Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2025, 07:42
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2864 msedge.exe 2864 msedge.exe 2284 msedge.exe 2284 msedge.exe 3464 identity_helper.exe 3464 identity_helper.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
pid Process 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 4896 2284 msedge.exe 83 PID 2284 wrote to memory of 4896 2284 msedge.exe 83 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2308 2284 msedge.exe 84 PID 2284 wrote to memory of 2864 2284 msedge.exe 85 PID 2284 wrote to memory of 2864 2284 msedge.exe 85 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86 PID 2284 wrote to memory of 5092 2284 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://marketplace.visualstudio.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b47182⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:12⤵PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:12⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:12⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,15674875315732634320,6006590985645692810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:12⤵PID:4228
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:232
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36b6f671-6a59-4d3d-954f-7a3334dd13c2.tmp
Filesize6KB
MD5d233a5a459399230daee5c6c55870c0f
SHA1263aff287add6504b23c04004fd5297e387801f9
SHA2566adfa27cc8807a0fab413874b431d50acf8b7fb24b8a6aefe7921113baae14d3
SHA5120b4ab646acdba7de1075c87934e6ea86802b4aff4339edacfbc73b0fd09a5bf4fa843a3c8958c7cba91225b31749d093b5e1fe6aa48f3fbe16dbc14ff0025e7e
-
Filesize
110KB
MD5a445c33b2031d0b578477e099f96e1b2
SHA158448f2892886556bcf925aa28a1b93964d27553
SHA2567cb659b6178db5a4c858c7b7e405accfaa3af745ce8bb68c001d9dfea67254a0
SHA512de36e77436a72336f4fa06c736ddddfd3b45b5c9e46d83f4ba374c3c4577bab3d110dea3638cc97a2724da39b234f2b134dde50818c4d7d64b1084754a64f80f
-
Filesize
23KB
MD511581f2c579626703f87b1400030fde9
SHA1872762abda91d6bf615641e61be8312259b7a885
SHA2564d71ec24b2d3fc6977f9fb48eeeba5fa5c43e4af68a08e74a0dd16e6fa4fcb62
SHA5121fb315c50f4731fc2e9c15eca6837346efb3a611cb3d0cebe1b1f2908be66e199b5df14021ef489f918b7a8dbee7b8b3c95f17ca290e09010cc2ec28bf790d59
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5dc2d5fb9081a5ef4daa01a646f48d042
SHA1be74147d857b8988eaba8e5b02da5535f2a1fc42
SHA2567e06cb38189933934bac4379f0f67fdece35589b496aaab20b096c73ed0d62ea
SHA512a04d569879dc414e10527b027e0bff4268a60c6d9ac8967c3466c215d3474fc1f64d2ea4fec3105af3f83b35423a0b83dbe828244ab01ca322aa430a37c9f79e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD5f50c78af74fe4fc1a0b0bfc14478422c
SHA1cb7c4da5a2f92995f2b3cc99bace6ccf07e98205
SHA256c295a670b56853eab28b2ca6be68a61c1e2da143a3714c7f02c2740c09033667
SHA512789bdf2af52a1e8ba7ec3805fed6d1958fb3942f8230065f02d49e07f90e87223a54b925ccce9d9b3df5cd0feafffdc4dff77de0b32771160685758018f95179
-
Filesize
352B
MD53b784a1d9523594ee66300f6ac91238c
SHA1c5935bcc5068e5e49e30525b7ec0fa30010675e1
SHA25695e295f814d0a2a35ee4541cb0102d5a51f2ca2db4e7b600d49d446a424e7edf
SHA512a7cf6b6709141829ec67f1a8ad736f8f7c6b816c8707f05c9cff4cd53b49a4e6e4ebb954088bc843e8ed4eaef36fe7eaf29de0c41ef80331cabaf1b1d15d40ae
-
Filesize
6KB
MD52a905900213665052996b394c44a5154
SHA143934f9b25008f1adae2b1909e89c8d7fff136fc
SHA256d4a1fb72c4716543228eac22a3cac041093578087a0f31e6f741faf868f3c37d
SHA512e47dc1d1ba029be663dbe40caa7740e8b9def9899ebebfcda70e53526bdfb17dc04112e959a12478539eb481a161fa6cc4e7d65472352e51ac0151ae4eb732b9
