Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/12/2024, 13:48
241210-q4kacaxjas 810/12/2024, 13:46
241210-q3gstswrgt 1010/12/2024, 13:44
241210-q1vxnssjgm 810/12/2024, 13:42
241210-qzx1mssjfj 8Analysis
-
max time kernel
157s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
a.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a.html
Resource
win10v2004-20241007-en
General
-
Target
a.html
-
Size
1KB
-
MD5
d5fb513907e0bf30fd3a61a2ecd4dd51
-
SHA1
edb774f15d961ada35f581d84d8faa5a47422850
-
SHA256
6764182453f39a713e142b15b917a28f06bdf57cbf75f537a38dc4213555598b
-
SHA512
c7f8e36e09fbf4d7b47c764090e368d9fd0eda8b30f60ea67c06b92c3af01b7749285f3ddafa109c08dbd14b0a78f1f82cfa4f18721ec66eb551c90567b60755
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2292 WinNuke.98.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 76 raw.githubusercontent.com 75 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNuke.98.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 697850.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 292545.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 511345.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4284 msedge.exe 4284 msedge.exe 4864 msedge.exe 4864 msedge.exe 2420 identity_helper.exe 2420 identity_helper.exe 5032 msedge.exe 5032 msedge.exe 1644 msedge.exe 1644 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 5028 msedge.exe 100 msedge.exe 100 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4816 4864 msedge.exe 83 PID 4864 wrote to memory of 4816 4864 msedge.exe 83 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4184 4864 msedge.exe 84 PID 4864 wrote to memory of 4284 4864 msedge.exe 85 PID 4864 wrote to memory of 4284 4864 msedge.exe 85 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86 PID 4864 wrote to memory of 2688 4864 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a.html1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa046f46f8,0x7ffa046f4708,0x7ffa046f47182⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:12⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:12⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:12⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6456 /prefetch:82⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:12⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6512 /prefetch:82⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:12⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 /prefetch:82⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3443386371879720369,3337592045219743632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4256
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
38KB
MD553214f37c15ce68a217e2915c835b235
SHA1912add71f2d55aef34ceed48859cac16207759e3
SHA2565b50f1bacf12105016c72bb57bdb3a468b274fc21d4485d1922a14e2e127f803
SHA5127289364baa2d22ebe8754a3b0c0ee75e707d88cb925a7a2e871644899bff3a91afff924eb5f3bb1afac7ec6d5fc571dcefc20c5bbf049a1bdc1e0a8515f6fad9
-
Filesize
37KB
MD5fc8b9283e9c3686899120581f73dbf88
SHA15d2c3af2bf4a2054daf15098d95992c9aac1bf17
SHA25627d6e4815025d7fe830001e206a4dfee19b496f302332f195ece6295f5d1f216
SHA5129dff216af5570c81213c24076f9afdb150b52df46d0143e199d12cc1d05d7e8b21e096b129d5d722ab0b51996a41cd70f0b2f06a65f9cd127c5700fc6ce49319
