hxxps://linkvertise[.]com/1253311/fluxus-key-system?o=sharing

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://linkvertise.com/1253311/fluxus-key-system?o=sharing

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	api.ipify.org
62	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{481B6557-BFC7-4597-92B4-5BCCAD7B9292}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
3512	msedge.exe
3512	msedge.exe
4340	msedge.exe
4340	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: LoadsDriver 26 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 776	3512	msedge.exe	82
PID 3512 wrote to memory of 776	3512	msedge.exe	82
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 2980	3512	msedge.exe	83
PID 3512 wrote to memory of 4512	3512	msedge.exe	84
PID 3512 wrote to memory of 4512	3512	msedge.exe	84
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85
PID 3512 wrote to memory of 4596	3512	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://linkvertise.com/1253311/fluxus-key-system?o=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe008a46f8,0x7ffe008a4708,0x7ffe008a4718
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1184 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13446708891326468631,3444889911030096836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
24KB

MD5
2c92288016ce3a327c2230ee1dc04ba2

SHA1
8cd9f721e5a0f19059854030773f76bbafa0036c

SHA256
3b7b2d0aac6717a3735156eee99212f28528d0dd86d7ba3f6e527535d1f6d398

SHA512
e60e33852a8af310cc8be770afc64a10c63b1711292770d4c7024842e534953de358567da3264e20c393199b1df43e1a98723a1f8bd657dea9a55a6cacb2f0ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
16KB

MD5
61e4576e6aa91cd435fe92f085fb0a3c

SHA1
fa21a6bad3a461c8f0e27b75913c8f1cbe0b2b62

SHA256
78d8aca4e50e6ba58890b68f8c3d6e562ff0b16516a0c3df56be18b69dca6aa9

SHA512
b250c2940f7ca24b763bfcd4d39d0022d6441bad54c415b9848ef949f8871f219289f044301de03313bf8cfa53bb2797c5590acc1b32889b0641f7a13b710bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
859KB

MD5
e283a83101b533fcf8b8e639d9ba4b92

SHA1
76c6f0cca762b34e2e97aab980fb39f34fe250fe

SHA256
cb3c5e3c0d2523a96880bc4ca957aa4225c0f1d90ee278984842386b0e2a5ff4

SHA512
3d8a0360f2496e0dedf4c0ae84e4112e0100c5f4087fb6080b37307aeaa3e1f7996784cfd7551fc1522e06e5a107d82aab308b605c0c870265ee334a8dfa6466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
77KB

MD5
1ee64a77b864507b3bb3f3368fe53d18

SHA1
852b4ad137819722c69e609c8f84ded91e343000

SHA256
9c938ac6b25159c1352fee3b3bff87d737e9ed53ba479a245ae086839e8ce0b0

SHA512
d13427f57fd3335a835e86085b51f97813d826c6f8af0597301b5708d881c55a3fb1f0807ca18087109da95fcfbbcf5c1790cfb9ca3f3c40d6243cde6bbc3e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
52KB

MD5
601943f741ef5c3255bd283c2ac8d681

SHA1
66b2bc531aa6a752ba4c7378b2481de677bcead6

SHA256
949b67441f2812109e3c903210017cf93b77e193f39fdf039ddb219615f7d43b

SHA512
986e1097df020de00c393b4a2cbbf35c451c4628e575b1244d700c8f50b1a819a491663452874fbd0bf50d10129ab3e6991ef8a9e4fc019aceb601f897d5f6b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
36KB

MD5
762274407aea46ce9b0badfe7886034f

SHA1
9477df870e26574c68ec6e798288424a5eb0b2a6

SHA256
499b341256700b6b643e469e7c314405bfbe7f0e63fda5c683619e0e684064b4

SHA512
e582508a8da9cb1b9f5465a47281c4dee0727e3da87c2a9417bf3c77bf5cdf1635893dbb8c0eca6a4afff73a5a63c65a1231a27df13e32f9b57eefa6202ac5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
104KB

MD5
b955f67be6b7cdf7c8677c5b6ebc22a5

SHA1
d7a30a973b29783890de1e93c19d59f878675efb

SHA256
159a0ac475deda522ba32f104b71ee3613ecca9685b0637fc8e9b3899e1064ed

SHA512
cd94cf3c1afe3aa08e4a56f67370b0e66061040afeb078d5d8bf91efcf65346541d38bc38d0561506f122dbe8e2d22ccbbc163ecf45879abb4fcee1f5186de83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
144KB

