hxxps://www[.]mediafire[.]com/file/wk98v3qh6lbyuz9/Lightcord[.]rar/file<@&1243196051440013332>

Resubmissions

30-06-2024 23:55

240630-3ywgmsshkl 8

30-06-2024 23:54

240630-3x7hhssgrn 8

30-06-2024 23:51

240630-3wcxhszble 8

Analysis

max time kernel
15s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/wk98v3qh6lbyuz9/Lightcord.rar/file<@&1243196051440013332>

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

3204 msedge.exe
3204 msedge.exe
4624 msedge.exe
4624 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe
4624 msedge.exe

pid	process
3204	msedge.exe
3204	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4624 wrote to memory of 868	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 868	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3732	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3204	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 3204	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe
PID 4624 wrote to memory of 2500	4624	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/wk98v3qh6lbyuz9/Lightcord.rar/file<@&1243196051440013332>
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa974146f8,0x7ffa97414708,0x7ffa97414718
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
2⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
2⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
2⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6648 /prefetch:8
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6648 /prefetch:8
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
2⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1
2⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
2⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
2⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
2⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
2⤵
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7824 /prefetch:8
2⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
2⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13150002555116642419,4690009303753520314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
2⤵
PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
b40eb46296c90e286c1daf6b5582f002

SHA1
7d2aae622c9d5bef7713e23dc5c8306c427f2b99

SHA256
b8341516ac3d2f0775ae6a5d82ef80c066f4252aaa3902a7083293b97013caa7

SHA512
31b2e6ce4be44214c317f13c43d10615f5878ef0f28bf0a3820845b6cf54a7ef8b35b673a00285035bb042ee81a48bc4e3b97c9a1021ea1b4e7a8b6285097c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
816B

MD5
624f3d3ab84b55e48e0a3fa47b79aac4

SHA1
10e6a7694b27fc62be1c023d02b1660f1bfc9713

SHA256
d49e9d51b3d23b7d6b1b1f85298cc9a41d0326089c10739a7e5d21c71d114e78

SHA512
17e3d9b0a2864be92554fb6b421c6a73843656e3bbb34c43845bc83f2bba3c74589a346c435cc7fc57178ae4fc1adfeaf217861a8b2c44c8be05f8f629da7d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
7KB

MD5
d3c79a0a5e34a7a78494661b4c5abdbb

SHA1
366053beeb277bed661f40155669a5c7144dc352

SHA256
f11cbdaca47db5672e50863145008c7d9dd3201543bec6f7e6dbc27660d71cbe

SHA512
e5e8b223e74ebb1d7f9a3a2a14b55fe9022dc81d9d8c088bb52e3d22dedb9b26251ba7cd2a25eb3ebd80728b2d83716cdf4bf0be6616a1f49e9df6bc8af8aae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
7KB

MD5
3172f7ea494bd009df189f87dbe61666

SHA1
a5956791e4c9c2c00fa70c59aac6c778d7ad161d

SHA256
878ec6806d80cdfb85a88f8e0f0a0b6f4bb3f30afc668e60d2c17e215a5e985a

SHA512
4d060d3d27ed4ced4bc98c2bd8f262e8a3ffabb583e9363886c20f8906f49eb54d3d9501962a373a59a7fda7e424c657838770355ea1f61182d3dfc20913af58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e0f9a45bcb574ff9cd17b6e9f993afa1

SHA1
64bcf8ec3895d0e54333add719c1e95b5fdd3410

SHA256
3746e30eabfabe43317a8aab6e6550f4cf4d6a6c27ec3ae46fdca5e2040afc57

SHA512
f0c925acce2a50dd2ae888a8db20cbab77268abe6424c874cec11ca0bd452d313735813ae3a1c83f293a388c02b2346fd04536e5aa069a8c30f6a29bccc1bd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
fd6378a44da74ab749153dc562fd9571

SHA1
34b0028df73494f76d8b0bb93938333a7e5cf56c

SHA256
08476b0bd3e1e7c47942b703284d5296e80564e047169d51f2826c13ee365c18

SHA512
36c936a331134f9fb7784346ca00938da9b4342e4cf21cd3e066a7dc533190876bb5d7c2cf42d56512490f7211bcbf8d6f00ea8e22716475221cf310d3d13755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
546f128f40e9ca17239f557c5bcf9efa

SHA1
4e9b6e195f0cf1fd2f04e685787b6c390704640a

SHA256
9d61c76abe5fee340a14241aca4883e94cddd0d6b6b0bd7a9133aca71828cf32

SHA512
062f81465b7a430081fda0ee7008544a311f0e29d90bf51dc6457b3fd76fc6144d0d9917667cc5b3b96921ad3a8cd0daf5f8ad1dd7de03e46282e05293b5dc98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
11KB

MD5
47a999fd0742c496e61d1a243d39d335

SHA1
f54d0efa7352ad85a85182d156186d949906a1ab

SHA256
74e77349a8e090cd13f23bd61b8a6bb00d6469afc32db859dee7d43491e75b82

SHA512
dad49569849442eb9418f9afe583a485326c38468c59ac9237b73de62743e858c753def98a5a20ff9f5b8de2ef36e42b053c00f7e4e71d5893901b198bf28be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
578685d03c74a72bfd089f5854073e0e

SHA1
671be44c668a773e12de3b2358c3be1317d88002

SHA256
a2727b0fc3cde0ac37ef7051ff2ceada2e93d1c0dcbc4418dab59127e6196ccb

SHA512
cbbad2c0888bd4c5bb59f2f0e3364ed0ce02ca4894a78217a7ca3e1da8a017ca0d6684df79b20c86d343614e8f00605e974dead44cfce8e1dbf5f9773ef2af30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f741.TMP
Filesize
869B

MD5
2c4a26d800f9b1e3c4eca6f398d8f8cf

SHA1
6343f49e301158427a4ce67ee5c0217e2b8f47ea

SHA256
f40837fd7784bd91a9b1bb40a23c96b51dea6696112c390aadbc978d0187f0cc

SHA512
c59beed3f1c568dfc219ce335a057661bd56bb27e64cc3d7c68b1854a517a0a3aafe3defdec87cca2b0a8192999b3b16eb74efc4c89d5d82fc109777166489dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6f42baa93501ad0fdf0eaefd101a938f

SHA1
b61d2a5f77c5e3985399419b860901ac8ed2aba9

SHA256
42ec4aff123ba4d965b5883ee8ef8fffd918e3204031ffc249c944bd36e25ce1

SHA512
83fb286864155abb4d055fcddc1a28b7dc8abc3984128492d7c1d791d56f15618962e0a2df9086f564414b5493df9fdd155b120e52e579279b6adbb9c72b1356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
bd662d57c09fcd6a7b58e9e5ecc7381d

SHA1
6bf84bbf97f984407862523aa151d3b2de5ef55a

SHA256
baa9ef53db6ab68438635a99c11d7ad3b01dc118df3c89e4851e560a54656816

SHA512
bbf18da2b87808bc2280dacd5d691c607964e9922e4bfb772f7bd2ef6e518055688514b4b68242be6ea7e179c4f916845efdce0c8b8c763aa249d858d44e1f49

Download Submit
\??\pipe\LOCAL\crashpad_4624_ZGLKJWUAHBWSFAXZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit