Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2024, 04:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://jolamar-my.sharepoint.com/:f:/p/jill/Eritfuq3V05IkfCu9NaKlMQBwsWpnFL0ntDiLN4HJgb5Ww?e=TmcuAQ__;!!P5FZM7ryyeY!XnLv9liFBA_uTs0c8LvdhZZJWfuW0qGo1u-DvQmun0HQdaT0Td_j3dvbe4VfcG0QWlSHtpClrmJ1pgul6w$
Resource
win10v2004-20241007-en
General
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: GetListUsingPathDecodedUrl@a1
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2768 msedge.exe 2768 msedge.exe 4440 msedge.exe 4440 msedge.exe 2332 identity_helper.exe 2332 identity_helper.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe 5472 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 2100 4440 msedge.exe 84 PID 4440 wrote to memory of 2100 4440 msedge.exe 84 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 4396 4440 msedge.exe 85 PID 4440 wrote to memory of 2768 4440 msedge.exe 86 PID 4440 wrote to memory of 2768 4440 msedge.exe 86 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87 PID 4440 wrote to memory of 864 4440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://jolamar-my.sharepoint.com/:f:/p/jill/Eritfuq3V05IkfCu9NaKlMQBwsWpnFL0ntDiLN4HJgb5Ww?e=TmcuAQ__;!!P5FZM7ryyeY!XnLv9liFBA_uTs0c8LvdhZZJWfuW0qGo1u-DvQmun0HQdaT0Td_j3dvbe4VfcG0QWlSHtpClrmJ1pgul6w$1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb2f46f8,0x7ffefb2f4708,0x7ffefb2f47182⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:12⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3844 /prefetch:82⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:12⤵PID:5776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵PID:5928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:12⤵PID:6024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:12⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:5636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:5884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:12⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:12⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10894300548506600522,6388604531907706481,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6220 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5472
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
38KB
MD5e48061b164573549914439e190948500
SHA16ba0bcd37274504578503d87274659fbd4b47216
SHA256eb7da0478ce4d9f3ea966d7fe81e057cdbd2ff0fd3bd9e80e410851ab947f5e9
SHA5121d5b3b5980d8bfc31373fb5656f9d744fc60510efd637e14b8c4f63e6973fda67de2c4a33b832be54a29102dfc4e3304d4bce914d3100dccdae8358334dcd1f3
-
Filesize
21KB
MD53121eb7b90aafbd79004290988d25744
SHA15584f1beb7b9e8ca11833035c9962b3ddd54f904
SHA2566dbe807b8da91d549a49beec3330d795601ec0f272ea232e91121f3ed703dfe4
SHA512ed25bf0b7c12742a7b71bc271364970508fb03a5096f42eedc360ce92205af5be0ac4eb0567585882d34629d179f9cab287839247c81f61d894360a83b28aaa3
-
Filesize
25KB
MD5b2b60f1c7184b15ebd6cb2a213c323c5
SHA18fed557ff6e49376f3a4bc56f95a548d6075955d
SHA256dba7c93d3cf4806133d8fe211dce32aa12041fb82acc4591f464052714878fb8
SHA512e1a4bb4afa8fa8c09e163ba9c0d264425378c8d50f212e2932a2b21cbb6983b566180657bb753681b960d02ca4dee73a5504d433c536e64da979cdf34aabb8c7
-
Filesize
35KB
MD5a729d45a65e2b9849159e08ef6fd5f12