-
Filesize
20KB
MD5e42ba21fc6ad46eef7210e6a17cbcf29
SHA165df7e97d6ec546a85a16beea1a8533788969fc6
SHA256f41a6b281e24eebdca7fdd637658685e2c4159b9da7c1017e5b9bfafa6821d8b
SHA512e9b1896224703b80e26411b65a418878d77713a023a8bfb49707f7569359246d9ce1e2307613a1ecae7bd64a78266916d4586aba1b30fda2ecffe05322427ef9
-
Filesize
16KB
MD5ab8c6959f7d35bc393a98b6a2db5ce13
SHA11289068381b91cc6170c810db2488bc3a46f242a
SHA2560178bed6aaaa7c7aeb61cbdaad645ebb6701968d04d1778506755251ba37311b
SHA512ee194274097d7b275292633a9258d5dfb0ccaf28a476e5fac10a34577f3206cadfa0b9c9aef1e7f029ca0d0bbf18e220ee69aaa4e5f2077c167ff0d0803d8d91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5912accfbf2cd4b0b50f223374cab3d9b
SHA10e0128ac73af687abc129cc5cc1c2ace6e4be7b2
SHA256409b51e7fbfd7259a69c055a71cf9019cf9ccc581d15c846df64b1c77d73ff03
SHA512f2bd8d5c18fb176b9b1713a2e539dd9bb79b50be24c0a8af5be8a32b7443a2ca6337ed4cdee5c05d555959f4e458ac1a97280d4f2a29516a5bb17d4129d7829b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5ecc62dc48ccfdb85cb21fbadc2b8b46d
SHA1781cda6f1de82857720f3b32bb9fa26d877a187d
SHA2563dfd549bb54cd9bb605366829b99acbde5fe678e3f22e8dbd8d00cfd55b76466
SHA51283c38e1235a28fef637346055b16a2cdbc45face36bb3add4c70e8f8aa424fae27e088e7deae11e8851eed25e514d4cd38a15e9c1d06bfe389e84a2316f9077c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD537a330794aed0c87a9fe59859fa17242
SHA16267fabd658c276d12eb66b668021458c3e29387
SHA256d158c87fa0b44457782894065f28d53613004fc8121ccd75b423e714242aef65
SHA5120fb76f0ce34de8aae4d14790bd8fc82e1914c9c3047996f23f7eff57f8f33eb97b330a6be2e3dab711acdf1a6c6151f3992613bb1fb19cb8bf48c53a8ba327f5
-
Filesize
496B
MD5406d40f57c41b87d19b999ebfe5296fc
SHA17d6ce47afbb25a87565cebdaf0a1a2f4af4bfc10
SHA2560d179bd1f38ad65839441984c85dac651e393eb75c561885911cb8cce8be6974
SHA512a763d98c4e196a8f81244761848a52ab25cf2b4dcc91ff8a977828a7f3639f05248463828221b575942a4c99dc5b720703339e4cb59e11a301fefa6236e660fa
-
Filesize
496B
MD5143a86e07d21dbd759f13e19188d0192
SHA1dd15e312a9574a79a326f72e0d986bb16d03024a
SHA256d4dd0c997a57ebcd61db5812a428c6f70d60e2818f87a0f6e31f5762ab66d5ab
SHA512c4b4b4dbc8ef829194003e6c7e7cb5a4f01258a093dfbb130d262756c637dab5d25f465f0daddab484cb267183a81476909ba6e6ac465e5d71bbf19b1bfe0495
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
579B
MD518b7efc4ea2d077f03fc16faf8171a91
SHA156bfb82051794cbe13189ba65c8eb68438885a7e
SHA2562223a63978ea315b6001d5d022d37ccdcad5ed87aefb1938a4e730ba9f2d8154
SHA5129447bdb2c051df6969829cf718b912aa4f3edb0e9a193edd28330d4cd88b52f1ca5265fcd94f1c65781abca52be8fc33360091fec73781082b649e5b693312ba
-
Filesize
6KB
MD534a59d52fbe4d9b8cd881f837ec3d755
SHA17ff6df41d9a03b63812885f6732fdd317da560ae
SHA2562c17cb8b0df312529bed2f51c7834dd6bb8ece27966b844101e4249faaf1a608
SHA5123c13e0c7f940651a66544e1a6230e32f2299f631f3612994c6ee35225d3df93407d515cc4f18eed5814b6012ac9fa3eec3bf58a3addb9614634abbcec9957943
-
Filesize
6KB
MD594dd0f3c28e37f7778cfa0705fff7637
SHA16f4db0e41857beff4148e0fc0c2fe3b9f3c8ae62
SHA2563be622daca048009b04eadf659b0f5408ab2258b7154c2bc7bb276c5a99c700e
SHA5126fc9a4f1cb5b8eec503ad2b7b4507ea8d869f2ff9154dd754ee2d34dbf4c4dfed69a9744071e88c544a116f998f3d5983d8a50df7f180266edc98942795041cf