-
Filesize
6KB
MD51557cd4e629438a104c456cdfe53b22a
SHA199488e296538e18044efc57f39dfee4edab1656c
SHA2567a62ec71598b78a41f169af033b8bc953d8d689c62c3578d76e54ecd8435f08e
SHA512cb02ff27a77b1f8ba354be79f9aefc0764ffc056a85f9dbfae8ffb5bf8d976a1be466efae573af093e6553a976cbcefde8a38441fd1bb52ed09e34f4782e4c2e
-
Filesize
5KB
MD5d3d3d1dba571d39ed5585b97b8cda8a4
SHA12bb2dbe47e71afa329a311ba01e67fb706e89084
SHA25664a1fdcadd87e302af7ff19fe3c55c94238389350a12d1c3fa31c16fd7b92448
SHA51234d301c3ee0955c2cf767d528a948a92882189cf883191311dbad89410c84492e563e3c6595593ed85f6441b2a56a0fb3d3cb64dd644d9d3fdc913c6a6548c05
-
Filesize
371B
MD53ba96b80c48c63249978760aac174e19
SHA1b872c068f96589bbf8031957c13abcb7e53e68ad
SHA2560d969898dc9ee857dec6438c75baa9119173f899620d2a665874960da95373fa
SHA512ccdbd534c54c5c08874b52a0b0ad90d47799fceea55963a96d4524dbb2ce2797647eeaa5db310f5e9bec687579f282784cdfdefcb17e576c0c71b9c10c57d6c2
-
Filesize
371B
MD5c12cec9ae227b8a3a1cd675d2ff46218
SHA1eb4635d52ca4e7c1c381523883b043062be2ecb4
SHA2564ee0c0c3bbc4a24831a7547fd787c6ce593127c3f84ed12830f29fd10ee28116
SHA512b000561e4a7f555f6ec252325995a3ad42c47b7690a340c55759743972393db3cade5b8eb18ceed8d53f55271ccc6091a0ba9b01af809830fd1b6fae5caf6a57
-
Filesize
874B
MD5d1c1c4ed21a3d37917d86efc0a717ce4
SHA1e5819a11395a745544e2f2b20525ccd311e89e22
SHA256f5393f4f3ecf4c48110dbaaaa14d9f12e5b6fd68656a2fbd46e71b099d2b8116
SHA51293fcd4744b8901cef4deb7d6087bb092241d0f5e2c82fd52f34a70ddcb0ad6058d00cf23f8a9d2119809349fdb7f392f69e75fcf0afeba95bcbdd92ef96e10fb
-
Filesize
371B
MD501881a48d1ced16986ff0e2883a18a93
SHA1ffc0fda0cf94cd8a5bdf9d7ead846b8537fe9fa2
SHA2565cde5c843646941dcf0a75efda44998d858417bf1719a6f8f01aef90d6b09684
SHA512d43759e6c1d70676ffad9a6b519d9cd4a57dcf4d7d6ff92870c623c64ceb756d7b84452be6c0313b0aad876f92ed6c85cd74a9a603214f5e4348f0791c7e15f7
-
Filesize
874B
MD5a71ff49565178f115ab64b5369463a98
SHA1112fca97efce8bc04158a8ac262c9d6c313ddaf3
SHA256827026cef99eb97410b5b081cac25aaf99b27bdbe1513a9bb73e4584962f0244
SHA5129629cd3afa521801daed7859c4b55e02d2f3099d33c053918ce51071801f04a2e51fe8e92a9042881a97c236fbf2fa8bb553cbbc368421b2e2d45b0b13fe4bb3
-
Filesize
874B
MD5e75c8f59c2103426dc27678d3d295303
SHA194dab5075685801e200d6937495e49944cf1488d
SHA2569cbb0fec20362399404dd7d5b162668e775061d58176c56b10295cae27f11f2b
SHA5125d7ed477f3ea03874133fe33fd8cff17e57415810bae78d499bcb0ff33b2552f28146f8f09cee15282d3142bf85be827b4412fc58d05a833309067fb136c51c2
-
Filesize
371B
MD5b427f7d8c88488f0bce256cde10f9346
SHA150ff8f3f9bc51e0729d850f6c02cfb8163743e9b
SHA256e0813bf3ea999e14275d9b40f6793f01a5c68a774796a6ded76bd7aea143157f
SHA5123c584efc37d50722f4fadd90622e4504f98dfe0b9033131b0f531aa3d997d56d1b259431f4631294011a769229d9dacedf2f98c989ec76f9d4fb03edddb24f56
-
Filesize
371B
MD51018b278c4d6d7ff9b7957b8b9c78930
SHA1fc482857218a3a28dccdc33a13f660bc2cb3da70
SHA256e401e56d978598cd8c1965cdabfb4db32b6059df3cbc3a28cda5155b36b49c8f
SHA512c030c26ec3cac80831dfffac43727800d8018c8e9122eb184d74437520dd32ecae553e7a7822ccabafa83f8de3c1a2d19e64ac04f71702e4d532198bf94333f3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50ccea395c730c0e9c74071b76475be01
SHA1b185e234625b174098c4e5ae197e601369982256
SHA2563c62c4d33eea17f23d7aef1e773584c4bdc2ba4cd4ccaa07ff67475fd1668300
SHA512872518638035079b512ad904593237e213150e69b59be4a80c26acf07147913aa9c86315f38ed299f2c99d7f3a2d3f1b44229b2efb4ec735224c86f591c152b9
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84