Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 11:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pdfdrive.com.co/7-habits-of-highly-effective-people-pdf/
Resource
win10v2004-20231215-en
General
-
Target
https://pdfdrive.com.co/7-habits-of-highly-effective-people-pdf/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2032 msedge.exe 2032 msedge.exe 1168 msedge.exe 1168 msedge.exe 4456 identity_helper.exe 4456 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe 1168 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 3792 1168 msedge.exe 83 PID 1168 wrote to memory of 3792 1168 msedge.exe 83 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2344 1168 msedge.exe 84 PID 1168 wrote to memory of 2032 1168 msedge.exe 85 PID 1168 wrote to memory of 2032 1168 msedge.exe 85 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86 PID 1168 wrote to memory of 3360 1168 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pdfdrive.com.co/7-habits-of-highly-effective-people-pdf/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd7cc46f8,0x7fffd7cc4708,0x7fffd7cc47182⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:82⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:82⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:12⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:12⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:12⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:12⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:12⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2180,391490218834515832,4338602920945329228,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=3708 /prefetch:62⤵PID:1860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
Filesize
30KB
MD50163a422aafb83c214f62d19c936a490
SHA16b5779b134ee9cdfd8f1cfb99bf094b09c1ff07a
SHA256d50229cc42c20999eeec4246f1533aecbd7d25015faed390a4bfa3360b016020
SHA51201ab03d3d52b4629ef7912d722932f3109584a85770bee0fcd6b19a09f1abf0f67864c1b6936efb652a86705f3261d633a63ed424b6286ff75b70d26df2078c4
-
Filesize
50KB
MD5e62e55896501ae26152d79cdb0baadc7
SHA165dfe446efe637169752a3c3efcf577d080cd838
SHA256a07f7627e4a8c2d7d46e5da985c86b7769e2814bddffaf6bcd5f88aca0fb17fd
SHA5120b94e1b820fcd161c83d516162c63d9f11792de89988b1180aade4a486b89723b1ab01e1deb44efbb4504a0ba7760288a8e3ae5f113a73f76715cdc005d2262a
-
Filesize
98KB
MD534b9371331ba8324177e64b61a379dc3
SHA17b2b191d3e18bf213db4f5b3ebe1bc60bf17d059
SHA25626d54ca678cd6d5bc0f7674a2191b0948062b48adaa4ebae760d284407896438
SHA512bf9ae787098ceed83294a066a66789882bed97bda212f6b01318d59d8531781bb4a21bd5277f04b25d5fe652354db7ea245c75014fea6b3c2f86f2d988ca2b44
-
Filesize
138KB
MD53a282640e3bb8d20f82f1447367a7f87
SHA1dce69ba25f1932663a3fc4fe8b3210cb240118e7
SHA25669d124d72076a70e3c5f1bfc8f71b551138bcf23d9e9a8472844dca223aa48d3
SHA5125f3112e3940c048b5da35369264867154c24a1e8bde5e2b3a11bb90cb7c6153e5064e2fd590b61d7f454053fedf0a498fe555082244e262b9493344f55686257
-
Filesize
67KB
MD5e0227b9f6da754f85019943ab37676e7
SHA160ece67cf54a510fff6c6d7a5e5be94570be1d9e
SHA2565003d1a18c0d5df01c68291fd2e3a177235ac471edf6b8d434b05cfda2480411
SHA512f3d3263a7b92ad9d557a5fdde9db86961422c3dbd98bb3b510eaeb0b6f3826229fe98d705624950e79636d9e52cc005673e489dcfe472afa5ffa0491a6ab5420
-
Filesize
19KB
MD5ce2bdc9ee291575700acedaca2d1a2c0
SHA1817f29c93540b36b63dbec76ae0be774b6d2f4d0
SHA2561ee77085d6e13fcdd5355d7167157d4671e3d3d96f75164d95dcfa6318e86d07
SHA5120736e870fbd29fd1ff93a65cc07fc148b1350126d778b989570cdf01316b7eeebfafd4c3932dfd885d95c325e2a4664bcbeebc10f3b5e668bf164f692778fbdc
-
Filesize
19KB
MD59d43bb045f7444664c73333b4fc58220
SHA1bdcf0fc36256f6893fc367dac9e4e439a78cd370
SHA256f9034ce9158cc96e9733081513717b58b14f843d82bc6b06e89e8e421f68f7da
SHA512fd886e47eb0ba8401db2f8a8fca40a3d046922e6825f200f6cbebed7f8a79d09f8f8f65cbb9a3e8d2eb7e36470bac0f8c185898084cecdde59b4997ac1ac41af
-
Filesize
53KB
MD5ab36645f81a569d8b0d5fda401518a1b
SHA13d42ed859afc97aad6e434124a3317572df7b378
SHA256310eace64047d818ded0683d9cb4a44e835c8f8b9f222ff69222b99296bb3816
SHA512f81e51ada94e3b5cce8794d1a45044f457b9e68bd2c8dfd213387dd7f63b1c44c11f37ca13155f77725dd2d8d12272d7ccc22162b6c1c7a2c51c65fa5e5dd203
-
Filesize
33KB
MD5680141aa43a8dd60515aab63dfc54e30
SHA146f6c8c0ad37f168bb610590becf9ccba479736c
SHA256beb3d4158850b9a762a9971e363b6c493492410ec49266ab0f11b3232cdb42b6
SHA512a22cef3c65b372109f01ca3198cc02e3f6ed0d4ba08a0d6dd513dd45a6e9df4fc2fb9062a12a71f2eb863fee746444c8c4ddacac3b6a72e674b1c78d8cb8bdc5
-
Filesize
53KB
MD58beadca7ad14c17b9543b4b4b2c2144d
SHA17b9cad639d5c5acb899a29f6cf44cdf9d0736515
SHA256ec06ba310b0aa62712c1316ea5f5d72a13780c208547c27808720442811d5dbf
SHA5120a7161e4b7fae41081b140bc3b0323b14adee690a36da9073107f7e42e9e211cbb87a85e35c3c8c26d68f3fd1933c996a53c38b8666b8826788295babc12102b
-
Filesize
3KB
MD524bf1199d701eed347795c178cc3512f
SHA1421d853de44b6c8147d5418fa9cf8ce2ae39874e
SHA2567c61d8554c779465d7061c77852fe1b61f6f83f4c4d3a34d318eafa9b9379a38
SHA51246fd4cc2eecd16de5635f572722f8eedc447d1a0788822ad1735a8a7ec230d5ac942f87cdca2a1a196dfe712782cf9f9b700238123f5df4eebbf8910911e4867
-
Filesize
3KB
MD57427363cd1363dd1578c04834ebc8b5a
SHA1d6be1adc7661ed2e8c94394d70a1b85efe7300dc
SHA256729ab7f84f4721089c64bb2ba41427f98364423678152e864b76ee005b79c46f
SHA51206636c3a5354509a11671f561d8cc8c08434b95b127d608a4e4f4616891b279a26db16c52952dcc7d1c1356396041ab92f97abc48167cdd1be4a3eef754ccba4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5a32c13c5d47c72a323929438c4a9eef3
SHA1559df717e10b884572a309dc6891e1f23bdee922
SHA2565e6e3ccf8c2e9dba9b0627f2c89aa806030c8f5c8c00380c4cc10e10448e37a5
SHA5122825ac25f80253da9333bb9cac45359c02084d2c5c0b3b5d66a9aa87ed52448b1e5ac6ca039d917b7621140ccdafeeab87f7240017f10c76c9e7de3bffa23e65
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
3KB
MD5fb4c501ec63de31fdb7be9742594413c
SHA11e1e851bb772729bdac62f8884e71ce9dcc3e654
SHA256fce4b456706c5494c946b652c9249c61b0f9f54d1d19377d6af294ce94198112
SHA512d66074f170f4fb233228ec12c48f224ca0cfbc3cc5ee4a7e970c2ca86d2baa32ad1d99a799ce6b0a417e739bb50a5583ba52003a24e461c29f4df194c7798f89
-
Filesize
6KB
MD58cc8e5b1614d7e014d037599ea708f4e
