hxxps://anthonys-organization-1[.]gitbook[.]io/k-tech-suspension/

Analysis

max time kernel
1048s
max time network
1038s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anthonys-organization-1.gitbook.io/k-tech-suspension/

Score

1^/10

Malware Config

Signatures

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{F76A3EE3-B63E-4B0D-BA64-AE4F92BF7107}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
3420	msedge.exe
3420	msedge.exe
5036	msedge.exe
5036	msedge.exe
1544	identity_helper.exe
1544	identity_helper.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 208	3420	msedge.exe	82
PID 3420 wrote to memory of 208	3420	msedge.exe	82
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 3392	3420	msedge.exe	83
PID 3420 wrote to memory of 2696	3420	msedge.exe	84
PID 3420 wrote to memory of 2696	3420	msedge.exe	84
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86
PID 3420 wrote to memory of 4692	3420	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anthonys-organization-1.gitbook.io/k-tech-suspension/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc057b46f8,0x7ffc057b4708,0x7ffc057b4718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12426443894946693411,5270319009828017590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4b2a9583d83fb445a59fe6a55028c10f

SHA1
272d38a8e8ef3c2b9d969d77f243e8bc4b1b3962

SHA256
6aa46cece8ee22d353c8632f5210c3a5e90540deaa72c809ef09893bb8d1c8aa

SHA512
6fce1673215e65e3e601febdee1d85eb3768f7f8794a860c0c1eec3a7f83eff7ff7737381f02c1e3eb368191d793a00bba706f0fcc238eeb378c9d489d528fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a43cba441195d17a78bcb8767af222f

SHA1
6fee65234717d7e6c7c2566bc681f6e7e207fb51

SHA256
1dc7f7c6b432e6aa80bbe2605f41c5bfaf6fd300160af465b0886e7e5ad462e2

SHA512
e29c78d7d9c5e2d978533a610b40b2d6b03b7af5694de55879e3f08c1b8289c6ee6b6446782f3430b683b1cdd4a2ae6e231778eb0287186567bf84e782d42546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69b5099c4929fb8bf7e5fb1a05698c93

SHA1
0adc0d3083e247c81469bddf293fd7e0162d0a4a

SHA256
96d193b4531fd51b648373e708fe93327b91c9024bb5ad70ffbc517aa51b189d

SHA512
0d0a3a92c7709f5da18416bd49b9cbc26c9a26d37bef4010d10980064049099b730827d5e68108214214f0ee297eaddebc3822f00d792c1f9d50bbf3fc339f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aa61d00b2077542ab94d3cb837568f87

SHA1
999a0a4c7996baaf89499fdcdf7b7e2d6e650112

SHA256
07c08d957095cd934198e5f730d2cbefb3e98f93a3608725b77fd9d54835b302

SHA512
408bfb774f664a510faad6584887cd1fa1df6ba6da3e9945436bcbd5b4de247e379620d09264166c5759e3b9d72bb88576e0f9d0ade61e7b5d6e7824afc4e3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f13b61622904e0fbe3ac4043c4d76e2

SHA1
3bb79fc170e96d035c915bef0b8db115311ef919

SHA256
8ce881e5c1a4418385fae1cc3daf6501aa01c688c2b87a4c4960a8d3a3aec3a4

SHA512
0f53ab7514493b28f916cad6124dfea5b7765b0b4fe20d02b79146ae9351ef6e472db4800c65cef2c1e6db91a2048131c210636e233d8245de8aadf130d10cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f8e51b0e743ee30577d294394d86083

SHA1
edfd0b5f07d66e531297646f54d5a89298b18678

SHA256
bd25d1b0d0d8fcc5a7c4d787bbd7f83d6d363e725006abcf22fca9e34c1de9c3

SHA512
ba0a70f08b88e3c0c9b0212e9c78d54281dfb9fa84dcf9764c5d83c7ae24fd7efc25a02eabb868a16a2daafccf943ab0e3d18bfc2c42e6caecb65095b3c487b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47d12c94ec7f09309cc1347dc499efa9

SHA1
dcea0bb25ee16d07e48fc15eebd59a789762c25b

SHA256
fdfcabbe4699b03837aac03de5264c93acd392a4c3954045e8f01f8f7401193d

SHA512
a694e89bfa04490867f53a6296c052e02087efc7b7cf4d40e081c6c34ef81e80a4f942a3d786742590451ac7248ed6aa60a701b89132c6d1a9615e779f408027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd9e.TMP

Filesize
706B

MD5
eb87cc9482b2a66698db9f4501bea639

SHA1
a8e4aca398829a2d7b75ec1c556ce054a3db5da2

SHA256
c6554a23e24a22b595ab5d9fa7233e8cb99fd58e0c625687d712fe53efebe3f2

SHA512
d5607e337738a0953a3662d1982b9d3c5af69e1344243611215d41d936c6db564d6a132c005c18be8b06ec7043296c05d5266924f6a737a807466b34311902b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0e70dcd4db0255ab1a02737bfa582bc7

SHA1
ac7cda3dc109e5dee6a134bf2b357315cc0f4fd8

SHA256
3e4191951741274d1032a1e659d888f4aabfcd508457bb328d9e40d370e531cc

SHA512
51a60b590340333d549206189f890199dfa41e55d0c61850549a1fa6448140bc8b945258a4d86a300247b8bd650c992ea041efdce9f5bb97b434f6f06819fa97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0d469d0bc4299e7eafde5d04cb6eb98f

SHA1
d7f822f2a82eef2b09be5887354acba373beb375

SHA256
9d79e6f3737259f2287f9cc997329bddd1c965a0a2ceb6c5d90b72d1fe9a3deb

SHA512
19def4a35eca9f052de81f92f69529d1021a8ebafd7d6fa830ccf2f56e2c4c0717386219c6761ccdc2d34b69f86c568ea02be84aa161edf240c8b41cef974c04

Download Submit