hxxps://u[.]to/nCKHIQ

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2025 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/nCKHIQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
3800	msedge.exe
3800	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4064	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4064	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1768	3800	msedge.exe	84
PID 3800 wrote to memory of 1768	3800	msedge.exe	84
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2568	3800	msedge.exe	85
PID 3800 wrote to memory of 2404	3800	msedge.exe	86
PID 3800 wrote to memory of 2404	3800	msedge.exe	86
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87
PID 3800 wrote to memory of 1008	3800	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u.to/nCKHIQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6b1c46f8,0x7ffb6b1c4708,0x7ffb6b1c4718
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6616937713363915155,147364918759164232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\488316a9-a016-4883-9ef8-7421492a8c65.tmp

Filesize
5KB

MD5
5a70c48dda7c2c3edbbe87088def6601

SHA1
91bd555d045fbd92fc5dd291e90d3bc608ff2d39

SHA256
30ef085225f2e5a457e1c76de79a722d92b60972738e3318acb0c73d94808194

SHA512
2bc85462e249e46d6904988991fc9150e4b997736f2efbd55ccef12211c8ed44f38d3846cbb1b175db589547d46bf5d99ce3acc7413bb070bcaa2ae65f115712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
095777bf2e01bb279dc6d8cbf19b9f1f

SHA1
fb3b685dad221dbb2d1b3e3e4c2e917dd1e2d42e

SHA256
bde0b9d9357935fa954b561f7187090c3ccefcae23a3c6ffae5f91f7f2e65e50

SHA512
ff4da032171df103f8272e91ae3cdf6375f5ecbcccaaa93e50d45de67a345d8c3ef80d416b93d02b20621b6ee82f7c51aeb9af00c587024a8d5882df9f154264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1120404c5aea4e7b9334e87678ea954d

SHA1
18826acd3201ced32594e9b1aa6f797f42393c31

SHA256
2a6d7e3bcfe95f32f60f8720ba28be234c2c4d661865ddd5f8e1f88bb50402d3

SHA512
ff160974b65af1e8b861fa7effeed2f8af22661ee873578dd9fbadff59dbe8c9daf066d6ecff2f162907c83e8a05f9bcacf89788b8cf15ff4118cf1bd9a60f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
64d9539a3ad0ea7f0856fbe4b12b1be3

SHA1
986d1bb05368082e865510c7c5252ab01f00b161

SHA256
09dcda48f13f42a8b7fc5c73c9c1a9c1de29a8211c560086310ec8b7ae3e6890

SHA512
49e68c788851ed1e33d55c273b0f36d414bb69b7ff04240b3ee575b82911fc011262fa1fe1a7022c9f7f1984e17fe8b9fba98a92f571d486aac7722db65e36b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c9e68d0d6c58497e37391aaa5d02e41a

SHA1
465ad95db0f44cb1fdae2d834d9a328f16d32070

SHA256
246ae85cfababc620ea9be24fd754fc6a6c1d4176ab0bf075addf1cc55ab6809

SHA512
a0146022e61f0dd227f0eb85ffa5e59b6ec3a4a05139cdafc406ea21c355b4512d3dc7446fd5ac35bf90bcbf3fb3ff2fb11d7ed0a5efc02a49661a69d86ac35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18502333e71c1007316b5059d70791e6

SHA1
75141aaf68eb9195b4269e05d1a4ab8f839e46e3

SHA256
95f7f739750d2da7a000b53345e4371422815f0cc825668958694a3ede4e2d56

SHA512
16a091e541bfb7e2a8f54451da1339f8cb6cf1070d7e4e920501b00aadf8b7231cb3abbed258e945961c3347162d60592dd0197f067dd899515ced9e547c5c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38176f15fb8a9661ef064e5c488fafcf

SHA1
ae50a9baa0640cf9ff595ab533edda220160bfda

SHA256
b797586a81e0b37cd8cddeb7078d75b3891ff755e8b91681ed6ff002c607794e

SHA512
09fc64d45bca365f1427fad090471ba0ea19a9cdeb5b6adea0d891d434d5bfcd290cc430eabfef9214004604417464b6cb265a77d4dbaca159cc804f756b41ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0d5bf0e3a284dc5052827ba6fa357a75

SHA1
b56d566a2e75efb70588075973ee13f9a91b7d86

SHA256
f88cc035d5ff1f4af03258f9a8e33d4e829f28602c68cfa495fda008cfcff043

SHA512
6eb4aab206577c74ee0b841a4ddbab940447a32f2cc5d3808d20976393f383318eaf900cf999e512317727dec4b2cc4a24bf764fe1b6273383d46d1196382aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d7928c997817000afb58c8a379825e0

