hxxps://www[.]matequiz[.]com/es/start2[.]html?quiz=658da21940f77fe4dc6aff08&utm_medium=es_photo2&utm_source=whatsapp

Analysis

max time kernel
61s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.matequiz.com/es/start2.html?quiz=658da21940f77fe4dc6aff08&utm_medium=es_photo2&utm_source=whatsapp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
1028	msedge.exe
1028	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 5056	1028	msedge.exe	82
PID 1028 wrote to memory of 5056	1028	msedge.exe	82
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 220	1028	msedge.exe	84
PID 1028 wrote to memory of 216	1028	msedge.exe	85
PID 1028 wrote to memory of 216	1028	msedge.exe	85
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86
PID 1028 wrote to memory of 4540	1028	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.matequiz.com/es/start2.html?quiz=658da21940f77fe4dc6aff08&utm_medium=es_photo2&utm_source=whatsapp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeec2346f8,0x7ffeec234708,0x7ffeec234718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1440824933637963412,13643117921909629021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
136f3b155cb0dee7635171d193431a91

SHA1
cacc0e4b3c858f3538e42cd5bea7501b00bf4798

SHA256
b74888523aaa7f5500bd0a7ac863980518623aec7fcda5ba8abe310faa4719b9

SHA512
7de09e8338b1b47b55a35b151c58e76c3adfcffd9639dec6348f694a8c5aac8d4c87e5f7f9381b1d3a44c06b45e8cf6fdf82798dcb6bfece60cd1990351560d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
bacdbdfa3903835e89dfa80b37cc1596

SHA1
872f5b57823ec2132511334f77e7de83e2713441

SHA256
5618041d14b08cfd47802949f1320417d4d96ee092f99dc8d303a07d83642cfa

SHA512
64adf8592ff215080488c9f117cab9d540b3140ef51d9bdb9356c2f805a49b6540d01369a3378ab8852e8930d192e5c9dd5ed07acb5751c0a03e26466a008678

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
cc0b5d6de02a76be301bde84b214c78c

SHA1
6917ee33e010c9d6ca72dc007d453a96078beaa1

SHA256
6687ec0fbecd18ba633d4ba9c6532f33c5bfd27bda55ac588e376fe5f786d3fa

SHA512
f3bd50cde80bebdb841c81c00649f00cc5543efcd15c8bef721a85c907c8c6e105ccfcc2a5af7646cc4e6469c81e0ab9a2eb5f108a4853c23dd6f937b04d22a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8802de02-a367-48f8-978c-0ac888421ad3.tmp

Filesize
11KB

MD5
3bf7710dc1f6b2fc1565e1edc340e697

SHA1
807ded99433df919b913a2ada9ca92a767cb359a

SHA256
564aeb5bb9b5c2441bc277f71dafe8b873bcc13e44bf6f01751e8e19e5e3b247

SHA512
2e3a799cccf6a0d8958be5d5fb118fa43970d1cc1838e24ba876fddb35bfae243770d843bec3a98ecbc718a5cfdab9d709b56f468f44a318483f574025b276be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
30KB

MD5
65162f996ce398fa95636a0793ade83b

SHA1
9566ac2aaa5ae50d6255efeec82d974f8598be9a

SHA256
fb9d7136ea2365dd3f8ed4a35a71327a5bed5a7a7959f6b9dfb0c38414da32da

SHA512
8fd7858e81b88a9e60f00a3c70ccd7534da524c124a88f3fdc47570a59b87a2592434aa27a451a7dee6cf2160d61af24bbd214c35f49104dd5f5754996dd69f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
19KB

MD5
ba1bc252528a94df68abc4158c30a342

SHA1
fdafa2adda170ab9a2473aa741f5ed31a6f256f8

SHA256
fd8f7fd869509c751b5e841163cd4ff6dcd42d3fc5d884731f33d30ac647a1e4

SHA512
9c0c9b8322343f22f21a42426713c6a8f9a3f63f9bd9362eeca1d30fc4a4d911f828c480ab9b08f45d3c72565209356b1d916c2d8ca9ba6784651b37ccd32583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
62KB

MD5
e2f5339567cadf1f367ae23c6ba2fe2e

SHA1
7b44030002c1b97bd95912ff696ec34d2335017c

SHA256
cb3c31fd9cb4a76d2a6b2d5c8177d121ad4c0bd1e3c0434d5eaacefa141c3ec2

SHA512
f6310fc1f14dc9067875cc67ddc57bb34a59b4772def6b355f0e23d951489361e4e732904ed7fbdded0a2dd0414e4fbdc74ad4c3287946113b956fd7246817b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
31KB

MD5
f46e467f0ce4cfe941d7ab027d90a82c

SHA1
320c6562c1d7d1ce7d157db36ff8a3344cfda052

SHA256
c99ccba9fb436fc1d57950c7fdea18ccabf5bcc81c37079ecb789e197f6b183d

SHA512
903de351ba6a5574acf883bb7e4dd6e1a5a9ca6aa0f4607b36fe78205ba0be5e25de112b6ba4901d8f301482fabc766469f418d80b7e072e5a7a2c9aafa38509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
64KB

MD5
af2854ba8c3c90a6559ec9240f07014a

SHA1
35855956cce13396918a41f3ff85e27864cbb8bc

SHA256
0ad9bca7284f78b93368df4f82f9cf7bfba333f49f2ee4f1d1098c6f4d8eb043

SHA512
8d54a9eb379fb4b4f44f8d71c7498d0ab788578f6b49d8dd0f797efe171877bdc54f1ab2faed6ce931629b673b332667416586c6707ca019da57b3f6576ed3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
19KB

MD5
956451cd35b915b06b0853da565afc94

SHA1
2678c99be92aaa73a5a9d1ef9f709f0eeeeecf66

SHA256
7338eb74bf7bc793d1be5e419d6d04d31a625e579640c67b753fbddf24b1df02

SHA512
391557d1e6433e2665537ed23325158203ac657fa0dcec3448d380263453bcff4b6946b07eb7cfb4fb84f4f8800f287c4058e605d6fcef096fd57ae97bb28592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
18KB

MD5
fe25151fad2965222d7894dfede59e7a

SHA1
5bbba86e9fe710d80c150e05d780d4bc4b88d1e6

SHA256
ff0a4097bc0c1f877a59efb3d6be2a4df8895a8227f48022a70d60e33b7b81f2

SHA512
895402dae22248c884a0eb553298405190d3dee1a7efe997631c194720f8c76bf7a16f8c0503bf0b43377a582b05c05fa15deb1a84f600b8d2fd72cb860cec50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
85aaf3f85ee38451b527f4758ca7e264

SHA1
e366c636d94024c508752bad474799c60485024b

SHA256
9f8d89a381af65216afdc915e962a70d52c21238ea869ae487536468b7328bb5

SHA512
73b942e55cdf9e54ea51ccb5599990422674663e6ef785ba4c9c803161d61768c8e38223fef024354b122afd31a7ee60a0542f7f106e5a40d76726ccc74e6633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa2823f9f4c88d85fd28c2f8903123a9

SHA1
34fb2a5b5489142716af93b8c86a1cf0a38a3725

SHA256
c72023e0f9b165b0b8e3848c36cb762d75de4cdbc00321c7abbcf4c6ff73baa3

SHA512
9e8bf4f746369ed883e067f1b89d28cc7a6964f618e7e96b3ea42575627431d219318c4fd44e93dbbfb852366c6bd55ad3482021b554b20a17e622953a7cc2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
0fc0dc34db3e21fcb2ce6f78f230bf5c

SHA1
b5744bb3056cb52336e6443515018ac3ba258a96

SHA256
29184fb94a2c10d9493f457d9898f06f3dc7e2d1a805495e56fece868e6c8efa

SHA512
b88ba90b551b5e53eda681e422f4244e47b102be595dee1a1e3ba7d8867b85a1bc86e1731280937ee53a91c145529ac3b99993f6ccf6d4f1a9005c64a2b81e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5d6661efb05a1d121ddae01c262cdb44

SHA1
2f0cb73947622bf1fb0738b14bb4c9987be1bd4d

SHA256
fb9cf5861e0aac0b0b2f23dc1d1f46991c9d5e5b1273cd8426cfe84a6e38c54a

SHA512
0c18ab7a07644f26315a6a22ce057d5fcce6411dfb7cdfe4e08ccafc6e4765c159185d604efe288e42989d5d6990a9e03aeee2287d8fd098604a4679157fdf0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7daa66191689caf4d5fbf799f6c9e279

SHA1
52670cd407faf2797b36441705e63c4a67e1d392

SHA256
291b140c97c824546489d673eed89ef1fafc521fbf8bd8657cd6d96fe77f6468

SHA512
7441554b469ecb64c6696c0c2d221c082278fa8292cff767f073c39258a3257efb155af48ac17663870a279fd8a08c2950908ab999e2c137fff2d92346a45d62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4ae6d987546f582a6409d1b1af2f7493

SHA1
3275b93fe260d86105d3cce198b4b907cee1a2a6

SHA256
6ca4bc1761eafe650ed1e24bd97782a0d1be8f0242199378dc51aee0bdf99d6d

SHA512
7eaa4f094bb57c2fe00d8a5c3ff6a09d2d2937775883962d482f89b0fde8584efb15589a0dda54eb478be5196969a7011adca840037ede65eeda5c1fd8728427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2fa274896d56897fcb4af887a8ea7f7d

SHA1
f10a5db9e45d4533ef68b5be74fb644a41b46e07

SHA256
1e456f794d186dfd8df2ee1c07e963dce4ea8df93da9baae33477bc40abd8528

SHA512
f38dea62688c2be7938eeea132b291eccda8bc7ee368077a10ed25f442f08645064fbeece5f49ad1e484b7ffa2c464c777aaf41944ccde32bba0b73a95dd6666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5791ef.TMP

Filesize
2KB

MD5
54a75bb5f8f8c5aabacad2398fe83885

SHA1
1931f87767eee3d64d7460d80ccf9ef30325f256

SHA256
71f3f676cc839052771d2f668c3bf71cb44e47bd9957d8df0c42a54db5e9e62a

SHA512
620ecabc4b4f69e059bc3d742c063ebbeb2b4e4556118128cd4ebd7e77e3fc3f9dc9f3b3f66e1e2b4e70b4a8b31d2404b044436cb04eba37fa43947d2828b5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit