fe6ef89f60d6ee9658e4a95126daf760ab983996cdc32b11fa7cd222e52059d1

Resubmissions

20/02/2024, 15:50

240220-s93d8abe65 8

20/02/2024, 15:31

240220-syjgzabc44 8

20/02/2024, 15:24

240220-ss225abb57 8

Analysis

max time kernel
1800s
max time network
1704s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Overwatch Server Blocker.exe
Size

248KB
MD5

2dd1ef815043e4cad7a8824bda5749b4
SHA1

ba1ce1ac279195d0d94142ddddf33169730a12f9
SHA256

fe6ef89f60d6ee9658e4a95126daf760ab983996cdc32b11fa7cd222e52059d1
SHA512

b96fa87ac5f7ad14e338f3314e91a5b05b65bcea9affaa4f37ac78385507642a45ee5a3b2237c2fca50ff0dfd9f6a8a42c308e3703fa065544e1fb24160ffb94
SSDEEP

3072:Zg95y39boeOQ9WwzzLjE5UPtJ0zLjE5UZS1VlVo:Zg95c9b/ztPcztZmV

Score

8^/10

evasion

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 11 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5044	netsh.exe
2244	netsh.exe
552	netsh.exe
340	netsh.exe
3792	netsh.exe
1592	netsh.exe
4964	netsh.exe
5060	netsh.exe
3464	netsh.exe
2184	netsh.exe
1396	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	ME Game Servers Blocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Overwatch Server Blocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	ME Game Servers Blocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 893853.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4140	msedge.exe
4140	msedge.exe
2744	identity_helper.exe
2744	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	ME Game Servers Blocker.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
2848	ME Game Servers Blocker.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4140	4784	Overwatch Server Blocker.exe	85
PID 4784 wrote to memory of 4140	4784	Overwatch Server Blocker.exe	85
PID 4140 wrote to memory of 1036	4140	msedge.exe	87
PID 4140 wrote to memory of 1036	4140	msedge.exe	87
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 3412	4140	msedge.exe	89
PID 4140 wrote to memory of 4624	4140	msedge.exe	88
PID 4140 wrote to memory of 4624	4140	msedge.exe	88
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90
PID 4140 wrote to memory of 2204	4140	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\Overwatch Server Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Overwatch Server Blocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tamoza.net/
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9659246f8,0x7ff965924708,0x7ff965924718
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3024 /prefetch:8
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6524 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4088
- - C:\Users\Admin\Downloads\ME Game Servers Blocker.exe
    "C:\Users\Admin\Downloads\ME Game Servers Blocker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
      4⤵
      PID:1980
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=no
      4⤵
      PID:2552
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=no
        5⤵
        Modifies Windows Firewall
        
        PID:552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
      4⤵
      PID:2120
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:340
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=no
      4⤵
      PID:1828
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=no
        5⤵
        Modifies Windows Firewall
        
        PID:3792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
      4⤵
      PID:4484
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Game1 ME Server by Tamoza" new enable=yes
      4⤵
      PID:2172
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Game1 ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=yes
      4⤵
      PID:2180
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2244
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=no
      4⤵
      PID:700
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=no
        5⤵
        Modifies Windows Firewall
        
        PID:3464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=yes
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=no
      4⤵
      PID:2272
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule name="Block Game2 ME Server by Tamoza" new enable=no
        5⤵
        Modifies Windows Firewall
        
        PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,8697903629260477015,14022284078641515419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
  2⤵
  PID:1744
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule name="Block Overwatch ME Server by Tamoza" new enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
5cd6d2da2edb231a647f319becd966cf

SHA1
58516eb069cdb14e78eacadddd2b6b2c6b7bf551

SHA256
8a40d0c42da94d01062fb4a72f46256811e88b343a2ee40f36af2fd1cabb9ca1

SHA512
8cc43c8c62cde9ec37f8545c79a454503c8a8cb8d02912902ffb7b4e3682ae35e41db095b3ef15dea1869dacc344bcd17781f32a5f2c0821aebf43573687259a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
24d175173bc363985ff422f1382379f5

SHA1
10e80c46aaeb97248db8d393bb66aba5a8aef19c

SHA256
19898188eb2dfda09b74f2b29ff564dd670abd70edc28f187a4f6528354231dd

SHA512
1db0cf7030b9b0488f7bfff4f8b0c00997903ac0dcd6ba0e1b66124b718467f320e598edbc692d2d95a8739cd91e0b48a77bdc4686399591ee11bfd51bc79f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b2ed5b3ee82d1e60f5e3d222df8d6f06

SHA1
72f2b194492c533afa4f3e92afdf1551e87dc091

SHA256
065b0bcba6201db0fea600ee37eb3dd2459d09473a352a15d9d7db41bf158b5e

SHA512
73349579689fd9a9718a84e929fff0267ae2e535455206122af1088a05019833919ddd5c9ddd242cfc6c85e75c5bccba867a589e32cf7ede9a680271c87ced4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65f675d7ad4072c2d12000fdf462ac77

SHA1
c95d5a4964dbdae67fbfef9fa6fe44cb9169634d

SHA256
4e472018b4c41c8c94b0b7fd1ea714d0a5682ac72e2210b32ad1bce6cef796eb

SHA512
dde7967d74677066f9780261aec83f85fa0eb774b9f352e20e7f4db45143288529e09f450de063b08c71971d9cf64e9adb674151d4af01d877524f29313e51aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
266ec46bb8aa3e52e84cb252c2a6c19e

SHA1
93a2bd68d9b138036fff88398a55724232db3d14

SHA256
b84337d59d52db405415b9cc9b0c75844d75dfa592b0ce4b639e7d477b5423d9

SHA512
c6253f1becabd3ae7fbe24211af8b9adb2f71a6daf6f135258a689dacd61796bfaf71d64799f0568386451f1fad56faa547936dd5b87b9a716c5fe5857c07ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
faf2abfb4c14ea195e4332a3548b6b27

SHA1
3d8ed61aa6e50d1fee3590e64f298710d3d15d8c

SHA256
f62a071d2bd31e0fe116b865e27bc7b357581054f80a5b1a71adf692e0218510

SHA512
7a80d39fd942fe16491fcc0ed7daa3618ee656ceb2ee5a6534dd822d6cffc587dbfb77f601d2f5d11d0107af523c24f0e904812e8e5e269cb84338db21925ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
402de4da00dce0961ba79b50f2d111f8

SHA1
5a5617fef5bc721c29183c94e9032c082e6ca50c

SHA256
ae68147dfef99c5a6f0e7e2a2854a5a6151419bdd1daeadd45fa593e3af5bfba

SHA512
6041dff81328556190fc2f888f9e3524f96a2905c7c39a9b4dab8a65b28a96fd387f8189c315e2019c21a299dd7adbd137df1c9fb2d0724eb26e16fb1c884542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
ff1ec08889833256821af5f711927d86

SHA1
56659d63ee47d19ca98616b7349737bfd22ab2a7

SHA256
1742dcd77ee69681a1abc1d051ebce2c3355d7033ce57bea37c28a01f979990b

SHA512
6091bed242ce569bcd19e1c1215d762b4c1d5ac9719bc843cc6ae26b994a22fd2177e23b65beae9d061f44b0ee591af6c695d1b36347a9f113157909ca813d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33ca337fff1b9a5e5a2987a3244d9f8a

SHA1
b7dd49e23fa0595ad8132f8f231716693abf61f7

SHA256
61ea8156dcc611c43306090738fee8239c91ccef8dee178138adca7a1b880a4e

SHA512
cdc64796be1a7329067f7a9f0d6d90f070454acf87a4f9f54019a10abc4ddd3a753042b8869e12ac004051acf356bd82f43fae326f09f865ee8761f05265e9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
30f5f8b6635951d31a1030b86e473d27

SHA1
0be984d70af82888ce6e4be4d3913f6dd9468ccf

SHA256
68bae3c56f8e91e9bd4cfdf7539c7d2f8dad1d9094ea6da5b8ba0bf83eebed80

SHA512
b77cd1c0c20448360eee08ae73fd18706550dfb2ccaa521118b6d0c58d21ace50e3936c761cf7e5e34504aad68579060b60b1e601508f372932450abd3162688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4bcb1db64c7fffcdec5d00868aa46c22

SHA1
cffac7c21fbe6f99d8920cd69b1c8df2ceb759d5

SHA256
6b74fac5df1aea02bb0c3c8848d1fbae8253428a0908018cd339fe590d237712

SHA512
cb05d83496a2d7c7d52ff1d49a88ab70f715b99c900798f7457fda54e1bfe1e6180b6e9b7314bf2872783580ed11e761389a22cdbad70b28b48592bc4191a653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b07f.TMP

Filesize
371B

MD5
50ffe4dfcb74c9181e1d96416d3dddd7

SHA1
1c1e7049782e0be80fd2113ad718978d89704956

SHA256
783965e0b8874eef61b522d82c2a998d2aace35f7153d29ba6e8c473c8ebade9

SHA512
3a1ea5ba003cdb4701c247c4a3df4cab532a7b21b0c0fe854cf309d6057371c75e3ecb81ec544467752a30a211d6f20d7b9c84cea16451174bb82299f493a2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef10400e53ff606923f30fb9f6365eb3

SHA1
38bd314d546c2b827307680b7fa34323ebc68989

SHA256
ebbe17fd9aef1a9855b4823e8f43f52830202d7d723ab24ad02afeb6fd7130c1

SHA512
5a71c6b3180b920fab94832c185ddceee6c8d1d49beac1da943f1e5f421f50776419c50242d38159c4c88681268db10a747ac7a5b78588dd86993f072389c3e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41740e5df1332d4606cf4efcc56c4fa1

SHA1
1f15e0509687af74cd74aa806256b84ce6e6a260

SHA256
c54224d6f6c4dcb2fa21e6dea202aa87683e665e036e546607433472e72ad1ec

SHA512
1177d5ea00da7024a7d5f2509385684d9a834896ea93822e09726bbfb542da5a217a3c076437251e0a98ed239748fca40382276d76e1686eb83143d8c778f12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94a0c16ddd1b5c3068734d7b90ccc3d2

SHA1
1aef459ad4720b64acd8390215a8653aea2cb603

SHA256
60e7317604743cb58d9385bfe93e3cf3e886cbd4ae9700f22e06ddc873914eb0

SHA512
49bbc09cacf3517c924e713f572220103783e6494d9dee7311bb920d01975ddb2e6e8d02a09cef15de598929f2ca625f842c0baa2a36a6e6f65edb815ab73e47

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 893853.crdownload

Filesize
552KB

MD5
4a8eabb71f09b1d7eafa4773423c6b58

SHA1
2005a97bc92421241c0ca33a412ab930133ddc4b

SHA256
f88e12d71709f40bc1d04fc12e5d69f0eece222b4afa1cfe6d2fb7c22694ee73

SHA512
5b4914da53d479f05b6b50c926965685f8cbdae44837156f43fa272c7b4c1b17a83a10d468a1a3aa25605a69f03b88031271bbe1ed6750554e84d33a54c8287e

Download Submit
memory/2848-420-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2848-439-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2848-489-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2848-477-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2848-476-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2848-475-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/2848-419-0x0000000000580000-0x0000000000610000-memory.dmp

Filesize
576KB

Download
memory/2848-418-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4784-5-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/4784-126-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4784-162-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/4784-3-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download
memory/4784-2-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/4784-0-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4784-7-0x0000000008280000-0x0000000008298000-memory.dmp

Filesize
96KB

Download
memory/4784-4-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/4784-149-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/4784-6-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/4784-1-0x00000000008B0000-0x00000000008F4000-memory.dmp

Filesize
272KB

Download