hxxp://epicsgames[.]pro

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://epicsgames.pro

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3844919115-497234255-166257750-1000\{AF439D1A-BBDE-4F2C-9F47-DC205A3A1CC9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
4692	msedge.exe
4692	msedge.exe
2928	identity_helper.exe
2928	identity_helper.exe
2532	sdiagnhost.exe
2532	sdiagnhost.exe
2132	msedge.exe
2132	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
684	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
1632	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2624	4692	msedge.exe	84
PID 4692 wrote to memory of 2624	4692	msedge.exe	84
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 4636	4692	msedge.exe	85
PID 4692 wrote to memory of 32	4692	msedge.exe	86
PID 4692 wrote to memory of 32	4692	msedge.exe	86
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87
PID 4692 wrote to memory of 2332	4692	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://epicsgames.pro
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc825246f8,0x7ffc82524708,0x7ffc82524718
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:2588
- C:\Windows\system32\msdt.exe
  -modal "262692" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFA265.tmp" -ep "NetworkDiagnosticsWeb"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10425670760524743404,874663745539679201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024022313.000\NetworkDiagnostics.debugreport.xml

Filesize
3KB

MD5
e94425731b00ca1df82667339b4c035d

SHA1
7e13ff0a897e6d706d5269d0c47faa35d699e41d

SHA256
171c5855457bd1a75ad68b7c35f8628f6cf4ee8e1ba932a34f907a9dd5c4075a

SHA512
d5965489f05938457720a324e19b1af65d6bcbae1e8f6a7a6c4e5ab2e5ac7717c06d28843cdef1456a82f0d9278da4c2b6574f35d0514dafb5de96fc835924f7

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024022313.000\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
240deb38a119238fa3af25cddf137c22

SHA1
643e97eb61d12ab0a3bc8dfbb42737d45593d50e

SHA256
c39cbf746942605a31e7442f3ad5ecc375d3938167a2830651fb5048bc82ec41

SHA512
da9affddc21755a635283135d862e3c333a896ae3552554061fae4361ad124aa7e5a0149cf1ef7b63d4251e788b78e8bacfc31dbb57853a660fa937afebaa3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
93bc667a9a0ca4395e30402ca7038bab

SHA1
69676e2269455cc9b6f6996db84f2e8a25542f65

SHA256
976555da161ee909bbb32f409c467057fb332acfba118c9fba37b9ebb1d0bc83

SHA512
cd381ff9ac5a26d08a33906ce5df92dfca02b4a2f9c3c9c1331097e61db7b33a11676fecd5b8f30a224cf3c31aa8ffc582a27ec0f73a78178e2a7539a174e720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
25bbe0e866ad734a1553af942e4d7660

SHA1
41ed49730798fdc1c6474e6ddce08bbd43acb421

SHA256
882b8896272829be89b497f1a6e6861a05bc9cfb7414b784f23aa67ba1cbac7e

SHA512
7b86d6cf81556a270a87cf250895a4b20c1fc7d86990726eb3ae1254304baefc031d401f308c428dc9eecd91fdd73ae76bff7be573a4003570560ae3821532eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
410B

MD5
91d74b5adba7114fc5a215f40c79a884

SHA1
3f2a5e2927efe4f354380fa4709a3eec68b028c1

SHA256
72cbcf1af6c033ae8fa701296246bd3dd0896d73b3bdfe11f91a0c7867415585

SHA512
f5251a062b8bea94990c79b8b422e1c92a242587051e504d8a0766690ed5849ea19eb69bbb9b47e43fd1d5cfe78cf488e65d52f2d9bd1337f4b5a45632434826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3448cc3b666558f614864f0acafee237

SHA1
aed4eeaef281ac6f7eb1674214dd1803e7313640

SHA256
24eba11feb0423828fa815df29b3d44d4e0a884ca3a1ee2a94551d0de1df7969

SHA512
292cd5db15ef661159dd55cf9e0054ff56f816175db7a1c0edf924089c02e848b112719dbda50c58d81d69cb3f29eadb955258c8b5f38d4eaf6ede2eaed620b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbb94e67e150ebdb95f92c63e534c390

SHA1
0f9600a7bd99f25b7730e9670b098cc4f9ffd602

SHA256
9f2f211b57c506cd5fd223e11c57f782d0da31558d9cab7b73dabb6cb22f0d36

SHA512
f8f6c0d303611b166e6d377c8b86891151d397ea697ee7fc6974bd01d3d858a2d33e18c872284b0e8c8e3fcb2a046375444fef176d081856cd0d712b4d521a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
dc4a1c8deee95e6ef3cb7922b0f99332

SHA1
8b47df015be326e61b7149c77dd2f6d56d65a0ed

SHA256
7c2e95798851204668d2ac290b53b71e8b8872b70cc55b20d82dfd1730666c8e

SHA512
9883bd088880601acb9746f600c10973820b420057bb379bf0ef26898af817916aeb8bd0eefa9b196ea032c96e55e9d03ca9c346e4f2218572a001636d2959d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36726df40c0ca3e09ed2f2d7cdedaa8c

SHA1
f3931a476c05fcdd04dd3d9fc8e168dc5d4edf33

SHA256
f529389b8582393598afb5a32a11fd29f8487703a9182740ca33794a85c51328

SHA512
8380b416a7e0cda755be05554b189d98dc8377cab7a7d815f4ff59fcd6824b39b1a494cc010867a4c04a5d16da5ba847c0da9330a1721e29703e134f2fc997f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7ce30ef04f5ee8f65bd652a0b8d54829

SHA1
7f7d2453bd864d889cab97a1524940f5a3cc7e5f

SHA256
ec015665fc0016974655a20a7cdc688892dc08f58da19a0bd362d43fb064a32b

SHA512
314a541b7a586506acd6a3b1bdc2594563be896df906a5d07d5e3dc921f5bb0f7869acaf928801e40c54c546ed4f4319bbb8a7178749045778b3b0eeffa8c9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d77563d6506b39b97904c33fed7dfc4b

SHA1
dcf85f541f3942495589176ab111aa6864b045f9

SHA256
95ae22059a4a18f9b78aae90611ef00fcf36e1e99d341321530e3b190f28d526

SHA512
69f7a2cd94ff56b9c48692ad2c8d4b1010fc117086ddb7cf6ba35990c76f4fdd654e67901b9b1401e26a96361600e1d108d4219771721a86ddcfcc299c6969a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8cf6eb28a8c95cb69b9c895e8370834a

SHA1
c1ebcf0a684c0def6f5d4f1b0435f780dbe1a0f8

SHA256
e54faea18633b1af3927649c39029776c2460e74a55145c6519ea57963c50693

SHA512
d00c52136d6703c3df253aea011bae79b8b0c0f364940ef374ed050ee00ca7d0acf1d0f358d5fa455630e468a607cb0478acfac64bcd4a1be7ff26768fdc81c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e46037af519188c085597cce1d5f72da

SHA1
3f9b4fab6391fb63a97168a0d7ffd170ef91922f

SHA256
fdfe1dfbd91e6304c02e5a46e2db9ae552903d3a983b520fce0acd1ea51f158f

SHA512
837c41234e8861c62fd1d47c9f5ed20d847c7f51f7e5f428b05918a1f22d7f6496ea5b73c84dca6d479b235ce1918fed5a257639c6cc36acbc90a790c78c40a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
c8dde208d5fded8edd53e4472081d48d

SHA1
a315d54dc2f536be0221d67061b14e02c7d98468

SHA256
936975fa7852272d2eb224c3e7d7934675ff3051e017d6a3f44cc069b5b29d8b

SHA512
ba4a533173e5d50dd563f02f86562a926b48f63098965e3ee9133d9f242934f8e81b8fbfe21f12d721a020b16c7bf142289063b7e417475b43c96b291533c65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
dce8231948c07f3ece293311d37067cc

SHA1
cdae1181bef6c3a9ace554c70d316476ac5548ea

SHA256
5a00df7a890a43a629abd8cc473dbcf8bcc2a215d99315caf533174cf5d7e92f

SHA512
40fdd95bc13c7b67491099f8571e4a178bc439c5f32c03f5cff8f55378a08f21d02290634723a0e6623fc62e1315feab12e97dfba4d0ded23c43e806b701a65f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596027.TMP

Filesize
368B

MD5
e4daf5787210a4fe99f58ecc1998791c

SHA1
b2ecbf1e343832dc81306d9ecd9ab9213e96e9bc

SHA256
3edd351d71bd87f76bb910b9c26e600258ab82e3ce3d5a49f897d5f9a716bdc3

SHA512
61487c01a4ae3939b1468af2ae9ef68ebfaae04c51929de810c21b5c037f176aa76c311b03b1a0a9eb0a53b5ebcd50a5010868c62a905bed27ac67690711c055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0d0722e4a6a381ade890406755c6587

SHA1
5393ca3555de68745f96a7ba90699cfed25e40fb

SHA256
24774a4c8081418942584b058fe05777d94cb3d7452c552826f023aca66a65b6

SHA512
0df88971d81e095ef5288ac388b5c854ecffd8f3e27fb7d925064cea0d4a9cd47a1d8c2d0b4da1a1c38dcc9093f19c0c6fb1cea43369bd5c89b450c71967aa8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDFA265.tmp

Filesize
3KB

MD5
65bf548fd6e9ee45bfdddb147535bbce

SHA1
6667ed3d3305633c984d934575a259961bebc90a

SHA256
1abc9d7a2c95794119bdb8d86d746a5b5c5f30c2d4ecb5fe65bd79708bda0d3a

SHA512
6d9472f3a912911f2340ecece1a851a8358a4a9b6603447c4093e37cca578d3e6ea7f801fdef40454a59a8f0cdedb5238d8aba8da2c4faf06b5359f3eba6e8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pa54gue.w0m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\TEMP\SDIAG_50cc9758-35aa-4f49-af4f-0f3fc622600b\NetworkDiagnosticsTroubleshoot.ps1

Filesize
25KB

MD5
d0cfc204ca3968b891f7ce0dccfb2eda

SHA1
56dad1716554d8dc573d0ea391f808e7857b2206

SHA256
e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a

SHA512
4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c

Download Submit
C:\Windows\Temp\SDIAG_50cc9758-35aa-4f49-af4f-0f3fc622600b\DiagPackage.dll

Filesize
478KB

MD5
580dc3658fa3fe42c41c99c52a9ce6b0

SHA1
3c4be12c6e3679a6c2267f88363bbd0e6e00cac5

SHA256
5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2

SHA512
68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2

Download Submit
C:\Windows\Temp\SDIAG_50cc9758-35aa-4f49-af4f-0f3fc622600b\en-US\DiagPackage.dll.mui

Filesize
17KB

MD5
44c4385447d4fa46b407fc47c8a467d0

SHA1
41e4e0e83b74943f5c41648f263b832419c05256

SHA256
8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4

SHA512
191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005

Download Submit
memory/2532-438-0x00007FFC70420000-0x00007FFC70EE1000-memory.dmp

Filesize
10.8MB

Download
memory/2532-490-0x00007FFC70420000-0x00007FFC70EE1000-memory.dmp

Filesize
10.8MB

Download
memory/2532-439-0x0000024F82CC0000-0x0000024F82CD0000-memory.dmp

Filesize
64KB

Download
memory/2532-440-0x0000024F9BF50000-0x0000024F9BF72000-memory.dmp

Filesize
136KB

Download