Overview
overview
10Static
static
10Rewind.Lau....9.exe
windows7-x64
7Rewind.Lau....9.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Rewind Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...er.exe
windows7-x64
7$R0/Uninst...er.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 23:44
Behavioral task
behavioral1
Sample
Rewind.Launcher.Setup.2.0.9.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Rewind.Launcher.Setup.2.0.9.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Rewind Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
d3dcompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win7-20241010-en
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
vk_swiftshader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
vulkan-1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
$R0/Uninstall Rewind Launcher.exe
Resource
win7-20241010-en
Behavioral task
behavioral31
Sample
$R0/Uninstall Rewind Launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
General
-
Target
Rewind Launcher.exe
-
Size
178.0MB
-
MD5
80b95ba57f1f6776ee6b5450bb76b5af
-
SHA1
57fc84780f7e01c61d0a864f98d6b29cc3de08c7
-
SHA256
a470df88c8538105ed3e3c5bc199c912cd540d19c6b20db5460b948544863249
-
SHA512
f2e3307e67be614eb245640253e844711f0d081462021bcf04a20346660afcd6a5aa4041900c9b353fefba4de03f343a6b12345fd289b31c6feff167f751adb1
-
SSDEEP
1572864:vexUbXH3qGPA3X2n04n0PgcCu5P3ds7Ical6BEu4ORlKIpDUs0u2hWozR9HLBwNf:3pjRCMx9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Rewind Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Rewind Launcher.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 55 discord.com 57 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2437139445-1151884604-3026847218-1000\{878038D6-6F80-45EA-B161-5491B6E95A2D} msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4468 msedge.exe 4468 msedge.exe 4488 msedge.exe 4488 msedge.exe 848 msedge.exe 848 msedge.exe 468 identity_helper.exe 468 identity_helper.exe 5284 Rewind Launcher.exe 5284 Rewind Launcher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe Token: SeShutdownPrivilege 4956 Rewind Launcher.exe Token: SeCreatePagefilePrivilege 4956 Rewind Launcher.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4956 Rewind Launcher.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe 4488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1108 4956 Rewind Launcher.exe 81 PID 4956 wrote to memory of 1108 4956 Rewind Launcher.exe 81 PID 1108 wrote to memory of 1252 1108 cmd.exe 83 PID 1108 wrote to memory of 1252 1108 cmd.exe 83 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 4816 4956 Rewind Launcher.exe 84 PID 4956 wrote to memory of 852 4956 Rewind Launcher.exe 85 PID 4956 wrote to memory of 852 4956 Rewind Launcher.exe 85 PID 4956 wrote to memory of 244 4956 Rewind Launcher.exe 86 PID 4956 wrote to memory of 244 4956 Rewind Launcher.exe 86 PID 244 wrote to memory of 4488 244 Rewind Launcher.exe 106 PID 244 wrote to memory of 4488 244 Rewind Launcher.exe 106 PID 4488 wrote to memory of 4276 4488 msedge.exe 107 PID 4488 wrote to memory of 4276 4488 msedge.exe 107 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108 PID 4488 wrote to memory of 2780 4488 msedge.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\chcp.comchcp3⤵PID:1252
-
-
-
C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\rewind-launcher-v2" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1788,i,3429029496691729285,6158982178915396999,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:22⤵PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\rewind-launcher-v2" --field-trial-handle=2192,i,3429029496691729285,6158982178915396999,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:32⤵PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\rewind-launcher-v2" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2536,i,3429029496691729285,6158982178915396999,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:12⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1264925854908285069&response_type=code&redirect_uri=http%3A%2F%2F127.0.0.1%3A6789%2Freceived&scope=guilds+identify3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebfa46f8,0x7ffeebfa4708,0x7ffeebfa47184⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:24⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:84⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:14⤵PID:264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:14⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4168 /prefetch:84⤵PID:612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5040 /prefetch:84⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:84⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:14⤵PID:5328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:14⤵PID:5336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:14⤵PID:5496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6674677857908696996,2313847836735656644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:14⤵PID:5504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rewind Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\rewind-launcher-v2" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3508,i,3429029496691729285,6158982178915396999,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5284
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4444
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD551f39192156433c402b241d765623107
SHA1f35a4e4ce95dc49e6c4b61fc8f227b709c717b6c
SHA2560dd4f001b91150e265cf081b023a7d48a1eb572c2484a55052f940081440c689
SHA512794a076128bff0381213517ad519e9ae40dba568bb47e7473aad8c00d7c43e7410608a894ff9611680b208feb1bfa9d2beaa03c23fac9af84c8bd41844a6090d
-
Filesize
469B
MD5531281a34f640da1e1e0913ea3bd3fa0
SHA1b3d6c6ad09688f9eeb084957406376003b759e53
SHA256248b93eb567cd4dc9ac99e5f229f4411ec74d2096d58ef9d9dfe84eb8a08be9e
SHA51273d173d29f1b9dc37bcaa8d5734cb67feeb00c97e043b95b5bd80351e3fc3d17e78c3068ddf3235687acd13eb710f40aa7be72f775c4dfc580fb3630dd48e62f
-
Filesize
5KB
MD535afd811b7edf63a0c4cae333e6d4ac8
SHA1ba5da7b4f51dda8b63fdec9e642de221a97c0e89
SHA2564f27542716977666802d1d39b4df51cf627087d40503ef29072facb81df46d6e
SHA512335ff3759f7ca472f0a1563e759fe18d064bb021301f51b7b40a132b337c1baf43a337ebccda5062be55bf8d2eafaacb1450cae76ccc1d39bede2e556c25d4fa
-
Filesize
6KB
MD5322806d4143aead2bf006b8ce9bc2f82
SHA15e4d8839d97a89fbed77764015cc6528983afd30
SHA256b9007fc36117f85e6691d14a748b6c6258035dee2eb084989006974a68ded727
SHA512d10f378fb4d7a477acaf03c3ce8fb3cb76a00e4f87993b8bf54a771e34e348ed4d9a5d9d30907083ca3050ed2821281d2a76ff563957c3339529be01961f344c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a0a26382f55d26f3a6445b36a6c7bde9
SHA1233f8c7d1a4680bc584a6be36e090d1b145bafde
SHA2562118bedca2b3fc8135ad627e14f24cb22e3eba1718e74dead2c8c9167a1f63be
SHA51277aaa3ca7eaf268052ae8cbd8fd57765ecf89d72a802aa47a4f08218c12638a962341554bbc3035bff4dc30bf5dbba057bcc0b5e4eb905a48cd5d31766a0297f
-
Filesize
10KB
MD5663bfda544a997f2571689e4d0f3d527
SHA1ef62850def7d5d85fbaadba0ea58b05bbb236509
SHA256a3b570921f3dda307acb491681bdaf25be73fa8b9afeeae530510d5b33e12c0b
SHA51235db5b5e5301bd6c3fe762fc34dd6abf71097523ccacff0c8a0df8c8ac57ff6a752a27fc145324e07cd9933ba0b1cf6f6d9d1ac9dc2831fc06f34220bb9fc736
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
788B
MD5b660e86df1c549d6cee0cd59d8a7f19e
SHA16ac8b24d4cb8bc7f258eb8409d79fc2f5c68f684
SHA256a101f146f0cb129f698362bb8d931aaf1524104123e64879b1f178815a02702b
SHA51221ac3d9579b501402e36c15bb54dbd5bd2dc30d3bc2fa0f13f8a6a65678f45a55e5a0e1171deafc859db10bb0fa2f0c550213ee12c39ee6ef00b8a9aa5e87b54