MD5
b2a1268cd6b5b4ae8afd6bdf6a7b0a8c

SHA1
887706b220ea11b3a07776a93dba21fc80d7edcb

SHA256
b65d6053a12b8e7c5b741c46d5a3e6fea452ddfa19cc3aeda3715d5450bdc67a

SHA512
4ee3ad78e9a184474f241a2ae5b31158574b356cfb6f862375497b0cd717bc81942aaa0f28fd45db9e161ad3f6a166cc61a9c1f51c95fbd52b5ef2167f36a389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
39KB

MD5
b7f65437aba9d4074b6265a29185fd46

SHA1
e250c9de636322d339a4d9beb2ea982abdb53271

SHA256
3fdb6bb134fb6c9c19e93b2a8b7b19c94ad2cf60b9ab47d27266daf122918983

SHA512
c7fadf909d859181b9b3e23c99230fe569babbf1dc8a515e93a1021f8082c1ddca2754d59af2abcda8890e645d16a015fa926a5f49a76c322aa59c8f7514bebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
02d0464758450d87a078aea4e46187a1

SHA1
41154a61b8192c00a4f03e5ce97e44ecc5106e74

SHA256
c6aabc7504bbf101eb3b39fb3f831b61148f34605c48b02ba106aedccde52750

SHA512
9af139023983a975acb29147037f4fa8ca820e15b4c5f471e2cb000909970ffbfda2b210c8330cea93271bfde3732455a545730e242f1a0e59871bdec702b39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
28KB

MD5
38e73bf808c5d86329ebf408b872eaa0

SHA1
2def4e1b5b620cc5d976c5f76955ac638b45fd96

SHA256
6b15574ef8517d0ed3132ee4ff42ae0cf3fde529cca90879daf5f79f55ce9d39

SHA512
7e090c2a4e0054c2a83b4654c2f5e8d923db1bf8c53e73e8cb9e35909f71191b7c6b12371e05e62ca8794b8d8d11d2df9e01743f23566f027d9be0dae432f071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b6513eed525c5087_0

Filesize
26KB

MD5
222948b7fefa7181201648e04ca8f56d

SHA1
b80dc8bdc1c64bc9b0a50fde4bdc7359b4bf3ab6

SHA256
11841e2776fdd390e8954f778065699e3769345061c33b3d49023b0c56e818f2

SHA512
2b3ba61c3e883841e25d95a2131f58fc64907d2ab3114427a6a6548f391c9fd4cb388664fdeee83ad2739b1e32a513dfec532e1f97bf942314dd8f8b38322358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7898909f052c84ea7179b8dc362bccc6

SHA1
60cc07753b9cf80dad839f427da86ae03774fbcc

SHA256
cc33ff4b5d6eedf4fdc29e7d4fb07d6e6acd61a65e483f4a26e66e85b616ffdd

SHA512
657146b2186017acdf7bdcc42782abeb84e44695476ae8a4c4a1933936fb6191213a2f7c725efd8ec58658e5c2c5d3fec5ec5e98bf639f9e237b15a175037e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
ad74b3c6621e12f3f927e022feac78ca

SHA1
4cc6f6e854fc73e3cf93476e5dc59bdd744c2e31

SHA256
6aac11cc4124e5464f710aed04731639ac5c6d7d8d1bfc7075c668fd5bdda7df

SHA512
52a3f9ea432913ae0f4a4e1387b6e2e626ec189f3792a784db3e94d9f50bca2552d8934115523344a7cd7e16b479a26c0e468fbcae665985f8f7411d0a9de234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5666e5763392494d217a53ebc9561eec

SHA1
7b622618060a7bc9fa05b33d282f031ff2300d0f

SHA256
80e3b1247a64cdeacb739a2354132d8b3b6b3d227cc6387ead060d22c3dde1bc

SHA512
0958166e786574a83965d7b3fc50b49500f5de2e73f13027e72d81bc82046afd9572c415bcd765f9b51501641ce88d93cebc56f5ce1fb4dbdc747299299bfa5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
16542545b638fff93f8412559603d4e1

SHA1
1b7df4bfd1289f195db4bec3dcfb1e85113a7b2b

SHA256
2b4f293b6e9fed36d8976535979543f345dbb2021bca9a7757a994e7e4557664

SHA512
a9d520b6c7e5f3b03c41ebc345b34bd99fc3ad517a7b68d5e72ae86f5cd6235722592fd4be07f3773e045509fa3f617a22d44cade140027b9ec79bca27f864fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
967a157ae66d0499cd5a74aaec61d550

SHA1
df92cc788fdcf4962fdfda4827b812ac5c00d13f

SHA256
e67e658fe5e7456be924415b1896bae22d9b16a6ade1c8b9de7391f689f9800a

SHA512
e8c4fa7af742addf16471778967b660e072b83d284f4095b056ab6b2317e98c4ddb8bee09043f38d76a719d2af7099b6285b9716ba49518a035916a2d61fd99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d587862af6ae853d5dd5b2e5ab586aa8

SHA1
bdaf383cf84371d53084d0891774406890e5a219

SHA256
44c1f63ed214ac5684d33f7357bed59ae209aa5dc156a4dba433a447e79cc1fd

SHA512
75251daf4d3fca0045018344240457154bf7775787c1bcb84a6c71465f9bb6a642a617a5dc82c6baf84e36f63af62898160d91f37a6d940f05d5e5508f366a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f3eb449643169f3c823166b905494cb5

SHA1
78fef85cbdd74a0aeda47bb0ec0c3f347ee08d28

SHA256
221f57ad88f2ab002b9b5b4cb81ca1fbd1eb747c039c6f9ca9c465c54f454a20

SHA512
0a403be4b0c512432ad8d872b764b936cac7143aa2c34a9d71794cedf68c38048b44a717147817cf115993d55912d6430ad1572942b5947b63cf47da1a8a4fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7dfad20fe28a5dfd562663dfeb522289

SHA1
084d3a7536402215cd68aa596dfbacf9e4b14444

SHA256
ff27aceaf2c6d1346be51c0f1b81d256b098503e31be140f9868f3a7d86cc273

SHA512
b2286289f849ec4b69e1f8a734959bfda35f03b59f82a974b77b605b0ed68216b0b2cf655805bafacaa9764f1083cbdfd85cae75c179dece004ec40f2ee41a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a260.TMP

Filesize
1KB

MD5
96f94b73afd4654b4adc8adcd37bf0e0

SHA1
6ce573e7f8fc9dccd1ecd98f495bb5cab8288d9f

SHA256
7a5e12863a80c5183b735bd8c6e644583947e0a45c810e5d234d046eb230bf32

SHA512
fdc87be6d69cb80b9d89927af273051d4ba1a7b15d90c6ed837a584f7e4a57f83c937241ec74d232c447740a5b53e33ce9c49b69d3302638faedc69d9682984d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5222bb5-61eb-43d9-8b6c-c8dba5cb932f.tmp

Filesize
1KB

MD5
7662d971d69af7d54fbc924d9aa2a2af

SHA1
4988bf50f7ecca7e2865a935341621be51925b6d

SHA256
aa72958d64728bb1c12fadec8d255f0cbdf61cd473ddbe93e9afef5146f5e736

SHA512
dcea75a5ccd0cc4d070958cee007e7ed76ad96dea6c00f6b7051c599d5027b3ae46058032213b8ea1555355f3107ec1243eda9e12e8d050d0fe00c714c372a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
039b5056c524063472d544830a2af10a

SHA1
08dcda13cb4e077e56be1e2d218330353e25ad51

SHA256
499c0115e4b0f1bbdce8fdb0687ae0b2a3b2a61d37a190d32b33f3a9da714082

SHA512
95e08451a6d99d8eb94330e2b353bcbc7f0829aaba0e844b44b5f9579ab1b1624ec275db06d7d35beb12eea54060bcafcf3470300d22c956f945d6ec0fd675c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
407c4934b1d17426810f9d419417ed48

SHA1
d56e8c47fbbb8738285cbe40ad1105ebb51e2c98

SHA256
9f4f239bf6a8de0b884eb6639bc3a60df5ec2b8032872d1c86dbad92e5cce4ca

SHA512
592df2d0fc44430656a0bcc77871feade81c3e1cb8eff636877ac56d93e70c14c0be0d50be23af306f4b34186684475d1dfeeddfb1fb643e8e14d7b1b9724dce

Download Submit