Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1680s -
max time network
1770s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2024, 10:02
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc 253 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 2596 msedge.exe 2596 msedge.exe 5116 identity_helper.exe 5116 identity_helper.exe 5232 msedge.exe 5232 msedge.exe 5232 msedge.exe 5232 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
pid Process 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 3484 2596 msedge.exe 84 PID 2596 wrote to memory of 3484 2596 msedge.exe 84 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 2380 2596 msedge.exe 85 PID 2596 wrote to memory of 1604 2596 msedge.exe 86 PID 2596 wrote to memory of 1604 2596 msedge.exe 86 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87 PID 2596 wrote to memory of 892 2596 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rentry.co/teee5s6m1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef0446f8,0x7ffdef044708,0x7ffdef0447182⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:82⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:12⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:12⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:12⤵PID:5148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:12⤵PID:5156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:12⤵PID:5164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:12⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:12⤵PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:12⤵PID:5788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:12⤵PID:5796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:12⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:12⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:12⤵PID:6152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:12⤵PID:6160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8512 /prefetch:12⤵PID:6296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:12⤵PID:6372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:12⤵PID:6380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:12⤵PID:6516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8996 /prefetch:12⤵PID:6824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8812 /prefetch:12⤵PID:6852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9456 /prefetch:12⤵PID:6928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9672 /prefetch:12⤵PID:7000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9824 /prefetch:12⤵PID:7072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:12⤵PID:7148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8852 /prefetch:12⤵PID:5336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:12⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:12⤵PID:6432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9912 /prefetch:12⤵PID:6440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14186601761615776157,4901850773603502715,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3552 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5e6bf763a9a761319c44da9736ef39028
SHA124eacb427d55b9b51112fd8c2903f7ecbc3f2952
SHA25632179101cc2037f7a9bf6d78a6ab426f24bc7509e67111445aa7cf5d070af0ff
SHA5125d9f9c370a7ed1d8b204fc71e1f734561289df954780f8b5b1279864bc63f6b919578e19c5a3db36e978346a15f9251152fc5f3dc9e6c8ff66bf3208f4414bae
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD5716d4013aa798e5801064bcebf7e438c
SHA183b0385f3756f032aea2a13dc61ec33e9e1cc4c2
SHA25603544a37de6d3a1e98104d0ac59df2218bdba579cf9386b13798128f748fc4b9
SHA512a62405ad2781a1db1a4b2e659f8fc3ebfce47cee3f7a43e8507c00d8ed3eff053e1609dbac419df0e4e20c62649761683c395072fb5711a0e783758a4830a924
-
Filesize
8KB
MD5e06bfd5956f22ab1ce31d79efa103c81
SHA1942ba4fd8eb28a63618d1bd7d9e841149290069b
SHA256ebe36dc7d8e977a8f8a289586c63daefb52ae9ca754ca5d98360043e724a014b
SHA5129feceba5a3bc85021ccc80e751ddabf468b7c67cbdda10fe0443b2f82839f633c3ef298bdacadead8897c564c2ef25caff3cc47873186bf16da374a682c8ae56
-
Filesize
5KB
MD5a06440d5c2227494ffd8a0585fa4329c
SHA154e6276578a1d75511a95cad2cb487d9e0bf90e8
SHA256d2365d95d0dac4b0bb4f74a55e3217e8b7ea7a97a87dc4fb09911d76d3909eaa
SHA51280b964672343cc8e39efdaffa3fc164ecf5c247bb447ea1e44ddeaca64738d53501700d1687b141a4af8f3f88b6e56a8bce6b7378c874b6570fdefdaed2aceba
-
Filesize
14KB
MD58abb5403e4d6da0459e43d6943e9a140
SHA194a505e723ca88026cce999bc17cf9670ecc3c5f
SHA2569f834739fe5ca23c1cd9ab3f55f28022a3965a19234ccaf7374b4dcd79964ba6
SHA512784445303852835bf234ebc6d4ef7f661400036d141b593800c3321749afd8a594855e10462a71e8dfd7fa3435dfcd1de1f4d20a57c14e90c55d691c4e2160e0
-
Filesize
3KB
MD55a01d5e9d8da19954e60c7ba3e2fe1bf
SHA16d7c551e2fc8fd62d3839e642d24338aa5a6b402
SHA256a6c39f6354cd30a0acabf246276dbada2b4e15d820ba3f9b2158fc51c768b171
SHA512e3ec8ae58406ac0ce04f58884498ccb93ba435b3cf9987557de8bcbc1f31d5cad977ead1ba3a3e15e805ecf5a4e5021032d0e5ba71ff1184a95340f8d0b1e4df
-
Filesize
3KB
MD53112f8cc6f772929e72064cd9b56c78f
SHA1ce8feff407f7f19137566710246b4f167e5833bd
SHA256c3a6383d1a1a62ea3e09f7bc2bab8c4fc0ae9b87c8d3f3e1c61d281e0b502a91
SHA5122fcfd7e532f005a1ce96a79c193be58fb7a079bcde63bc6f57e71095664b3e3f7fa1c51df0571604e72d551b50fcb2b2fdc647c37b299f86f3beee3c167088c3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5952a0253162f869709fe43e31bec55f8
SHA17e49ecd275bdb5f566d2f32966328d6ce759bdf5
SHA256a51d2faab28ac9a303ab1cb91c504e4b9ba9d902c8d356651a2a2586f45ac321
SHA51282d6782246d6976239286f1a39d963f6c2ddbc2b4b5a38932a2d4eab0ef3a2d3b726327990e2a9ce032d8dfcfd95f4c2127d59bde57b0ed517a5d553a18aae12