Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 22:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.google.gg/url?sa=hXXps://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp/s/bnjsky.com%2Fwp-content%2Fupgrade%2Fbd%2F9859250356/ZWZ1bGxlckBwYWNhcGl0YWwuY29t
Resource
win10v2004-20241007-en
General
-
Target
https://www.google.gg/url?sa=hXXps://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp/s/bnjsky.com%2Fwp-content%2Fupgrade%2Fbd%2F9859250356/ZWZ1bGxlckBwYWNhcGl0YWwuY29t
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1652 msedge.exe 1652 msedge.exe 944 msedge.exe 944 msedge.exe 1240 identity_helper.exe 1240 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
pid Process 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe 944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 944 wrote to memory of 2800 944 msedge.exe 83 PID 944 wrote to memory of 2800 944 msedge.exe 83 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 2700 944 msedge.exe 84 PID 944 wrote to memory of 1652 944 msedge.exe 85 PID 944 wrote to memory of 1652 944 msedge.exe 85 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86 PID 944 wrote to memory of 5072 944 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.google.gg/url?sa=hXXps://r20.rs6.net/tns.jsp?f=t&rct=j&q=&esrc=s&(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp/s/bnjsky.com%2Fwp-content%2Fupgrade%2Fbd%2F9859250356/ZWZ1bGxlckBwYWNhcGl0YWwuY29t1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff38e146f8,0x7fff38e14708,0x7fff38e147182⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵PID:2808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:12⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:12⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15126176147252283433,3413779043809119170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:12⤵PID:3620
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3464
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
215KB
MD5e579aca9a74ae76669750d8879e16bf3
SHA10b8f462b46ec2b2dbaa728bea79d611411bae752
SHA2566e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
SHA512df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5bcf34fb1aa8b3be8d8672efce81e4385
SHA144fb00fa1e521f3710371fcf9ba3904d682eb7f8
SHA256d1cb183d9eed5f0fba2d2bffa0c39aba0f12e988a7079b66ed5c518de18683ce
SHA5126339af6f1ef735916eb6ed4a7c19660b2e003640cfb3a961be359ead53bf830c123ddc0ebf0f1d3b69308da9d44dd316e93bf3389c934299ae76cb892f8907ba
-
Filesize
1KB
MD55a00ecab8208517599e6f99e154b6489
SHA1ac4c04f77ab69dedda8aee0d263ff01e82619232
SHA256ee6f06fe33c8ebb8ffe46d049af21502799cece45a038c98d71a9b93b7fce3d0
SHA512cfe3c26810bc05cb737c066318fea5fd153ca150b09ec03286e779e5c94c6232761aeb93395e314a2d0050be51f41433e5590ab2c7a800c83a6c7e52c0c4d033
-
Filesize
7KB
MD514c6e6951e93f791b76b3e18fbba41a7
SHA1dfc05730766e7579419a4ca78293506ba8e2f6af
SHA256d1c2e7461a27bbef2638c13dd0881951d29452c5b0e6779470eb8ab90d528760
SHA512d871a5fa4a58ea0effad0e501e7c3a76fd3d95f936cbf520a7389d39300bb63ff994495f9bde5c7d68d8c8f73f131d19f1d96d4696e041b2a4d6e4752c5c2820
-
Filesize
8KB
MD5724a09f019c7a1d487a78a6ccf979d0c
SHA1f486c7e7836f03366cc9b5f544bba9c1326930f5
SHA25630639f827d18d1a390796b2c0081ba7f0945abf42e417a9d309765517f5288ca
SHA512e72da8a5f59bbc5e4a9aa5923a87aefd9764c785e5cebf1aed8ee8d62daaf40c942e483aea38d61609af2ebb4cf00bcdc30988055fde244645b45bda739c482b
-
Filesize
5KB
MD5d144eb8b1b03f150cfaf73fc7e630909
SHA1bcae35fd55f171da15d24b0d2e7de2d519aee0c7
SHA256a7e28f5446d5a0f0e3da09871873f9c9573dd5cfa00512daf098d7fc10aab7dd
SHA512ee233efc4f2ee19c20612f205a2b3cea560543fa5d201c421bf0ecf7683ad62706f037ad31028d1acb4705f4682efcee6aaaf27b71ebe0fc08457dbf14a3bfc5
-
Filesize
6KB
MD55f19b25d6fa9bbd35e53be9ccf687e14
SHA151d532d1d498a7f34cbd051437f54aa15e80a18b
SHA25684c2384abbd67fc5a12e90e4a118b2bf14bc243ce5407d529d15ab945459fdb4
SHA51220b6aaf578d598f34ad10e1e4f7102ebd4743ac8714e4296043846b43b0ed504c9b7addce194d7b8cb3149441c80ca0f595e34aea22542ba9172cf4334f28aa8
-
Filesize
371B
MD59090c6a87ac0c42836a627d605f04e07
SHA1991dca5b592253007b0a0bb1f08d0c92d4062315
SHA2563b565a22c499565b331cff0d3d9d128a03bed5b55de1f2bbf86b0a8ac31fa7b7
SHA512910cfafbe79c3f6a24a1b619e5977634a0fce01f32f7e41d2058763dd057a1b558c26c1a9e197cb40fc6ef43bbcd5101cfdbe57667b8f512e82dfc0624114560
-
Filesize
871B
MD5cd64cba0f062140859cd41b4b024a7fb
SHA17cdd0a3d27532981976b364ae3fc8d8d90ebcd0e
SHA2565ce57454d334f747e8d181c8a1e36ee78803fc334eec628d034d32169d76d5ec
SHA5124aae7ac4154dd5eda11622ed17e507fe859f4cd1a0faf65cc637573ba485d2a74c7130d9dea5df52d9650110ab87fde07dc565b837e47a5c5fd9392883d2ba78
-
Filesize
871B
MD55e726e71548cffcb6e88abb41e0cc1de
SHA128ceb7a79db2d3a056d9ee9c5797b15faf786532
SHA256b5aed5b59e39f0218d0396dd37fcecf8498d1412884ef6648d795c9b6ad07a24
SHA5129e29797204f86546b341e9817900fa9b2e33eda738bc6f1d0e05a98aa7808bfdcb9044d12e8f73dc463b05ef82dcbb34efae77be9c635b10ace04a0ddfc2d2f1
-
Filesize
204B
MD591f882e92ca7a55def106f7569a7727d
SHA18488558f881d274bf0c70ba1ee0811ceb2768f8a
SHA25671c12e9bfdd6974472a9f6883694e67f21cc27d5fe49e2e39eb87d84633a0a9b
SHA5122af1eba76b864945855c086915c37a04217b0c6e10ea17e46d9ad011730c1d8db211da315c952ff8b104b028224377c962f2805ed9391e1bd9e965b02b17508c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD565f3deafa3dc146f247f7ab980340760
SHA18ac29483d30daf0409fd4e3654d307cde3f85312
SHA256e2d339ff6c062544d581a444208394ea4b41fb60887b52b26c2f4de0d6f18748
SHA5124d63d9725ec7b58a83676b4c0562408a72d436cfc61de112c2439b784ed566ccc97758d90c46b69548463ee3909960e5531d6e02cb06e4c878410ad14e019c91