hxxp://cdn[.]lkgwbfh[.]com/o841l7912ilv0mpy30hq8768vqu/768kpy7b[.]go

Analysis

max time kernel
1048s
max time network
968s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cdn.lkgwbfh.com/o841l7912ilv0mpy30hq8768vqu/768kpy7b.go

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
82	camo.githubusercontent.com
83	camo.githubusercontent.com
84	camo.githubusercontent.com
85	camo.githubusercontent.com
86	camo.githubusercontent.com
87	camo.githubusercontent.com
88	camo.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{E9066BA4-292B-4391-8E20-F180A17C4754}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
1224	msedge.exe
1224	msedge.exe
3004	identity_helper.exe
3004	identity_helper.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4708	1224	msedge.exe	82
PID 1224 wrote to memory of 4708	1224	msedge.exe	82
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 932	1224	msedge.exe	83
PID 1224 wrote to memory of 4940	1224	msedge.exe	84
PID 1224 wrote to memory of 4940	1224	msedge.exe	84
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85
PID 1224 wrote to memory of 744	1224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cdn.lkgwbfh.com/o841l7912ilv0mpy30hq8768vqu/768kpy7b.go
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1300 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18180162719574564328,12037718927389823852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
da955c990d8718b698662aedd084cf0a

SHA1
1bd70531b2103ae850f8c308a17389db7e3a16f8

SHA256
39d2a1e8cf8d81f602203706df0625670ecb6ba72e71225e7b4c55e7771821d7

SHA512
fcb99d30d157a949e2fad9db4e9d3955c253182a19a3b4c76c45614bdbafa908d015956746b5360f93b6ada00957324fd52f5789636f2b411a50445f64de86a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f4743b1e09af1290f7e98f18b88d1763

SHA1
130cb7a09e29221211489c89c6d1e8000aea034b

SHA256
676da11b9a0faf1019095550b084ff64b6eff22bea53110d9c27960fb882903b

SHA512
4be67369ec5e44c3f20a016fee08bc6f74df7368a9a8e8676dd7f2794a5b9d6188c35f44c9aa2a2928b558e0006913a5779490bf8147bc3eaa976af812102483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
493B

MD5
57b08f42e0c34f62bab072acaf568b15

SHA1
33feecafc60a54caf42428ddfbf5f06926e5f586

SHA256
2e1fefbe644a58c38bf2cdbe5cd4cda7e53ed282948cd6ad7c187d5b65dcb49e

SHA512
32a3e610de817434a73669ab3c875fa0bdb016114ff9085093335f835dba88ac60ebe1fb832eeadc190961251399329d189571eaaf018a1850c36ac2f3ce05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c4387a812a73841140f7334d31bd4011

SHA1
a42d91359385c1a1d64ece9c1ffa236a0fcf83eb

SHA256
1d8b0c72d59d4cc1050162008e249095441350809d1550f715e3fe8e586be966

SHA512
6e33049d1b3936e42dfc9b42b2b4dcf4b1c658b035608ca3670aeb3b6580aae75578e5c240ed5954e60964095c2740b53d903252a52aed831b3d25ed4de3f5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1016B

MD5
d7b5b3a298fc9b1923605533ba79f477

SHA1
942b2abf0b8363a56b6a0d3a1643db40d9a3d5a9

SHA256
fd27b80ecf2a5f1231bc5a1a0db4ab770b36be7207e758f511fb7b5226619893

SHA512
325b51e0864f5934f91930a9c059d2d1666c31e0463c82c3b819fa2e2209910f262006d428e60e6195d0e4387b848972fc359a33c401e99814942bea7528578b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d6b23e476f7cf1fb4b24181bb90a56b

SHA1
8fad085020b3510601f3f4186ddaab71dc11e88e

SHA256
c19f202a16f9cbc4fc50e438743b7beade5d88541425260b26d1badbdd5a2f95

SHA512
67402a2ce0d2ac1778dfaa8f1bae2ce6c55ca451280dd855be3cb5d6ecccdd1fed5d19461f4d8062210ffd94928ebaf46d97c4ec3244780b197ff26a6f7586ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69a89a3a80a333c4940b80e48b94319c

