hxxps://pcgameszone[.]com/no-more-money-free-download/

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pcgameszone.com/no-more-money-free-download/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{9D7D3DC7-6AD4-4884-937C-A76BD60AEFCC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
1360	msedge.exe
1360	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3708	1360	msedge.exe	84
PID 1360 wrote to memory of 3708	1360	msedge.exe	84
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 4936	1360	msedge.exe	85
PID 1360 wrote to memory of 468	1360	msedge.exe	86
PID 1360 wrote to memory of 468	1360	msedge.exe	86
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87
PID 1360 wrote to memory of 900	1360	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pcgameszone.com/no-more-money-free-download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b21546f8,0x7ff9b2154708,0x7ff9b2154718
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,802217134969393091,8459150352743736137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77207719-4e0e-4eca-9450-e9647d420e51.tmp

Filesize
1KB

MD5
ab2016cd4ddb4792d659d94737c603d4

SHA1
d9d507c5c5c1dda9c2983d59b1c60a2c3c96286d

SHA256
7ab7f4725b05f9c9bc7c73d5b02da88af496a5f4c00477505a4694584f19a9dd

SHA512
559dd47098498b41e590d43fe5f803f01e7fbd399ecfde5915ce23bef9069563900f631ad10548c173d55ef597bd01b97b8080a2dfbdd76953878d8e3c81d4ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
29KB

MD5
fc3a54126b60aabb257a03ee7368bccc

SHA1
2a52d4a13d6025b116c7e2670d8f15b00731100c

SHA256
2403e1a1abbaa8f911da32a55052a95352a23250d3caf33cfd9246e4084fcac2

SHA512
9ad6ed709ca7da4609e33758d4fcfeede77b7a56f5f8fa2919073695baf49211fabf6905be9ef778e0a060cd11260d0e6eadf4fc0f056dedcda23140640a6622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
50KB

MD5
cc2e3ac76c72cb6635fe4fcc92a35e9b

SHA1
7bf58eaa66b6d5e3a9d6d65a4a49779a48171508

SHA256
db535d50e781ab790d669d674e6a62888e82911a7c40511f6984f1aa054671e3

SHA512
07ad1db95d19ff5aede3e13af1ea94bc3d24c1ae3dfbe51640c829d0d400832bf69eb38654579ef9178ef93d6106d54594089010e74eda31829d66726a98b8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
18KB

MD5
167a86058d48b21466e3c8491fe17daf

SHA1
5b773efdd5310bd8b195cc61f4df9bbf52b30fdd

SHA256
01c91a01ecb23d3c6e8afea59272f858a267c74c69842334b247e047f9cb3001

SHA512
59aac63c0397e27c7435f7ebc9e5cadfef68db8dab49611807a631a959f8fa1179fa6186ee39916a385e5c8e4f0273142c0f897399d4f6fdc3148a5a577bbb37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1ff93f660e3a339f3eb82104f557f9cd

SHA1
15cc57d8cb904f9b8bcb40b4c5d5259a43bd9d10

SHA256
71b280f07d9d92e29ca76ee94f4b52157e3aaaff864804332ee6b3eee3de2401

SHA512
17464d4aee7d366f2bede18582b6af8ebd0b9ef14aa96452d4b83fe4813683beb17436370a691d9811030f08f86e48a3019be1013f4918dd80654e491ab38b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3b341fa4e0a89e1a4f3b8e913a148398

SHA1
105a9121d3ad45b398598a3216e428c27c44e5fc

SHA256
81aeeca7d3381d63ea39cff9754253e5dfdd5ed364dd5e77905d792c4d54462e

SHA512
24c66129cae52443889ef0e69eaa02a6b091db3c1a6126f5462a1cb0fa63aec7de239f1592a68d5533e1cf76f8af5790b3121f7cbd33f3b9e50a9dc1d5ac577a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c0aa0307cac80f8e8196cde59ab0b30d

SHA1
7b6cf6f16f2e900485151cd3a98561413927425b

SHA256
7d5a9d4ba6d0c731f30f00f6ce06f8b04b78a79a44a0f38f20fc893798669faa

SHA512
6a3472e42f00215088d389bc93f3f152e9b0eb5a3e81c4e40d7aae5568680016d420a5062f1fc322fc93895aa3fdf38b93a698ecb43e4fcb3d730b3bb4e7df2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6d3814b01be4bdacbcba6ad1e50414d2

SHA1
eb3020fff033d41e5a7e3741b7188cce3c7ee3a2

SHA256
df7ea89683517d5426668748f93e4c0124db825c8367e464942b8bd766d6a96e

SHA512
4ba01707c622e47ffb6897d0bee7a0565485c04be568b39b4aa128ab18ffded18848854841f61576e6e75879865eb9679ef64ba56a29e679acad6b8f02f0b326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeffa5089462a6b16849c2281a6e13dd

SHA1
2f5078692b0fa79e7300f56e9e81571ae070c01e

SHA256
5fcb04bac9dcce8d93b5eb118a0d161528be5a01c7911af1c0eb1c9fe02b15c1

SHA512
c1737ee7b5318cfcc7c328189e8a57cda90df03c7f4af702c2e49d71ba17bf2deed8d418912ddf00ec65e34933125c494fbca0cbfd5153d085e7cf3d839d6d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7e8362d37a0411523d74209a72d100fa

SHA1
1d834d26de182d3beb40144548360cb3b9429de4

SHA256
8c934631508942c726fe51140808b5daf4617431f3648fc4103c17f5232d0ffc

SHA512
8819a9e88918a14a73908a953ad69240e61d6ed6c793b5f59930132b476cc929b412eee5ace6891f92901212501ef0d3e3786528da151c613e5e2e6a2382312e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0b9f7330e27ed06d166827a88bbe06b

SHA1
ee85576e1b56bab4eafebca27b3df0a0e0346970

SHA256
e1c0406200f3debb40f19fcf5a1a134482b7cf6f5eb5b0ffed16391938510309

SHA512
dea65df429b1a4c3ca96e3b24f04a5324ea1690fb38519307557e130558f29589f9bc470556709044d11c5b6c6694c8ebb1c54f935b73dd6fb6eb00204fb2536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
e665351a42141912883595cfff89e517

SHA1
3733488708fdac90c5d1a6c3035dce64322045c6

SHA256
703cd1d68337a6141eb9e4231ac5e11a7c191c67cf002fcb6c3cabacc1e03da6

SHA512
fdf89cd09ef05554d7b1fe9b1fc84508b1a7779a6f0ecfac59a9720fd230edcb6e3dfcca0b53ec0ca2959fcff2d3dacbf0d432d67a90d656b478696ad62009f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2222cddad9ec5926caa9ed9a7f1bf25d

SHA1
3eec6ae3555d165d189e2935eeb42a2acc6d71d5

SHA256
4d8f96a39720eebe02734fdf286efad156fa3f316cae3262196474ab35d95c1f

SHA512
b459540b03454a156be87006da34e7aac7801e79ae1942bc9780b69022955d4c1a48accd1b462d6621fb9ef0d72c2e14efa4a0d405ba55a7976b57e71cde127d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
288B

MD5
297df8588d0a1428b4e14ba4535291bd

SHA1
a5980e0239b633c5ec525f1d20417f7dd63cbb1b

SHA256
6a57efcce5118527557b511c4f01701e928cf5b9bb251a7183cac3a60fe77215

SHA512
8b89d92a7d2fa0a852f49b3d4b872aa232746dd136fd235cf5c164e516a1089c51c54bd4e9c4bbce51138c1806abd696f52ed49af8f85a69d7df00ba20247029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593ca2.TMP

Filesize
48B

MD5
73d10a3909236411143ce7ab3a4f43c7

SHA1
03b902870cd1bda75d54fb312c215cf66ef019b1

SHA256
aa699491a824dfd77fac124614dd3cacf25309de8533bd8afe9083f3743aaea9

SHA512
28faa4c049de6c0440b5736f136554db2814183a3ade3129eee4ec46b480775ec30346f898b36ac4a21810518c8ca3c4e51957819675340acd6c9d84eac275ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
45126b5177ed041168bf44fd83fcee95

SHA1
66ebc00b33f4d5947122624e0bf3655b0e4f0705

SHA256
c80cbcb178c72078cb328a010212225a03dc7802783fa14a19f72c0f2f2ac7bd

SHA512
e90bb309d3dc179a73c3d9bbbdc4e208818fc41838a239cfd4677da26448b13546ee113582435a2f345386797887646559417a8ab5790749804bfd6c97efcbe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
89c640a38f6154d5d985fe5c7f02b212

SHA1
31f40f2765c808ec364c7598480e1e903d3d1c7a

SHA256
44b73d5788ab124e7ec4de996fccb3c5f011ab004273618b551ab5a9ba6abf43

SHA512
aa6e3fbb9ba1658b0b554a4649ca6e664a074966c107f2e075ecddffa97dfd859a5835a8b19db4c5cc75a152e7227a44b16ae7f5d716f537ccb718d9b90c7f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6be436484428f34cfa0f48c9383a597

SHA1
78037b13748b6046f2d798fbbb0a87632fa0d037

SHA256
5eae63d2f2933022c235778899749c9c79ee0b2bb55b2cdd0f7bac91ff6641a9

SHA512
c4924aee4fd69efde87af74ce0a419eab180d69f6df76e965bbca2b5fcc6373a26542472adec04ba644080511b3352c25a70da2c7a3726c9b89d3a0664ca44c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c128.TMP

Filesize
371B

MD5
81193611315791036c51f7ba912aa7f3

SHA1
049eb6cc29d0ec6d1072b24bc8bba3f8e6ec3d6f

SHA256
1a2f68ac89e9f754c51012fb3d20e2acf4f842f723f9857513622f726ae6d497

SHA512
bac12f6bf1bf9ac18e62a62efb2633da12ba5a91bb9b136638086baa43716d600cf95f4ec652a7f50c02dc68f5cde128418e57573110c52dec6ed07fe425fa76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b5ca4eb0eeb919f7fc3692ac98dda461

SHA1
73f75c7ae20b844d1c444abc71656014e5968d84

SHA256
c382724c214a04aaba6c9ed84c2efba56fe0b7c107b2684d63a00637bc4e1e8c

SHA512
c179ca6f4c6ddb80c3c684095810f0b2da1122eeaee30a80c22b594c241c1af92922551ede994096815da9c7929d6f0f5d67447e2fcdecb0579516e998432f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfde8a2fed785d33fbe8cd665fd8db08

SHA1
0e3e4b4f907a054470fd18febb8919a41b4a45e3

SHA256
3c2829e05aea6eeff89c9140e37ddfbdb28af3ad3ca14fced4d1d67503ca899d

SHA512
b5301b3fe65e51067315b668e6d66bfe411e936cfc38d098adeafb609070177e23f8c39219f5ae3e723c8853dc7df796d09a35b5d05eecc048fa30233f54e9de

Download Submit