SHA175a14f3e8ac5d4eca6ade8771c84f4f5328301d6
SHA25611980ecd03e02439a6300eeff5dbf9a48bd52eebf14bbcc246752b0ce5baf223
SHA51289460bcacbedba68cd7fe67e675c5dfd76e6c43d87ed13d03eebf4a66bc298c85f96605306eb879d4ed89bfe0e53699a11a09bba866226f767ab97203395a6b3
-
Filesize
35KB
MD5e243d03bb4bdfb80fc2b9c40863299c5
SHA17abeba96529b293239da5536d4260efa1e797ad9
SHA256a8283e1b2cabd16be04a6cb0a292e532d5b74520123e09c2cd9deb9eccf2d1eb
SHA5127bda56879f1873647edf1b3d18e468430fa9a03ac88e8ac5209e834de13b7c0fd195f684f7afde8e526b4993c1debcdf6373357b925b423afcc37d76ee5c0f41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD53831164d5d66851260e266d5e3382c1e
SHA134e93e0b6532eb0e9db8ae3d619743d1110351df
SHA256ace73d9feca3107b43696d45496eb5e1a8af3ee7a2f05e4f14b61735b4ec2f39
SHA512883e02098d4397650189f15672f0ae0b542668bc12f65e77c678464177e817c444ddb75fcb6516ef948108312d1f7b5b58c91385da9e1083038ea2931c7847d7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD50b22fdac46d3aebb78c149907f62e131
SHA19dce4539e3612fa0a0a35a9f544b40f7d8cc33ed
SHA256bb321eb5ca333ff92b443839d60e45fefe585df72f11f9c879212059548c5b5c
SHA5128d44133b9843c057c13c5248c870c04a2d981a9b330124d14a0b7cd364d39fc7663e18f12886767dbc49301fbe79662834f89f265cb7c4ded8ec4dc6e7dc9388
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD58d7e81a0bc8f6e9b471a9a5c35716131
SHA11aa82eb6976b8fef156b218598ee10bf2438c4c9
SHA256e86983a37284c68d8a3207747c5b2f320a760424295452a6a102bdd2ed6b56d1
SHA5123f991316add5af88bd3b5e0848720d935dba90ddbb07924c9c306c478765d31b9ebf8237821c0d8b195f5a9e5991cb7c11009bab7189d695214ee0235e4fc89e
-
Filesize
4KB
MD551f7887327b8c7ea80824d5fe112b25d
SHA1d414e9c915416e04012e6f707b6f15fb7503e9ef
SHA25651dd1a38f4b97d6148e961809e084059f33e5de5db426bcabe5bd777df740c86
SHA51263e8cae8abb9cfd8099e315ad7360fa6e490d06268983b2a18db3891de822a7e52b2baac0b57758c5f9dd1e71d5fed175a38ec9d74302947e40032574284c5d1
-
Filesize
3KB
MD56c1d07633e0d18d988643f3fc47557f8
SHA1e2a0e3bb3937aa291c9acb07cf24357684af5a04
SHA25678babf96a0f3d4eb4a30e7ac2ba7039955236e1d968616b63c8a858905a68c3d
SHA512971a49fd63efd298774b3d05cfd1d88b9e9ea3844ec1e0de7cb9dede88ffe1bf625946b37b10ee9691be5f393fdf8e811e9ee68f5fbd76cdcdb21d925212d59f
-
Filesize
8KB
MD5a32f3d090c161645c100837d0f7e821c
SHA18b3fd4dadf9ccd4f85a8df6bf9496ddf6e0da626
SHA2565a0e42248c5b84b176d828bdad5a5cf3d5587edaa20c402509f9e4afccb69ed7
SHA512d9ac5421ba7d9957761e8881e59997a3ef11577da6d98b9784e67a1cdca657b662a7ce7df20d61f302173c5fceed8e084df59284c0d213e8f272bc34e1a7a322
-
Filesize
8KB
MD5e3002cccc19697471d729296292ba518
SHA15747882fd3c37404323aa709b17bba779933bde1
SHA2569739e8a70e881a885bda7caa03d1c6cbbf6868802dbaa8d6c78d6c3815bb65be
SHA512a4afa4b397e6bab0dfd18ef5c365d67ac110a28ac2b9f7ee2abc27e0766e864c95ae9b40765704c924dd1fb31e6377076a5e634a732275a34ce3b87bac8dcce9
-
Filesize
6KB
MD5ec4263c052556e67435ba400d15e7876
SHA1f25455bddfc172404cd473b518ab96a601d72f0d
SHA256815751fe0e5fc2d5a2168b31b4b7621cd89e9fc2e0a38ba114c1e44e9c92739a
SHA512c8bd4f26c92f58d1fcbecdcd8fc2c267eece25c6490e8937e0684acae870f1c89756c2de29e16d9c39cbe3cfd6ba48486befeded3067fde918db995d678b690d
-
Filesize
7KB
MD524a7bc6932de3327a06837ab743f0fe4
SHA1eeb672c5b53c85824cd8c00f378d615e5b688fa9
SHA256ad07f1309379ee9e706ac323958df7ac63665e7d47d1a1273093bbe1c82e3ac4