SHA1
52de1bde7e8c7fa08c654489bac54625167c153f

SHA256
bea364495a38b967af132e365cd8275a7f22725695fa9f6669aafef370fcc590

SHA512
bce2ca0cc4c3ecd643c30a5f83a15eb9aae7ad2e22ed2a3eaf024f2faa1e4c9c00b355aaceab7f5a8c8306624da8fadfd52301969f2d3adb585271c9dd898896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9af31da8f1c58118d6a5caf9802b17db

SHA1
14e3aca5a88bab2e9fa25be2ce619ec30722c7f1

SHA256
a8df8fa89492da8a998876c99778200c87b1dea36f4d3364092193cd030bcd36

SHA512
187b39219f4bc83175f40de36291a18776bde7289bab3962a8bd2a9a3b8f10ec7df9e3dd7c7182fa99a7178d53b48f6658cccf1ca3febd0917921187e956b04d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a98109edcc09a3ad2a2d5469dde872b9

SHA1
b621939e127fc71426e5f6ad02e7b6b1acffb0eb

SHA256
343fe373ae90fd9343d657917e87991fc751f9a7ac783c8bf4a74681d866909f

SHA512
a2b4eadbbe062676dc8722958f0769cbfdf3033472eff4f5f9ca0e5d2215eb9c0cc86a88a917a73a28fae0b7b39b5988fe17263e1b80aa7748ff1a22918125cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c59b78a38ce4c3b5b5a01adc818d1f61

SHA1
cb147cde7366ff86a7e1752736c8b5209f8743c1

SHA256
b0cd33eff9b22529e8a809b0ba4df6bd4f9307c568d1a91dad8feaac2505ca08

SHA512
b646905cda8260776d439f4567fcdffe87a1b67c8f437fca1d6d1e2bcb35df70d3bf680a8232e9b363edb30674420bd98557db169cc22e510636ff4b3e18ef1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa92587f255b7c2dfc34ef7336c22ae0

SHA1
8dbe5a580ef621d9e9a21491b2f5df7d4dd1db81

SHA256
43d3c1976bd7da7834ec440d770219dbc22eae5741f8938ea5b4e62860085aa7

SHA512
247311ee2236d861da64dade4cc342184cae6c6940221e4533005e7ed9e7ef9a39f404c8c6956199636baeaf59849b8723e4a12e4ba8b31ce275095fcaac8714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9bb0a473eeda066cfddf321219f48717

SHA1
41323e70932b7abaee68d542d54943592d08d231

SHA256
ee1f212bc6dc65798c977e191b3954f188ef026eacb4021394ce225e377cc295

SHA512
50b5df72b5d55476cfb41babcc14cf4f1a4c1cbbd9c796f832c2a3a4e6e8d7746e91f1751aaa8e7666b22a9d2929568cee175fb6f3f5f306059a356cd8117057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a5015.TMP

Filesize
1KB

MD5
98dbdcf100b066d683cbd11b7f4cc594

SHA1
943569a63b0c6bc1fdd9569cf49a4e9a357aea9a

SHA256
f76754913a5d4377838f733a16cae3a04136d8b37d2808944e58875db2f0be13

SHA512
860fb15a471c36c1ce8035617efdc58f89ab0981a5680ae5c157cebfe2144b1118ea70998d680c4c0dc17d6545b054c7005638cabc79a98962025e84bb5a570a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f9049db8a816bc30564cc55a1c4cf25

SHA1
75b61a310b9d9efdcad5b1bdecdcbfb45dc74741

SHA256
e31defa620f133c37961a3c07d7afe4424f0488f51187bdd6611e55b10d642f9

SHA512
33983bde7cd91ccc9a9d7b64219845bc21ecd127e0fb3432970a99b837fe16c84d28fe8325b6f3a6a006892d31970520acc647fcba00b796884687e456850083

Download Submit