-
Filesize
6KB
MD5da644fad6f1b9a514668274f32235aa1
SHA197fcd5398faea08f630931aaded316f33ae8e0c6
SHA2561d41213cc9cbf47f4cd137e638a3c338df7f768649e50d79ce320c5c8b3c1899
SHA512ac01bec0f80d13a669a824a6a99652254bdc100ba5475ad2d98a8c579fd063de542dafecc5da388c6591a9bb1e2359e16e8e9c31d9cecc6bf69928eac6d2db67
-
Filesize
6KB
MD53348eebc7e1daaab6e7ad7fd797e4391
SHA12be94a92bda1f74d7ab4123254e133f18d60efa4
SHA2565997275802cee71031ef5b6e296bad9922386405303d28fb10c24d280be9f8f8
SHA51242c02e6ed97c0d21b6e4fef08aee09e0d956759ba1f43d3ac3c31ba4b343a55f98dbbf2e5fe957f54872c8be4ed3304395187124446b598912c5616bc3944e65
-
Filesize
6KB
MD595e0ef1820ed3a137ada9ee89dbf3b9f
SHA1ce529de4b362e681e3884c6dad8c850b0cce15e6
SHA2565e58402194c2c0c018471dfc2d0be8903e83939c33706f59e2e1d67dd077ed99
SHA5122fb3a757ac0bb2b2f4542546a8e24f2b1d900128f22502336c6a1e5f23f3455e47358ba4a6ca84fb21d601e22167beb89f941d56284c125174e89b1b066876e2
-
Filesize
6KB
MD51cae894a4f1a25a0daec61b44af807ea
SHA119ebd30d493ed8013ed15464c0a77a6699daa32f
SHA256df7070f5dbf479a08a16b76454b8ec80d02fee9197f2c5b9f90c591c744eced5
SHA51259280a53ac74cbb5ed52afc7a12f8f475ca29908bb099e11c3b78273465181c689da242afd87fa764bc578f0dfd9daf8943ac8acb468c8d0c094c7f4d2bb7330
-
Filesize
6KB
MD54c7e09ef37e42131709d45b3d6893246
SHA1ea784d3710f8953015ea6357a1b979f86a15e010
SHA25654ba03a6df973db960339e4e10e7f23e0e396209ed0e771e9e54b88f0206fe3c
SHA51274bc2df71e2228c99d3ecb2914530f15496248e7259e92f9d6bee2bec33e3169d9dd027c2682e49c0b6c562e828b91df54d8b32e2f2df2b1ca531abbaf554ccf
-
Filesize
5KB
MD53857d366bec54375a719288f42043777
SHA1f25f5ddaf2fe1382cdf58edfce78e86e4d7f9947
SHA25690f320e7ea58f34486358aff16ffdb77af52c17957a090662b95c177b695c354
SHA512afa08f947d2ffd011e994fa1be1b4bafc4728c8fdf522598e792f069fa2b33dddd40bc0869ff309982442cbc602e977b68f124358663421886793038bc6b726a
-
Filesize
6KB
MD5fa483eb20123bdb5c4919d65af5a7111
SHA1ba83aea70f24e0407b3eded9a74464ab7cb5aca9
SHA25630ffaed43aff7159bd3fe22aae8e46b8fc7135195f02fca586d63568084c7010
SHA51250dde72182eec83c3b74b8ea5c3eef9bd268cd886e2a74402798ab4d0fb9ca729c82f35468bf3c5aced718daa4db5ef29a5e58e4144a94a8ca55306af6ede0e4
-
Filesize
1KB
MD5acf5a4699a88b7f83ca246b347eb40dc
SHA11edaa16165c7fbc7124ffbc46a7e51f874693bb5
SHA256144d26a5f3f9a1e7d1ebfb319c34757a5cb1cb39244c3aceb72885817b4ba001
SHA512977b9dd444743bbf186f8103523d87b13ecc77a6a516d2d908df81ce19cd1241566eabcc2fa973b2caa81b6c81def32e15172cf5203d7a1efceb2c9c51314e37
-
Filesize
1KB
MD5f529995978985c7649bda44293e2f87a
SHA1595f55817a8b38e1074d0b2c02008bf8e79e1791
SHA2564a886cb32a90a186329cdb7a908d0b9f24ab3162cf6aa98461ae0c018d853045
SHA512819578d5befb0e3cca1b83c85c8e6742df781a237835b4028d8d19f1a4190556c786b847dbe4d33a40b679ad73c1c830df3c8ca50dd91342bf4990eb6e47e440
-
Filesize
1KB
MD5df805d3c519cb397c81fc43efce70315
SHA1cb0317f55fee18a09e1db79b42e7dc123a7d3eb8
SHA2567f1b4d8ec3551d879ac2077e93d21eb1aba3b7df2ee39559636c6d1ee26dfd86
SHA5128317b9b2a5635eea66b08bdea120e1cec4a66f8a27258620028b17cb7487cca4efd3ed6feb4f889d89f60b586abfd9920ba90b614d6a55bdefcfd853e281485c
-
Filesize
1KB
MD55eb9ddc16642589a7f5ba03a84afa072
SHA170c0ec7092cade3fc90b4e84d1faa7250e687be0
SHA256306e8b5563517d9732c2961a7d58e60a6a12a66d486409227115eda6926ddfa7