SHA512df1763837e5e241528b6e7b92522f508b4470e0ad88e43aea62c0cc0d41155f39111c571a75b335c47df80ffbc4f6481555479e7534422412f3b8050444954d2
-
Filesize
5KB
MD5f99198fdd9b423481289f23d407e9064
SHA1847c3aaefaaeafa349618c25335c0b525b4f1e13
SHA256f37836a8aad7f5412ea43dca9de0488e401b5fac83d4e08306cb52379ad56865
SHA512671fe82d8df5beb6ed405a32b8e6870af6b22d1cb866f1b30ba573bba09029fc7622d6fafb200e250b34745077d9b9dca1376e73bb6f474513e6fe3f08cb3241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\908c426e-f537-4333-a977-a3e88c3b0f94\index-dir\the-real-index
Filesize768B
MD51c5933a0c573b2b3e5bd903b0a467f8a
SHA19c63523418819864d13254539c5a30106564e046
SHA2560963e34daaf057bfb693cd78c65ab9390c8c32488898c378001da9eeab71d56d
SHA512ab6820bb3fc5e50fa65d43e5be51eb59e65e4b674ec805374c07211e449aacb2f77eead932b38a57490d23fc85a9baea484705414341242dffc1c356033994d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\908c426e-f537-4333-a977-a3e88c3b0f94\index-dir\the-real-index~RFe588d85.TMP
Filesize48B
MD5c23713ab91ac59a5f5afb1beef416de5
SHA16adaf7894b7ee817a3b640cf47ae84086529f739
SHA2562582eb457d689196cd4169206ae1d92f996bcc1dd6684b10b2600dfe43ba0d95
SHA512bfff23f687c5a155dea588076de917b6e54e42ec1a4dd9934a96d31c5eca7e791b3a1cb7edccc3d1b6b655458f210a163c03943284dfd9a7a1a713bfdef0cb78
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\c70c6323-198c-47c0-a305-0db49a786f1e\index-dir\the-real-index
Filesize21KB
MD5f55261e459a369abe2f8aa647e1cd170
SHA11663e425368554b58bf7c67fea6fd4097a327d7d
SHA2567c2a75618f51e6889a722adbe57e516d02f51c589520bda8ad1b193017caa708
SHA5122341155c0a9bf9075e86902eddb770a0c03a67d9110cc98fcbbbcef1c2f5eb4403836f08f8fc866e760a6c05b68dcb1e66df92925b5737a342047aee2186e83a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\c70c6323-198c-47c0-a305-0db49a786f1e\index-dir\the-real-index~RFe588b53.TMP
Filesize48B
MD5f064f7e31c5c9b58be1cd4c439f0e737
SHA1b15977cd4ac9ca149d8f0674cc40edb92e40eb11
SHA2568975e2acee1ea4edb06f598a452911a3faba584913e80261212d8b2ee329ab36
SHA512e3978d07d71485a9b96d738e713dc5f4cf35e4666dd241b8a81f7e8c83930761fbfa4c1507fdef1a15c49ae1628caea7cac149408d88372c2aed50ac690afeef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt
Filesize177B
MD52e4080838f8da18c089aa4b402262121
SHA116efbeb1e4c5f49a6eb4de7d9212c45b480abfd7
SHA256487f3f4ff98c2b2197ac207813e21d487760994c897d4d01edb41c1416ef175e
SHA5123b6fc5ea014ee06ba6eaecda33a87bfaa246b09dfdd2c69da46370a30dd6b367bc5cda923bb3a9b807c0edc09b9309c287df4e22c9cc964883726775de5323bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt
Filesize173B
MD5830bde58119f35c79f75ed765da30244
SHA197e761180b67890bb6bed7b8c38cb5f6c67e042a
SHA25662c65f54b49fc41a955161fa4624ed7bb820e6ed03477c174ccbf51d4a90d9b4
SHA51222f6d5ec79afb4f8717998fa787674ba6799263f01a05121047e60e07aa637a167608c28b405b0062054282f93494cb97726f7b8c1e0906eb72ffcc0249a8376
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db5120f9cf38fd6a22659982d69773d0b54c3d4e\index.txt~RFe5836f9.TMP
Filesize106B
MD56649aa59ff65226c473f903d1da61104
SHA1df89b050eee088a472874a2cf27696367a97c036
SHA256991b6056eaa04c5fc247612a487f4bcea9d27dd785535aeeb18dd9787c2813ea
SHA5125e9f5ce4c34a2ad904a0c48c32c2d62f9543c656a68c37ea0477074a4aab076a5a177498d9b08619744b6a0499eb4c12b282afd9a590edd6d3b67471b29274bd
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD59965d927cd6595b453331a5353d47867
SHA172028301a7f29e2760bbf7b69bd85de699d92a8c
SHA256e170f3321713d67204977f9c26ba7d48df8bc348014fe857a01486b3c18897c4
SHA512ae012b6bd64391edaf26b6bd29e0abe3217b47b920964c817b631879ddd3b6dba20df9234e018d47ace78358e26544b1f91e8eb47a22d6483d9515ccda727a17
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5814cb.TMP
Filesize48B
MD5d3883669025e3ad2c74786a8a12651ae
SHA1e55c8c1b16366b00efbd41135cdb7f5403a59509
SHA2561f759495cea9bf6132214b99ac0a6d21c28c88fa8ad1022d34c534e4137b3019
SHA512af796d58d94e4a03380023842b618304f3ed845ae5a70a888f6da3cb6720f628a97ad186d51fdf3a210ea1c5b1dd6403882d0f0616c794f60744c330e04cd1c4
-
Filesize
3KB
MD505c5b849cad4e2eba3cd948a5cbc94d8
SHA1d1747e9df0e7fce031ba0dc63793a34a1a69c63e
SHA2566fffbabf2274cb0e0d63062c9f911e9bf9bebbd50d55e684478f56bbe77b0416
SHA512fd08f8419d1d52c7447bf67e9e1b02d01f7c847542cbdda3ca3dde54060db2eff7dbd55d8ff3517767551a6dc05e2d98f69bbb70ab591a0a51810be27dcdbeba
-
Filesize
2KB
MD5cd8e8bb47702f2231162ccb6cdb21436
SHA1855006f95130398f5bfa4bfa3f0cba05ca23698a
SHA256d64673153cf50cdbdc2dba86a3e7e03cfa8c25706cac7d3cccb0cb998886dcde
SHA5128751e17df557d19eba8d69e123ab5daf355e4b87d947216879272c6331ee15acc2bff26291ca34570561b9f446b05704d11d6e1fc9231d4fa4f453f5ce34a6d5
-
Filesize
2KB
MD50db5b4a0463e8624b0923441321300d1
SHA11119cacbf754ad19b2a0477f25c558bdd2292415
SHA25605da78315347c52c92ac0fa35fabae4f6b19373661344c993814560f0e2be1b0
SHA5129130ed7ab105e47059751ca7c77b70b79903c4a785e63619b0aaba0fe4974cdfc8efd4b8a38a72e013c631fb3fb7a377ff2bfcf1bf9d8a7c85e52c5e8fbdf6f2
-
Filesize
2KB
MD5f71e87dd4c1b0be81da08337ee875a53
SHA101b48f0ae916e8decb45ddeef095d68b0bc30c53
SHA256e23334e0b9044eff99bce1313190abb68b6ee31f2d9686a4cd43b7016d663082
SHA512ddea4701980c7e52f198a3020da0379c00a5d0d349c752997ef4bc19cee7607f9c7ddeb4d74ac0bbeb693cab2b805c3c62b5ab2b00e03ccd0626eea564cb7339
-
Filesize
3KB
MD577dbb0f9f63d113cd695d88b9868f86e
SHA128ef991458b7296642242bfebee7d87269939bf4
SHA256aa34d73edcc02c77d7ec0927a7e4482247ecc6733948d1a7b63e95e6356b5c8c
SHA5125a1c560e220d33ecc54ccd84ae6ff94f6a536b4b40aad37e1f5baad4555fcff580b6531e1354e597675ee5663616bd60831751306ce471df8a7ad319f61248d6
-
Filesize
3KB
MD5260cd66010ba04917537a1706faa7f5e
SHA184af25e61a262d394ce951009a3ae3eec9ef2f7d
SHA25653e1f9baccea6450ba1144b4f966859c44b55e74125fdb692504d7d1cb253bff
SHA512599b39532d9c0cfa17cd7c87c9e1a929ec743efb2ae01b5e27767aaa7282d650649dfc899ae6b32b6f385e102aeabc785398756641a50ffe53c8ea02016a697f
-
Filesize
1KB
MD55d5d98dc41604bfc3ed5eee70d3cc4c4
SHA12cbb6e78c9a823ddc0143bcd285dca0a63c4968a
SHA2568d54c0d223a30ace6c798f1550c948def823987a4209a406647a4cca95be4d0a
SHA512635bc323cfa521d69b247f9f1fbc844f30bd16062b99b0166f8b7126539037ccb45bd96a611eaed4c3f48fd5249fe7057ea71260bc9534c97c7153b0569d0c12
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD591d21433cd7ef6e47d9841459bfe96fc
SHA1b3d89247b9406099879ee3d9006ddff1c6e8ce11
SHA25650152d48b17338cc678cb772ce49120326e991e13da69735935a3fc359c5f8ae
SHA512ed5e2580acff7045989f561aab7603b63f19394a7ebb9da0ab146a8a53c8077b66b94010dc5e8bc7627b786bdc4bc9d12f69d253b2b608f437f83b3cc56f5bec