Analysis
-
max time kernel
519s -
max time network
528s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2023 08:38
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sampedro.biz/wp-cloud/login/[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://sampedro.biz/wp-cloud/login/[email protected]
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a7bdd19f-3dc2-4f8a-8563-19f8bab131b7.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230508103901.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1568 powershell.exe 1568 powershell.exe 396 msedge.exe 396 msedge.exe 2888 msedge.exe 2888 msedge.exe 3316 identity_helper.exe 3316 identity_helper.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe 3220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1568 powershell.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe 2888 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 4728 2888 msedge.exe 86 PID 2888 wrote to memory of 4728 2888 msedge.exe 86 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 1160 2888 msedge.exe 87 PID 2888 wrote to memory of 396 2888 msedge.exe 88 PID 2888 wrote to memory of 396 2888 msedge.exe 88 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90 PID 2888 wrote to memory of 4904 2888 msedge.exe 90
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://sampedro.biz/wp-cloud/login/[email protected]1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://sampedro.biz/wp-cloud/login/[email protected]1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa0c346f8,0x7ffaa0c34708,0x7ffaa0c347182⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:3844 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6cfcd5460,0x7ff6cfcd5470,0x7ff6cfcd54803⤵PID:1660
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:12⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5636 /prefetch:82⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:12⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5792 /prefetch:82⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1748 /prefetch:82⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8129837722371575657,4219918925455345444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:12⤵PID:3912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4616
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x2f81⤵PID:2516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50820611471c1bb55fa7be7430c7c6329
SHA15ce7a9712722684223aced2522764c1e3a43fbb9
SHA256f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75
SHA51277ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148
-
Filesize
152B
MD5425e83cc5a7b1f8edfbec7d986058b01
SHA1432a90a25e714c618ff30631d9fdbe3606b0d0df
SHA256060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd
SHA5124bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77f1cb1e-1387-43ee-89e0-6b49ad6e2887.tmp
Filesize538B
MD58ca25e7051269b561f2ebe3815713bf0
SHA106d926b013d886cf835304e9e11ce808e962e82f
SHA256b23c060d95891849e3c5d5eae8b7a3451c6b85f7167468aa7545b867f256598d
SHA51248a887fa9719334d26f31e4221897efa5eba8709a91c5c2bd67ca8244116ad3112af2a6ae551f62735b04a5f9a5239121b18a8d46358e29e76c32fbc0e2ea1c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD5fff24cf2713bd7cd73b4ea9d72edbc84
SHA1a9c0b348d4b1d8ca230be27649faa45c93b57ab0
SHA2565bb91f36006b62c7b5fa30904166a46898ca9ec0b5c66d835b1ab38ddc11c347
SHA5120bdd1dc0412fe4222260c572bd270cad2e9670bf92f8b799a4e9b8b08bcb61060db99ffb2028c639886d90f6997f61d23d2b4081f79421b3749c2aecf8104fe2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD50dc1280d2f31878a53b7b6e088fb4c3a
SHA157c5870b22ea56dfcef40b1da32263056462a260
SHA256f2b3b5899d47dd10c3d78de46c53a4100e54f0a9b754c308063b97749c9570dc
SHA512e00f093e7a1b3651df8292f63da5022eadb765fd5649553bbd548e3927ee74508b6b6e8afcea1fed2a4b3a8ba3233708f17e4aeb704edd220275eeecbe6c166e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD51d93409e18e382dc79b9cd6673e9031a
SHA13848e10cf139d959059c024ef6c5f8f89f6c5627
SHA256188d336e771edae09ca171c6eeb96300c921ce2683255d2029fe3d068cb0bb1b
SHA512f3e436a281c6052484d89e844fc77571db43eced883263c9d64b74a7c8fd267c652d04f323327068a279a28e8be303fc944edf50c4cad51ca4457ba46a90dac9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize600B
MD5d8dbbbb5cc3e306a6d7f93ddf567388a
SHA18424ca64a5c7ca7a669c384a7b7b5bd62a779a1c
SHA2560498d37354573d0d60d77285202b8951f004c3af2008dd5b829285e5b9ef4746
SHA512f8f5b8fd913af536d62cc29ed376c7bfa79a15232c472febf3502a6bdc42f36aec1087c5de5781d8a8d4c5339efbfddef1d28c2a3d3c07fd8fa707da381ff9bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5a3f1075c7e046b9db08dc171f6ae9677
SHA1434f7e47a7d1172cd04d5532456b9d31a9679c5b
SHA25662cd31c9b10c80045f533625951e58266fbe85206aeeef7464786cb9204814bb
SHA5121fa320b899bb435ca5c4e727ce0f54d5ed7c9305b8a1cc7f789f41c27afca320f3dcc3709ebb0f72b4545fbc2bcd0fab2b5fada4297b4dd940b5bf4242ec730f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5a0c9ea8a6fd60e05f7e7c93eddbc0fcf
SHA122681a9100e84b00ca9eef6950e35b3f9cbd24e9
SHA2567678948d6d43647e37ab9f2e0788ceb8068a3adcb13037f3a44832c12da4910b
SHA512d9e582a7f818f2a84b53145428fc7a2218ef4d9eb77abb5bda2c1868651e0840c2aacf2c2dd26e417f500a0a96c6084035e6d66d7c83f7083a8b320703b9044e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD573758dbb8bc5fc62a34f73f9fa5c6b11
SHA167512433dd832765b3b23aaa2078f2a15fd0f558
SHA256376b2c96c7e199fb26c5acf78f58f6af6036e3d2a7db943bb42ed2a183f6fc7a
SHA512071965399e8df35345f61a855721ea2d690b4deb4b40967f0a7af12fbee7b500a62933c774e7c733adc84ee0f7b57a7217616a16d68ff58cc075c5a328afd101
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD5e89b184dd61d9de82a0200365f5a7c62
SHA175ff132d4b155ae93bb0b8ee7d4fb20ba7779c37
SHA256c47c42826a8d08986ddf1c219394b2ee7e902308120a6afb7c73bd444b115f64
SHA51258a07b6652ff7c5e99d4450035e41f9aa578f0eb092d6fe4ac73eec12436adefa3c35a72321c220ea7ca77c12ffb54a2c80fd811c0a520c141486e0987711fac
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
777B
MD52ea83fdd831b5d9a530abebdfc02c890
SHA1637086c551b53afb798876b5785a5315c80cdb7b
SHA25681a5aa3a2a4072ff0768e996b696d99a86939ec7e8e6f661ec7c8ae1dc952a9d
SHA512c093a4a62fd3aa21f060618025c67fe0bda785c3dcd19dc15272582a4b96b117e2b2b8df4603d60d131eef18150403efe5ad2b30ddd68fb0502303d32a9ff6e6
-
Filesize
1KB
MD59fbcbf923f7ce6a0d1d46fc06b4d4177
SHA13568cc45c885272203695903bb4cd0129bce3b04
SHA2564a6a43c7c5475e47b62d2e6860dca7a57feb16d94f3433f4fa6520357f19dacf
SHA512388b1c71791d82ab4173419ca36749fe3920664e4baba5cc36115dfe974e597d38fc9d05dc10510df95ac37530fe79c6b7f34bd448d64649d6eef3bb5019bd84
-
Filesize
1KB
MD56bb87f025fe62f09960ea96e1f959b11
SHA1d9a38837c80ed0592e5d814a6fead88789d5619b
SHA256397a7519ae15b3bb145f6b18938fd277944a8f90d58d5fee21181afc522d1eb1
SHA512a8624dc467cfce752b1829ec8568a24e5ce199b5fc1920096402304b41251de9f9f8c24db71ff5a425d3188b52f92a76968b24778135eb7d75295fd153b48386
-
Filesize
997B
MD520e80ba9b083015ac8063284198ee6f3
SHA198a2f5a1cfd797f5467b3a663ef9f2113d2f4320
SHA2564f20c572bfaed3ffa5a8129f065f998dd54cc9918ee2af49e9ee3833dd391f33
SHA512a0fd48fb70f2f64a6a5dff0198933a0d1cd0f38fa74fb913521eb6f5d9b99299309d340d717a39dc9093154d9b4c46b99402b903571b90feb13018ed312a333c
-
Filesize
9KB
MD56974c41c563b6265e9af7a78617efae0
SHA1f614b4982ff6ae9cd1c10adab3d97290c9eca55e
SHA256a8e14569d4d57e2763b80c7313b39dc13c67f5b06ca51b89a374a6c7809118c8
SHA5124142ad6ff95b1b02f2782d10866db58ec82472826590e17469f15a5b447cf6cb0690f6059ceb3e1a58142a970935abcb0fd0d5931915f76da8df23789dc8950e
-
Filesize
4KB
MD56d0812bb073b1ce10f3d7b1b913aa6d5
SHA1dea2395753dac91112bc23881d75817d9d96486e
SHA256f53cfa435fb3943c1f4638d59060f5bde34702208a52a6cceff1ac4afab23e31
SHA5124ca717f55ae8ac7033a6a96978fb2e577d2dc5cba6c49f93073f742746b0cad3109cdba36da6ab35d4605f375d81973195b1d1e745210ebe5eb709f00afad749
-
Filesize
5KB
MD5e545b67efb6804cf2cf0ad4f465e9f6f
SHA1032aa8e5d03aefd5a8ebc2dc753b9b4e8170595f
SHA2566d5f8284b861875c1ce0cd4ce8452e418d227896c87fa35d4e0cf0bf7021726f
SHA51283558a7681a3c102422fdb6f05f49824f9a331dd70c7dd46785599d883a1a9aae67e10cdcd8b295383c8e7a90e8bc16d14c6a892b097eeeee7c6320cdcd1eb8b
-
Filesize
6KB
MD5a967dfb4da54fd23edea991fd4b20204
SHA1e72f1bef11705138c1c8365eb03692427bd51bda
SHA25679695f1a5b250012814ccbb30a163a78015136ac4b288ea8a88218224ffa639e
SHA512e6e3c755e62bbdd27a89f2b2380ea693d58745556fe47f0307f3eee732789f7d3094fcba1336292c52ba9d439098258e1402122b3ab831cbbe578391410080ad
-
Filesize
5KB
MD56332f1283b3273c1b6a0ca444e39ca20
SHA1d2be4094a095bba07040e0f5e3be8e1037c2b680
SHA25626e747deec58e8d29c525c5fedb8b1ddd1d34ac6858b996fef87e10fa45510e0
SHA5127903b1f31153d48ad2861907134e960ec5a1f2c5e40b252afa7b31f7ee9282ef5ee12a89fb2ab768aa5ad9850f9eadb8a0022b45c15618a56f73427da9cac622
-
Filesize
5KB
MD564e9e6413538669512df08f68b1a8430
SHA1613f3c4f5ae20c1b0c48a7d54b856dfc81bb5a78
SHA2561873a9eef4658bb3bff64e19165c48e36bb513ed4f6da7c2398b23a8308b187a
SHA512e3422a96dd992442d9f4f2e5a7f060c0e98f2f1d72b30eaf5f3e526fb4f6388bfbdc49fde6ff42ebe08a32f2886052fadf145469752ffa285b964dfcc8310be7
-
Filesize
8KB
MD553a0ffdce1ce8db4dbcbfd930470dbc2
SHA16e02457c8bfee7fe8cc8dced8fd741ecfadec4da
SHA2562de43867292872afe75f0f43a6b5a9bd346185c86f1bdd53e29efe7ef90dbf15
SHA512c1a8abb58087caa21d32ba11250d92bb0363ab5f05cfec39c233b38ec372769a65807b404806a585da1c603a9ed81facdeca16a8c8bddc8015a76b41857df472
-
Filesize
8KB
MD5b614a71fc327c69dffc5905c3796e88a
SHA1df1cd6d42d44e51900cede7a31f9105589fb5bef
SHA25655eae80c6f3f399c8b06cd6a5e4c721aab4676916f9aca619b1ff5b71cdc9542
SHA512f18d1db59ed80907eb6ccc6186ee1cd58afb3cd3a003918d7eaefe25644bb9efc3ab1060f178e746e449e2cf5afa978050fcbb2d9949c78a912e8adf0ffc8c79
-
Filesize
8KB
MD5290c9919c7b6223b1efda640e261ad1f
SHA1f14c258a71322f316f20da4694779869ee23f749
SHA256379352d3ca62d609f43fa6778bdb928084bc1890d4929691321a036330d9eb33
SHA512174e0a77e6b31141e2a9ef7f6362c7c033ce592b354772352dc49460578cf16895e318e0364e87c7a596780eeb10c011bd15b67807afb198148bf8ef2fc832b4
-
Filesize
9KB
MD52d1ee6af85c4fdb9b7bc5a02d852812f
SHA11fce8c1535bfd09d0dcc5e086de3f97e0a0df6e1
SHA2565b05e5c8acad4b82fd52459ecbeddda37f49db485d40ac3f8bbf8423f10f59ef
SHA512a9453cb80256041501721be4b4ec60839e9532cfdb185da919cd39bd5383a1884170676641cafcdeed43688c00b87e8d0ea30f20b9854b646d0516a76ffa1878
-
Filesize
9KB
MD5cf20ad8014a8ca6b48b5995e03296f3a
SHA12bc4fdb877c39c2c8edc0257d70b7ce9b1c30305
SHA256432e2d1d14d5eb8c088ec307e4a54062c644c3387844996a5f864f1cbb74cafe
SHA51207101a9efc1e7eacab8309a178aaa51023ed27b464d8efd1c34a256fc1634a3bacee9f38f8c236e9dad1b4dd5a95fa028476ad67bb78f6bca23ce34958877f80
-
Filesize
24KB
MD5d53ac35ab3976e67caeed75c4d44ffc1
SHA1c139ab66d75dc06f98ada34b5baf4d5693266176
SHA256647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437
SHA512391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2
-
Filesize
24KB
MD5bc5f988722f72244e9a4aa8e1d6a0ee2
SHA14a132601b1d75fe013d364df95b711223eb9f742
SHA2568ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9
SHA512be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
538B
MD5109088bbff7d9c9c8d8796f8d24a1d69
SHA1b71b007ad310c0f668efef77ef7b69532c66b45e
SHA25696c1665cc615a247be49b05cd13967b1fdd44fd80886393e3313d501094449dc
SHA5128fce9ca1dc6238f05f16b52201ab22aa295562d77d433a36e8f82c752eaaf00cfeccbc03e40ae01f07040cf652e7abbc8758c4e5374a24a6fd8aa3e58815649a
-
Filesize
1KB
MD5b6f42faaa912fd7a45dd8636aced1fd7
SHA1a2eef1133ac910961cb47641b769c15475c5f5c4
SHA2569074c36cef8fc5c0755654a6794d4d15d5763d9bfa57756dae6aa2c2dd72b0e1
SHA5120eef3a366dda33fd787a90c5c2ecc917846be03099ffcb8ceb2bf046a9f36f1d8a4e48878d2196e49410da821793d82357a8c596d8b86f149a1a32305a261fba
-
Filesize
371B
MD541c88db5f84f708408021a4f1e273904
SHA16d52127a4de544edb7773bf911b9542aa54f938e
SHA256954ae69a617dfbd8aad581fd500991a582516eaba6c4c2a0821c496d5cc6cc89
SHA512117d8b786f483e876510acc40f4b55f7d47a90e130777f99e0960a14503a268c1cc9f1f063706edde7664e938259f49c949b93fa1a9f4197b3d2c8d401585e1a
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
12KB
MD569baad858385d3dc2a47886d4779c920
SHA17ff9d8631d76194d6a751853ae8d499c33571055
SHA25669b3a532a2c55331c34a17f460a23aaa2f6231a8220cf82e33fc839b20f30659
SHA512feaace56f7016cc411661e5d8bf4dd282a423bf15a62337cc8ce9e78d9bfd532167b9263f25ecddd1d67c499df513f8f1853bb601ec386f58a3e950155f98a40
-
Filesize
10KB
MD56b4327c8b7faf9f92726b40f40ab6ed0
SHA16e200749c180569b9c451021c2a5a2786e0f3e35
SHA2564c99ae42bd5300df862577514e8bee0da27377e55dce9ed6d3c55d9ff7f1294c
SHA51237c186b8731e1fcb38ced12e8eb3eb467759da98fa87abeb61064e076e14b80a4fc8deab962dacd6076ef85c80676d7f264d8f4f109f5229d48657fded977520
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5d2e8c5d4618951a512b2fc9f723a6e46
SHA135858bf27e3780a718883641fb1fd6261cd59930
SHA25629befa557ee6fd7b0646dda399a16f6c4e157416dc1e44c5d6b1a67dab22d41c
SHA512ebe0f0c637f54bfad5dab7f2552346218d553e31b3e800fd1f74c63c55343949f6eaca5c4592b6d08c76fa4c332d0c160250798b7fa03a5519e45b47f886e9eb