hxxp://ws[.]spy[.]pet/exports/

Analysis

max time kernel
252s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://ws.spy.pet/exports/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
3648	msedge.exe
3648	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 760	3648	msedge.exe	84
PID 3648 wrote to memory of 760	3648	msedge.exe	84
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1060	3648	msedge.exe	85
PID 3648 wrote to memory of 1976	3648	msedge.exe	86
PID 3648 wrote to memory of 1976	3648	msedge.exe	86
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87
PID 3648 wrote to memory of 4916	3648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ws.spy.pet/exports/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7c3846f8,0x7ffb7c384708,0x7ffb7c384718
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,768721150934184471,3339746313669149624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4e0
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
21KB

MD5
ab445a4190b5bace89fea9b0b912d6d0

SHA1
f8ad5194aa91e598faa372ca91b854c5fd8d85f0

SHA256
1edaaf310f3d8db7b3cc5428b70b6e116e11c856b44ddf122dbbf4a171bdd955

SHA512
245787d94efc832bf420044b657436189a0aca4d1cad7bbbcf75caa39c4683287b3bc83616e09b5fcd4779a6a2c7db7faed4370ec68d14438d581f1ebadfd66c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
17KB

MD5
df67f75efd267c9277fe15a3e351486f

SHA1
c07813fc28a57fc00826f5cdf72e4dc4d0a45089

SHA256
cd25d5007e57f6838fa6256b6b39c1abe30c8fdb0c510d1d0aa4bf6ec64f47a2

SHA512
ce8471510f110fc48b95d904a2f2e9504e50ca26d56ec2ce3db5e67e103b3771ea2f85abce90f5a907dd24bf7b91f0a024670e391db7d63b9b4a6633c76401d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
42KB

MD5
328534a992a7c874d501be739136a9f7

SHA1
41a91e8ba38b65d4353a298e8eca8450dcd7e472

SHA256
9293105ac6823abfd34f003e0bade99c7e51742dbbb7199cbb10352076212003

SHA512
785b839f9c4305ad04d4f29d2c97a4da93a923d2f1a2f77c23c7643739c559215663afdc06697dd2bebc950b39341ef09e6886075aaf9692a3b23a18c5583c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
36a9422bdfed2fa6d3efdb8aa20e7578

SHA1
898f45d169723c08fe43b6af8dcde60871bc7927

SHA256
27c75401397ae21905a4bfeca9f4e23c78e03886a12ca07c118a6ea0e0fb4d8b

SHA512
98530f1783f6070f4cb19bb4e4640c3b43237f3b63abb6b4b3f1d5cf984481de6e2a7053b4306c4a122ecd46dcf0ed5963533220badab421a748d16372022e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
b9eaf3f80bf6205eaa85141fc6095c1f

SHA1
9bae83fd8b8827ee8e44317cd1cd36a5c4943c32

SHA256
d52271b78d2f3ffeb11d9711517dc6f7fa45618f855e1ee4c429c765814d5883

SHA512
1ecf5ecba1ad837314b8ee973f46ece0329a11b8ca0e305aaea0f2883587f9a1e5701cac4551f1469c8934a978c23b6294fd22a0267fef4bef77e3ded3a4ef4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
835B

MD5
25877b96b335de23c185c16ddc96fc75

SHA1
99a7132d5dbf4490285c9165362f6bdb72c0d6d0

SHA256
c4979a49eac1b464c9dd8c97bdd30351c0327113cdeef6263f7ce2aa46a3a698

SHA512
cc3c83c82e4ef0fe3091e728630b1c180eac0c4c97119c8669897a141bac442fab6d8a202117c04af2499f75e750960d87d64b5430fc6e314f79d15460427e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
915B

MD5
f86d9ffb389ff00ac002f40583206f56

SHA1
b5f482cad1ea90e2d2ff5ff6fdd4711501c769c9

SHA256
60badcec28ae664550f6cc84289edffc42eadfed713238a248c1ad9dd57a9288

SHA512
f0ce462f6908bd833cabd45d464b73374c9aa88c0d1397dd471c497f213394f9e46aaf5bffeb13e5700d42e138544c5fb2ec0fbcc57087887ca4bd734b2aeb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
915B

MD5
ac7285f5acabcf6c3021397eff60ae61

SHA1
ccb3b4822698b4cbcb7087ef5e7672742be67494

SHA256
38d7d29c270feaea2c79bd5bdbbec4af7e9d39577768ba74246bffb431bebcd8

SHA512
962220004676410eaa24baa746cf8dc2486d52424d10a04b7da9c0579acc8add2d7114f6ce4ec8855e12a9b804d13084d98fe6c4557c6c25979408385c839d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ee4e3ca2ce522ca92f85f5800690615

SHA1
86ad68f2ee7958121bf25e944a6c27effeed40d2

SHA256
05b640a02a841db36d72207885386b882d5e4ad2911a90b29e8c41f9ba53dacc

SHA512
925b58ca12da85463ca99c1fe2c0d4daf98ba203f76f410299a667cb43275f00a6ca8f7822e2045caaaa0c643cbe78ccb1641df545821530e21c69d5ab5cd431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
255716f50a63af62f108c0cf2d9d1688