SHA1
0d7b17586d7131f43db3db804943acd5143cd13c

SHA256
a356ff9740c15db156b875a853cfc5ab20a8a9842b74a35978ba9d07cbc02e99

SHA512
f07ce4536bf58ac20f5c369ac650028e62528ff190d177099939c27ebf9ca5c590f10d8c32f382788bcf3a205850fcfc7226b4ee1409cfda08e203ff57ce9d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
3f8a93958f2dc31794eaeac4b2706d1c

SHA1
e09a6a02c3c0e1b03b8ef29bf8dbcb12e5a26f1c

SHA256
9640aae25606c213cf7ca4627341e2a7a51f209fa1f36c49a6df0b4aa408f57a

SHA512
02fdee6a9c24e6738cd8047d38d0cb247ee27810a0648fb18e1f9c17f58afa7b6f4f4abaa549868afbbf4125be0ea69927ff18a2dcd6bc037fb671ac0aedac72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d954.TMP

Filesize
48B

MD5
6c26ee81530f860c58710c9ec74a9df9

SHA1
e75e9fee783595e9b75ffc26e16cacd69b11b1ea

SHA256
f7db1f2372e05b947ac2673c427557d8bd1c0850ba6d1190ae800a93a3ad076a

SHA512
356bcfbb325eacc504f30e50a4b3d24882de8cdb32f318755d5c35c08c1f4900063ce9bb159b26bfbab3d1981b53e587247aa71164f4c4a5c8e023b6b5c1676a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
763f56985b853097eb0ac527a63c7c04

SHA1
f9d257bcfb33f88e09155b4f1fff19899dcc6fef

SHA256
b47e78b67116da1d711b64a652dce6dc16bc140897df6257a8b337b638653395

SHA512
5b4623883004ac38897920dbc5ea9c4c6f18bd04b588f15f86fa91e9f5bb814cd7001d2b205c9daaac7223189e2d6a2a55b0b6b1af49cfe165631cd83124182b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7bbb406481f57695ac2dfed9ada0157d

SHA1
45657aff733a336bf10a57aa7d1eff98d2d94b61

SHA256
1831888561bf644b4c7e9eb88ee1402b6ae8cb96b363a58c70bdd31cba643d11

SHA512
fc74e3c7d30fc07abe80997ef112e3ca3f02925be98eeeab7403f126a394f3de3c8c8fa73049688f7145ebf11684334afd20cec8465551fc7e1aca7e2c745c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c7fe.TMP

Filesize
1KB

MD5
0f5184c65c6018c6fccb17c08c0dc0c2

SHA1
42918c6b0cd8eea41ccd989a00064388d6c7d5fe

SHA256
2bb54cca51266344eb611e82a00feb9a0b989c253522a2c1dbd5d7c43ba30c2f

SHA512
3ca500154abc92febcdf53a745d988eab9b978b7b4f1a841327d8439aec49c4df03e41748cda09232a0f098f6d920edeaf97f8408203a853805d0fa5982e05e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9d8cc90ee082c4bcb72857908172037

SHA1
a895a6597bcf2a0774c88911f30b77f93f5113e3

SHA256
19e1431d79ee0d743ccda56303a14cc30b8672397626f76acdce1af6b0e05c25

SHA512
71df07f94376d22f3bd53161402fc7bbc8c779e6ff2fb3f8a19c455aa015e2e4b88dcd8aab41ff0dbc05e82dfb362e9b9332bb0a42672ab5c51a4c6ce34be732

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
79c01c67acac64a9712a508463e184c1

SHA1
69dc4d6c34208cf6ac0aad1b1c1c6a25aa3b3569

SHA256
2f9a6e060ac7ba1159feada14522bebd1c4b269e3f3c31340d3ee5948fcadae8

SHA512
3f7fc59deaebf6c42551d4ed09173ba03cac4cab5d1cf5cd461577e1652fe1a1f5a8df37462ab80b07e919a15b1ef176a2115f939fb40f828ea29ad4db296a1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
461292aac3e8f7cff1d7963735dc1473

SHA1
4ecf959089884aadcd2e003752e8d064b462dc7c

SHA256
637b306b442fefa972ebbaa6b74056905543c3e15b1e8a949d93ab381d43bc33

SHA512
25e05699bd6e62bab463b13c5564eda9849a95eb4bff9662b3aba7b042aea273cbd0ce53d40edb8076f2ba4aca02b001b53022ca4a42b572092915cb9b8f44a9

Download Submit