SHA1bdb6d361d7ae365af395dabf737cfffc2681a885
SHA256a98e41484c0096cb75adb5710af340c10e51d2cd51a418fff6627d8a597e5337
SHA512e6ca80dfed5535bfed0051499358eadf36d08fe917ad95eba15d7e27bd31a47ae40d3f72ee31707a8cd1e7fa3317cdf3ffc22067d7dbda1178f511bf52b2ddbe
-
Filesize
7KB
MD5cb8be1b67e05a46b36efc134559e9e30
SHA1870466aa410634effc0a2d7e18c48112a3f2e072
SHA256ff37ae56536897d1ccd6f49ef725d60852c045712edef0efd67652f944a14d3a
SHA512b326ad876609156ecd91c7f5ab3aae2a1158270ef0cdb8c322a142d11902de5df3fb2e7fe4a161fe13bddf3257068c22a654e833f8770eca5a84900ff513d4e0
-
Filesize
7KB
MD56adf0ed769b4751aa3565bd4a845710d
SHA18377632bfbd1286276421c6b1280cec7cec8c77b
SHA2562cb933d2aaddde8167ffb6a9503f60d118745c97882e4adec6beef912c5e3be7
SHA51208b05b63cbe9a89918e11ed3f2daadf1a3bf41a38b716a8f923ab6bf6d6043238e771d1450a9ffabe4da8931cd6d800ea1e89afb05c0b8ff4b36f7c4529d6e6e
-
Filesize
5KB
MD52f0e72cff1f9a8f712f6367025089fcf
SHA13a71e652b57f99d818ac174cf01914a327b13d5c
SHA256f1df65360c10e45c484f7eeed41bab3412cc3594dc3b8c74b6370cff1363036a
SHA512655929dc4cadbee168f0782538a2d3454aabe6814dd6bb82b0a9c3e57a21f5140436832a333dc111e78135c24e12cd69face23b159107367b93527d117db48ac
-
Filesize
7KB
MD578c68a82f97b645cf3436ec276d30ea1
SHA178963a9c393888a9de6bd871555e91adf919f020
SHA2561656b912b00924379f09041dfd391d5b5f2f6af13c01cdb2b8f52158a7ae1638
SHA512d05af94ebfb759089e20423ce32505735725a480b427db72973e246e0ff297bff9c0901011998c016783ed710b3fdabdd2bb505d3d3e6e64e505f94d63b76a9c
-
Filesize
7KB
MD502baf43f3311ec13a90530a977c861ad
SHA1cb713f170b57b237b0ffd400b256bb6046b68638
SHA256b1e101da3b3368762e2bd58a00a2515b6c2a0fe416ac2275ac05bdfad9638aa5
SHA512c417f487413c774348e6a7f9415d4a2040b6f0d7b4ed8e067e97c0d4a40cc4380c8643a405ec38aee6d973452628718a0e7156fd9c22643e30c14f37fdf3f3d4
-
Filesize
7KB
MD51bfdab5aac2f348bab658944ea61dbe2
SHA17d31978907edbbf39439f181d8236e631d46a69e
SHA256869bf2c80595451e8d55ef3c8978af61131055491d72773530f0504a755c26f4
SHA5125f37736df3b66dd57ec758e6127ae1426f30ed45ef24b59d1132883f0ac2bac7e4f5035041e006011b4bf2ffef08806066723e94c3b1a7059ad4e1cb0300c674
-
Filesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
Filesize
1KB
MD573470c8d9babf5dae2c20bc61968549d
SHA137d5dfb8557d1a1a1631af6b270b5c8c3a3a78df
SHA256873c5275f14f5a254c1c0084c5b3a178fbb74f844a0113aa3894ff25cd6a8a26
SHA51203fe42883aa756d82b8160987b01a347792b4c82c25dc5ba3baa5b02b5605b67088db0ef38460708ef9d2bc505175b2bc58d9c28d1870ef86230568318006304
-
Filesize
872B
MD548a599c90336304e929970f8974c4ec1
SHA18fe9391f549a7615ea305806da6158900d002661
SHA256487814f31c3eb47c3f58e4396f481e1213ae70b38cdb126800a7c742c1883997
SHA51223952d40423024cfa03d735ab75553913058f3db364648338b135a51ed2247c6fdb641550cfbb52e6a918fe585ddaa9b47b744d22bdfda14ffce8c5eb8ce546d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b7e070781b58ddf66d682fe901d2c094
SHA1a464cb2e571bb58897dd75e8066976e60f932119
SHA256f94203a5a566801f936aee08e3be32bae0b61359dd4c6c3e2b4ab80ca86427bd
SHA512e81bff196ae2c59f831708b0617492bb20e70b2d217f549028086995d54e8a463dd3e0a143380bd5f2150dab3bbc3d5f031fd91ea7dd5b00f1f92ed405303d7e