SHA1
00cb62a5710c3078621f2183c308ce5da5011173

SHA256
0110e229c61103b60961ad92f8c9fb82b0e9425f784d2376bdde6e41a0893278

SHA512
e5688b7c23888e701d9a35e0c42dd0ee72c2c74d30136c2d7af5200676235c74db48fb3e7a80cf6cab16ff6094e54e0693873770a054038dd59779093ed78f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ce0248e9cb26d854a8d886a02c12fe2

SHA1
a0ba2be86a023002ae1e315f66a65f200f21ae14

SHA256
da608279c60a8d43761d79bfe4cffc6873c525aa7389807575d12a6cf7dd9ffe

SHA512
9dc7ac9ff455f44f2536b89aea4128ee724217f02fda50a2200374a0ecb96396ccf5342763fede5319875351c3202e5284095054340460be0949a5f9806c1f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
711edaa7c9537722d7547e4f98e9f3a5

SHA1
8df532f2dac915c6452f8d4cbe24bd239717bd8b

SHA256
ab17901a63d9a920932b36561260fc2175aff82329c2525ea89744942535042e

SHA512
c60d999cabde52457f40f9670e980d9deda0b71496f174e20a2d9ed28bee828bdaf7c3bc9ee286649b916025a7d61225975eca6ad6bc2bf7aae0587bf0031d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
83cd7aa587a3efd635f68d45a7ad26a3

SHA1
904cd596ec1bbff8fa5170cc8dbea9483f146183

SHA256
65e558426f3e6862fc1acb2593d70865e070ec36f456344d26930afcdfb5d32d

SHA512
9b8675bddf65e2c5e2eb744f31d16dc25dcea47d368cb463140f5729039ccda0dc46afa712bfb30ef4264950d2dfc83dc10df507e9f441fad72238a572ebb9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c3eb2877dfd947ecf68e106d67276ee0

SHA1
15063c69313e17f15982d6e32b4e382333e34918

SHA256
e9b3a0a881d942f88bcd8a85308ffed4cbbaa3a2280825240ed7833d580cd81b

SHA512
3eb6b0b8cb6f5329aa3ea435cc89cf5daf97cbd254499089bbf25b074a27eecb2d664c49f29826330f3bbaf874519561e2482c8654666b919e4de864f15667db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7ddf9a1afc4be0797c4b1723c619ca8

SHA1
9f49d926339ebdd10cdcd71add7ece846ba0d0a5

SHA256
7f53caeba144517e8390b8869bd27337b78b074bfcc29e98e34ac0852afdf4a1

SHA512
9d6e30c92ef4e426bfbfbdb35d18460cbde95d913f9c780a5425fe7ddc9507d62bbd315ed512c98a031ad3e6e80a4eb3bbf20606038effe26ce3f2943964e90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e49df20f7efe048f96eb1da9aee57d9f

SHA1
90c861c475679787bc1804f12e8c411feda66c89

SHA256
941cb13f6a6394fb55110f34cab480baf96fcdfd068c25a909144bee029840d3

SHA512
84e873843ab3138ad0098f9da36e2be4170d2ddf335e3fc69904094b5cbbdc1a148e92aeeeb7c0a911a86aee8454ac9f53e4fd38f901d6527e47f097ed3dd321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3bde3c51855ca7d9222da9c3d5bbee96

SHA1
c43d753d36f1b28a16f5c7bee88cbe3d4920add3

SHA256
b35bd3d5938d052d83b83b5372558a3972fc6d4f94477d2e5f556b8fddb29233

SHA512
378e8bd88cc7eed9e36d0133a26e53743a1b4b41c3439f2986ca685f5270b719e7ba1a690b452f8221e7761a772d1576dfd37c5feab0ff86396f9782a30fc9b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
16KB

MD5
99f80f720e2f0b26801e8becb293ae5c

SHA1
57dd9abb14e82a466d29612e0cb53b2dc73aa43c

SHA256
99312d3cab8d3f9c93985854350d309d6bc2b941fc3ea08c772a252ccdabab84

SHA512
e870151eacc6d17092df9883fdf891b5de8b6f66cebc03448dc94336b68b1f4cb19a295d91e22a2e7ea61c187cdc80ad1a5a0f37733a6a18ec9558c4582e4ccc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
18KB

MD5
ed12646ca8b1054ae2474ff59799d9be

SHA1
637c51440b4965e2ec919cc0e848e43b542e1f5e

SHA256
8fe3870d865a098b1d0b81e88f7dc35d0bdb2f59a1c6e139c26e1564696c8aee

SHA512
315d9b4dff8470582ab5841a0a3b76a3eea0534b69d63219e6065151af9c4d8db4a26c176d45f0d01921c9d75a38eef13a64d627534a6f13c9e4a0fe09a41414

Download Submit