SHA512cf02cb36ff4f1094a96df947060336779465d59cd76125e5c9e451882806a00cd2210ae59ea8b5bb177b89b2b51ed90d8022a58d4ec9927468be63eaf00e3c67
-
Filesize
1KB
MD5b74053840e326763b3c2247738605e39
SHA11333240300eba4f7d30e9f251abc4681065083c0
SHA2563248b9460dafa2c9821372005bee6e680b32b9eec4c19e25eb7faaa26e27b7b7
SHA512699a559a1fab9c163eec7b2d7830aab64b523bfb5a9b461ed26e8842b8ccdce9971d9095fbbc4a260489d77aba7559d135a687311a5ee0b07222c337833e59c7
-
Filesize
1KB
MD562dcd84ac6326ec3fac3bfa7a5a67284
SHA1bb2d591f0fe329347104d3b22e139880f3d88ad9
SHA256b9b60c74d4ebf041e09a95ac4671c1dd5f0f18592c7ac632364f5e9fe681562b
SHA512da1d1170c70c0c51bfc44b0ab136b2afc53e7f70e0538700ab6ef610312f01557fac6108a7633cdf2680e994af5b17a9afd6c863631791e07fed09f4fc8cc415
-
Filesize
874B
MD58c55fd2b75b4914566245ab4b98fb8dd
SHA1dc4dfe190156b0af067297be5abf0e9f6261e016
SHA2567b98c87a72af3af1aadbf1fda0a67fee1de343fae07b7be865b9c964989d03c6
SHA512aafc400623399ff1a59df39f98a141f421f2df1b8487bae5195dc846984f74bb3007a4220a9d8ce616d96709378d46d2c4ee9774172cc2bb5e847a75708471af
-
Filesize
874B
MD53711e662a2610a97857753bad063ef7f
SHA193e747d3add55e83e857bf0efe2d94b94861ad0c
SHA256bf95a2884ce8f3b6fdf26d55c84a46589282dd55f942f24d827b8c44db011e82
SHA512c521dcab32b56392ccedc4421533f3790af28fbc62e3825c452c5690e884884e2107fbe5fd69fab3ca39834bfc9805c6627cf43f7de8bfecb1405f312f148b6a
-
Filesize
706B
MD5b94e22c2a5162b30345360e6b2704a5d
SHA1b76ad5ae3ee84e60e26208eabe10b14a4690807c
SHA256bceeb52ac4a5b96e64b60c88672fc6f4a5e4cbbdb01be7cc1b90da4acb9a0580
SHA5122b214e7580db3d5c22b6365140a33aee5459dde94189ff89995e3ee3963cf26cf4f3395fc6bb5c6eb274bf41e2c1c6ae3100fb463ada975b4ad220713fd331ca
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59a83717e13edd0a833f481b445481c92
SHA165c6e3dfd82ae69dd695eba5cb92bbfa59a66d33
SHA256bb5574926b0a97adc7f44cb2297ff8e5e0bec64011f1958cbe1e6e342f9adc36
SHA512e165f60916feb0c59ad5ac4debc72c60263ed7bb894bdfd43355ed22554d4510d1a692ad6ff6e71f2232ae3d94249237f43e1acbff97dee75a0e2c799d53664e
-
Filesize
11KB
MD5d0ae799a44153886131be6d9d9938315
SHA114c7d188e983c93d23aa63da893aeb8609cc4716
SHA256db0cb9f56c6b7b3915b50ec09ddab060655bfd81a3e9d7fc9ab5b5953e03af24
SHA5124d5cc6770abe72f2e95af445bd39e612b9d7fc5e443c88a8bc07b7a84c025fa894e8aa3558129130c88b7c739fa2924bb173f465ce44b5d4c0c0a8cad65f2197
-
Filesize
10KB
MD561b4175f98a49cd4730290b516b83fec
SHA1cf24705a52811c93a88499d644f6f64a4d42480b
SHA256ac97885f6f3f01539fc2cf37e7f2feab3c7bb4247c8166653ce40c096ca8ad4c
SHA512ffd267df02692dd9819d4a9b9efe53596734bebb30982499eb6ea94759ea72832184850ec1d42f27b81d21b212e73c7c66c20c1f09fccc13328e5744edb7b35f
-
Filesize
5KB
MD5fe537a3346590c04d81d357e3c4be6e8
SHA1b1285f1d8618292e17e490857d1bdf0a79104837
SHA256bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a
SHA51250a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce
-
Filesize
2KB
MD5a56d479405b23976f162f3a4a74e48aa
SHA1f4f433b3f56315e1d469148bdfd835469526262f
SHA25617d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23
SHA512f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a
-
Filesize
32KB
MD5eb9324121994e5e41f1738b5af8944b1
SHA1aa63c521b64602fa9c3a73dadd412fdaf181b690
SHA2562f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a
SHA5127f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2