Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2025, 13:42

General

  • Target

    http://link.seilerinst.com/ls/click?upn=u001.cEqgdhrRZKxRF2HzHb4-2FTVNSvwR2gUPLdJeIgfgg8ciEZ40FQ4vOw6Y1wKnQIQVHSeQr7QXxDUmb0wGmH3jJnCW6Y3XzdS7Ccl4QHkCGUzwgtkuYrCh3N4IgyW6jxhL77qoUeHiecm5CPwkRwcHKL7FsS6RvPBFh6nmLcf4ZzBtrNza1gSNhr3vvvB1wkdkQSRPTkMKJ0LGYAXxqI-2F-2BFUeMZLtptgK9XpdWRAOhjMNo-3DIbYh_zb7wV6j-2F21a2jJHEJfT-2FOWzTaPqg4EUmh5Yu4poHgl12exB-2BEMEJoh1Pz2Bxg7fFqwQQjFyin-2Fyv9u-2FwrMMpsAPES5zcVmy0FI6qKoV-2FPP-2FY4tkLDq9RTl2L1GDw5nmAFFGUub0fUn-2FzNOEOXFMSYZnm2zrfh3BxwmbA4MSs6EZsACgrEgIfTWqD5BYbKFuTGnaSlxYkUsSv8ncf9m57vEY-2FpiRoZ2M6-2BJAjR1-2BAbOX5y-2Fe1rneSbzq-2BXusx3dFMYlh2lL5P84OVUbqj4wK-2BwJFDg2JDarfnVQIevVZam7g9l68IHxgYJt0OqXK77uhdn4U69-2FK6G1tr94mdTx3z6rEDrBxXF7h86mvA-2FxPb9pmDkWTOpWuScJggzSlglkHPXxzSTfLeY56PJqO5lU482hDw0-2FAgR0P4wJmpD5M33DeAsmG7xenwRFykEU9PlvBX6b8XXZxzZ7VSCDa7DsVzU-2BcptzLd-2Fnv9Cx3TFYOuu3k-3D

Malware Config

Signatures

  • Detected google phishing page 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://link.seilerinst.com/ls/click?upn=u001.cEqgdhrRZKxRF2HzHb4-2FTVNSvwR2gUPLdJeIgfgg8ciEZ40FQ4vOw6Y1wKnQIQVHSeQr7QXxDUmb0wGmH3jJnCW6Y3XzdS7Ccl4QHkCGUzwgtkuYrCh3N4IgyW6jxhL77qoUeHiecm5CPwkRwcHKL7FsS6RvPBFh6nmLcf4ZzBtrNza1gSNhr3vvvB1wkdkQSRPTkMKJ0LGYAXxqI-2F-2BFUeMZLtptgK9XpdWRAOhjMNo-3DIbYh_zb7wV6j-2F21a2jJHEJfT-2FOWzTaPqg4EUmh5Yu4poHgl12exB-2BEMEJoh1Pz2Bxg7fFqwQQjFyin-2Fyv9u-2FwrMMpsAPES5zcVmy0FI6qKoV-2FPP-2FY4tkLDq9RTl2L1GDw5nmAFFGUub0fUn-2FzNOEOXFMSYZnm2zrfh3BxwmbA4MSs6EZsACgrEgIfTWqD5BYbKFuTGnaSlxYkUsSv8ncf9m57vEY-2FpiRoZ2M6-2BJAjR1-2BAbOX5y-2Fe1rneSbzq-2BXusx3dFMYlh2lL5P84OVUbqj4wK-2BwJFDg2JDarfnVQIevVZam7g9l68IHxgYJt0OqXK77uhdn4U69-2FK6G1tr94mdTx3z6rEDrBxXF7h86mvA-2FxPb9pmDkWTOpWuScJggzSlglkHPXxzSTfLeY56PJqO5lU482hDw0-2FAgR0P4wJmpD5M33DeAsmG7xenwRFykEU9PlvBX6b8XXZxzZ7VSCDa7DsVzU-2BcptzLd-2Fnv9Cx3TFYOuu3k-3D
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffe93e646f8,0x7ffe93e64708,0x7ffe93e64718
      2⤵
        PID:1952
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
        2⤵
          PID:2672
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
          2⤵
          • Detected google phishing page
          • Suspicious behavior: EnumeratesProcesses
          PID:3732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
          2⤵
            PID:4084
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
            2⤵
              PID:2960
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:740
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                2⤵
                  PID:2460
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3748
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                  2⤵
                    PID:1948
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                    2⤵
                      PID:4168
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                      2⤵
                        PID:2412
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                        2⤵
                          PID:4792
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1184 /prefetch:8
                          2⤵
                            PID:4028
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                            2⤵
                              PID:4884
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
                              2⤵
                                PID:3932
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
                                2⤵
                                  PID:3164
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                                  2⤵
                                    PID:5008
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                                    2⤵
                                      PID:3028
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                      2⤵
                                        PID:2456
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                                        2⤵
                                          PID:3692
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                                          2⤵
                                            PID:3288
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                            2⤵
                                              PID:4452
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
                                              2⤵
                                                PID:3572
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
                                                2⤵
                                                  PID:2380
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
                                                  2⤵
                                                    PID:1220
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
                                                    2⤵
                                                      PID:2668
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
                                                      2⤵
                                                        PID:4712
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
                                                        2⤵
                                                          PID:2824
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                                                          2⤵
                                                            PID:2904
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                                                            2⤵
                                                              PID:1724
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
                                                              2⤵
                                                                PID:4212
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                                                2⤵
                                                                  PID:2412
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10538161095630221146,1896774893477473395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4752
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:2392
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:3184

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    56a4f78e21616a6e19da57228569489b

                                                                    SHA1

                                                                    21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                                    SHA256

                                                                    d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                                    SHA512

                                                                    c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    152B

                                                                    MD5

                                                                    e443ee4336fcf13c698b8ab5f3c173d0

                                                                    SHA1

                                                                    9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                                    SHA256

                                                                    79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                                    SHA512

                                                                    cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

                                                                    Filesize

                                                                    214KB

                                                                    MD5

                                                                    ba958dfa97ba4abe328dce19c50cd19c

                                                                    SHA1

                                                                    122405a9536dd824adcc446c3f0f3a971c94f1b1

                                                                    SHA256

                                                                    3124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607

                                                                    SHA512

                                                                    aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    98262438690274712bd8f45d9f1b94ed

                                                                    SHA1

                                                                    f5a9f1be9755443a374633acfca79e9938c5da91

                                                                    SHA256

                                                                    692fb454b8d19e0db152b3192e035b37ac0851cb61a4673439f76ad3ee66529c

                                                                    SHA512

                                                                    9093f76905cdf37e582711cb3c6ce1340cdeb194272658a6037dc34f45f04bd37ef3a5dc0cbe1c7723d850a6e3c5a311b6f01d83adb69e00a7745d42f695ca9a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    2a8c428f1c5273c0b56f6fd1ca49048c

                                                                    SHA1

                                                                    3bb939fe6deaa91a305134f4cd4af47069a7af04

                                                                    SHA256

                                                                    d67437b3073002fac7bdf237f17efb81ea9d5f5134e75eca46cee0eecfed86ad

                                                                    SHA512

                                                                    ece77e6997832d7933634ca792ac8d95c58bb1b03e01ea05bff1150bc0de5920adf7b3232da234738a4f8b6e3f9b84f36b5c84b0915c5984c67ab20b91038e6a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    cb59867f37fd6138fb6dccd99fbd0b07

                                                                    SHA1

                                                                    43c843309bb22c346c86ab2c2509e99c3d80031e

                                                                    SHA256

                                                                    60a508c8ebd4fac06143e019782ac157f2551c7920f3e9095b1f88df8e175474

                                                                    SHA512

                                                                    bf1464d9ad6d05a9c79e9f69952250ac2586db58152c71e87ead9d77fe3656e235d14c0a5c3c444e38c5e8ce18bc3471c0740bce37065662a1bfecf5c010ed3f

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    5KB

                                                                    MD5

                                                                    1c34d61f52518d1ca99e1282073279c9

                                                                    SHA1

                                                                    5b142138c4ce6fc34a3567abea05579e952f7cdb

                                                                    SHA256

                                                                    9f33927ecfddce81faac0cb9da5536fc37426f2d1f9e2ea5f7541e0396faded1

                                                                    SHA512

                                                                    7a5a7fc03ff1ebd39b2d61cc46bb6cd51e32dc81a7f9962b478a27ef580f916b47815ea72f94f4427af30b2e3ba823787fb6039b1d0dca4addb59564e88b2668

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    20dd00b590fb2b2de73d3ec5298daf59

                                                                    SHA1

                                                                    acb183c005e03ec7c5c76e138656004219d68080

                                                                    SHA256

                                                                    bf8e1d12046f0afdb0869d9a6e1fa226669edd94b075ceb05ac94db61fcb6287

                                                                    SHA512

                                                                    93820537e9ba78d78adf19d6cc673edb60744cc635adc767d9877fc079b6e64928462e499f081ece3b74bc79be420a808d2cfc902657219ab270d14c320535ac

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    352b9177d39adaadf624ae3c16c8c2ba

                                                                    SHA1

                                                                    8a17a6d597ab2508040cdaaaa5259b593f4aeba4

                                                                    SHA256

                                                                    7a6b47b29810a66516e4cb81fd78b9ca89333f797ac90b57cbba6f6836cbcf48

                                                                    SHA512

                                                                    6855cb965e972c96a8d45e1072b6b504413f0a5472582593e26d8f0c8650c5b95e278be25b9dea4efcafc7a25f0aedab51de1521b6e52bb904df36ab1463c9ef

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    25fcc1858f412b7b69bc244ff1525240

                                                                    SHA1

                                                                    ad45e4cb2d3cf97976ea1db970bd0d7859336b07

                                                                    SHA256

                                                                    00af4fa6bdf601ef21efb5cd30b047dc68ad427e895bbd39e6480baa213cad22

                                                                    SHA512

                                                                    98f66becb50384b092283534920d26738fc6dfc86bac4f003b8ab75026e51934779cacf8b99d722931904a6d37b31c8ff128b26b215dca14327fb1ce14c02e09

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    5fae9fff14d235dd452698db7fae217f

                                                                    SHA1

                                                                    707d61305f3c343f2d7b0826d0eb062957ca9287

                                                                    SHA256

                                                                    e4280cbc77e1b5eeda5ca07bb2b4207c702debba53a13c6b6985a77f84a32a31

                                                                    SHA512

                                                                    766ae91161edcb99a89baef717ebac0d6f839419c5191157c93e7c92c321e91f3cecd347352f5f2f67f3e5211671293a42328222b757ed09a1298b7535468fe2

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    fffc84fec2bee0c9225b9e9ca839c1d7

                                                                    SHA1

                                                                    58509d602fccad84e1d380a0f394ec4a33615dac

                                                                    SHA256

                                                                    8861dd578bfb328f26ee613a8f5c132d78323de30e47ea272043afe101b01f07

                                                                    SHA512

                                                                    af8db3f79dcef421c63888b9919bdf1f78fdc446acd4faac51d47c8e9c4b5a5bc9c6cd0a6534c0ad082246d82eabafb36e1b5f4cab0ce8c93a82459101e4e32c

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    b1088da27202ae2bbee611baacc94673

                                                                    SHA1

                                                                    8684922be8a7beddf89cf61f003e5f2248905d54

                                                                    SHA256

                                                                    81b8c96ff2bdc257cef0364bb4d56067ee9f5fadb94944776bd2cdae83a19015

                                                                    SHA512

                                                                    1a4ff0f750f486e77d9aa6deaf9416615904b0dc9195c8bdca1d526306c736f9514c0d4c7ac5f3c23a4b776243f528866881885068b95926563f263f26dcd016

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    92fbce9ff3b31d6a07b9ffb3304484c0

                                                                    SHA1

                                                                    5d32008815eb1d4a2bf2f8e10b559167563e73ce

                                                                    SHA256

                                                                    59694b0d32686ffb3d40785a948c31c61af480ac17b94b501f1fe95f4a9e7035

                                                                    SHA512

                                                                    b83cd9a4d3fc343f35b0ac6dbdab3152ead5943b67b3fc763b3a0cfee203651de15be409d344f3a9a4e94bb0b9fc35b4ce3a77bc2afab6417e04d76369e71738

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58912f.TMP

                                                                    Filesize

                                                                    203B

                                                                    MD5

                                                                    2acafc965614998f128c317259659c6e

                                                                    SHA1

                                                                    0e1bec5eb1fa461b7815c8b6af7b75c94c076775

                                                                    SHA256

                                                                    acb19da743e1f5470e253951865029d680d69b408656df753425374df3eae415

                                                                    SHA512

                                                                    2c32e5d8599439a984e5bdd7b1d4619fc69567f853e4a804df858f5dc3cbd4b2cace5ed0d4d15673571ac2bc239c0965ccd02ff4b077c6565683585358bd438b

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4af0cf5-1d8b-40a7-bf88-3b8e4ba9d2e3.tmp

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    0588e825996ccab42ca530d1dcbc8f81

                                                                    SHA1

                                                                    61e46f4d6a4d0a1da2f447bee2a6728f2b53b712

                                                                    SHA256

                                                                    9b62a56e43a5045790a0b78e56bce1f6a739e26c95ae18c25b11360c13492c0d

                                                                    SHA512

                                                                    d6c00b67522725ffb3cd8c568ae36d297db5799859b6175bb2274514d21686cd0b54f19a65d8624013c665cc59d37a85b1c063cd5d051b837e3916e0448cdd70

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                    Filesize

                                                                    16B

                                                                    MD5

                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                    SHA1

                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                    SHA256

                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                    SHA512

                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    10KB

                                                                    MD5

                                                                    9b90df93dfc0ab80eaeddb335c773f05

                                                                    SHA1

                                                                    8f2a2824c652f9117e5063f7c9d395bf305d492d

                                                                    SHA256

                                                                    544385ca6e7ec3717ef500bd2af8257a746ac7a76bdf2b1d9d62afa1ffbc0c87

                                                                    SHA512

                                                                    31daf149e770f7e58f44a1a8c8071e9e15b9c9164bb0bd995c13b34c1387cab30e94134ce284b8cf71936445ea15aae1e43bf07ef8681b70d2c4cc69c6521fe0