cc
SHA1b5b3cfbc193e38b845db2183a6dc3822dae3883b
SHA256ab2d14f68a3217d583e975229a6f4d69f6e47419fb973160200d02b04773212c
SHA512a78a0a89b66452a4cdbe997307ac6125ff754d60a3e0e82d90b4ed55d801b67cbdde7880ba14961b84cbc45c510342cae55e7e90579c0526ac1bc2e7155c9399
-
Filesize
8KB
MD597be93b9f4f63ae54ab1bc20cfa280b9
SHA1cdff93a664da5b22579ba7e2262b2677ce02b998
SHA256585186cb8d820595a3f79edf249a5edcc013e2d588992e4925fb6f701601231a
SHA512f8af51a4953aa5151d3897c389fa1def504f70094456b797455e010adaf16e2f94f181fdc13af464aafec16db05815c3cdadef2799108c79fba2d52841f8c238
-
Filesize
8KB
MD5f2700a6a1f0d39cabe2e6796a3b15942
SHA1cd4fce7bbbee25c2664ea3cdff8e6121262255bd
SHA2567503c038b5baba12e9c41cfc5bba45060c9aa6025ff3baff568e33a81fa44ea5
SHA512f6682552d92a1262f10f74af81701c0e7be882543b2a429dccbd5eaeb0e55ba0fbd8e548c202de7f2c6ee1d3a05419701f08cb8efc0335580ae7189acf5860cc