hxxp://subsplease[.]org

Analysis

max time kernel
86s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-09-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://subsplease.org

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
18	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\[SubsPlease] Oshi no Ko - 21 (1080p) [60D2B506].mkv.torrent:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2540	vlc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1280	msedge.exe
1280	msedge.exe
2780	identity_helper.exe
2780	identity_helper.exe
1912	msedge.exe
1912	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2300	OpenWith.exe
2540	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe
2540	vlc.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3312	MiniSearchHost.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2300	OpenWith.exe
2540	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 772	1280	msedge.exe	80
PID 1280 wrote to memory of 772	1280	msedge.exe	80
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 4796	1280	msedge.exe	81
PID 1280 wrote to memory of 1408	1280	msedge.exe	82
PID 1280 wrote to memory of 1408	1280	msedge.exe	82
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83
PID 1280 wrote to memory of 2996	1280	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://subsplease.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc8bfd3cb8,0x7ffc8bfd3cc8,0x7ffc8bfd3cd8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,17360928831803550401,5821719033890767443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\[SubsPlease] Oshi no Ko - 21 (1080p) [60D2B506].mkv.torrent"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
556601dd2dc72aa29ebbc2c5973fd258

SHA1
dbc414f199d2e8bbe52c3e73eaa9f574a6ecc2ac

SHA256
e00972b5e94591f88a7748a1812e187213231fbe0da38fcd15b6be53c2e201d8

SHA512
7f41e554882b8b2c0a86301c7d15eecd0462c56b6d84c751068cb55a3bee329aeb398bab812eeb8ecfedb61710c63a6bfd92efbeac9e7aae9e9890cde0e734dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b5e2d5a026e76aad9b0c62d9d3c8ab62

SHA1
87c871032143fb7f321fb78cb9a464fee341919b

SHA256
32aa8402e3800e9c7d45cd5e3d351a73f81dd323d91e934d72f6ff5d57b39275

SHA512
f672c1b490544c86d341ebf1e81ed908c358ee99b3f1b23fe849839c360b23111487d30c28329090420686195d545c1c5b40ec41c9acfd5b386fc7611741ae9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89a408dc6ecb62d401507216c1d05ad5

SHA1
dee741aa401ff29a2d7bee5156d550096d15e6b8

SHA256
aeedba9ba7638189cda7c22d653a2cee4b476c33bd187ba843d35d773b4f8ec9

SHA512
a51f209510740056ef6caea229a57c50f80a6a1c664eaf60e3e6c99e6cc99a4fc68f3e121a17adf8eb18605d2743de52946149f3ac4ab167c7e79c36d82424cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
800da8728808a5f5750d290086db5354

SHA1
defffdc29a78265a4e41a73ce1d994874d7521dc

SHA256
5a80f30a8c42148af8810b3ef8da53d47a04d922a94b14f3ccfbb3e5fcd9db4f

SHA512
82369c8691cfbdb886d65ce93af0634dc4676d44231182e3b1c64e375361dfd8f278a1caaac8ae6a7ba1885d7d48bc0390fc3906a5cc30ad4f20975d8c94096c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fff6845e326ad91563349ca3e6826b87

SHA1
051a42be9d295fa600c44e6face6b1558382c1ad

SHA256
8b166c09dd75f36d41951255e029e59ef4062cfb5874596e8baebae13cba01ce

SHA512
38d539cdfd001303734c463c09e2c5d6ee42c884ecca4026c9dbe8d1473dd7ebde4508d1b964b93ee62249051fc3398587bcd0e9221eb20c74e5f9e367b4cc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b8de02fb9b0cae1de8d48df99a7f959

SHA1
3d1b845694fb2f7c10bd424040f77f880f9bb196

SHA256
103ffb44b77f2011c539fffcd57aa339ac7751aa7fb666feb64f70698760c973

SHA512
03bc54e481b11845f27c02f6ca32d7c46aa55faa93c14b46dc69f801d5baeaf1dde635018f012141e4fa57b0e457c3c1bc5bb6c553f761b3fe6cef8d5548ea6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e2bf.TMP

Filesize
534B

MD5
74becd525576467ccebc2b263a694367

SHA1
c6fc9b88dd2f8f8e52d5fddcbb236c2858c4cb57

SHA256
f51edf0b1da51efd3e3bf5381165218c2826c52863cee772a542d452b3a49496

SHA512
5ed5b128451af10e41adb357fb332d10d36a21a994d56c9cb048316bc1c5d10dccfa00d23c6f9987cc3dbd2855d6fc6c56c5f870ccf7e6cf8edc66fabdff6861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
08b733a765749e519308368225f5814d

SHA1
1a7774aa6ad5c1e6a5c95793db6a3bdd3f4184ff

SHA256
da40bdc0cb00ec5efff2fb65feef8ce00be105c0081fa03a6c05fbd6ec51ad65

SHA512
9e75f4380a0b3fb0a390ce49bc628157b04848ab414369e5f73db70c35a76d09e95630b60d35c6cca8e73186501a253e74f2346047435742d520f1092f50e7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c148ceac4fb185846b0303023ec2f868

SHA1
c7de9bb5f52a29a02ffb27f6784d13e00f2f33aa

SHA256
1792a16da7a2201e1806015530f8feff10ac5a069f84191be1de0fcc9241703d

SHA512
7d6686f8a63db907e05cf02ecc8dde5be5bf38eda3a00f0d1e7cb991866679391103f29308d0aff499cb2b9ede74d07fbbc445c50ed287f6c4323819d22351a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85f8ea6c39d6a56a8ef76efcef48756e

SHA1
00e653f73df9ea827ce0568a5780d6ded1da96b7

SHA256
10388d3ec4a020680a9564cb633991614dea9fedb47208cdf4b992fd3a488018

SHA512
c04a1384c65e8fde01f6e644d244047481e0d12965286815dbe69f9eed0c3c4d119fc075988d50b93938049baf13bbfb0ab77693a104c43725350e11a43d79dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d234745c9875982f309538d6010289c

SHA1
e706157fddebd039c282da8114a90d225a563809

SHA256
838d603a31fa7316305c78b16f6ba8da04368e42e3ab9b1c89c2ee91e015f8ec

SHA512
b8027b4108fcf286296b8fc8d51da8b3ec9fd30c5abbb002b1415299f1367bb9ac9de9165954043a7e0d5e594281186da74c73b8bfffdbd92f3dbb4589d31b08

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a7f391566ceb7d310b04c1376aa66a07

SHA1
eda88e9134d3de209152481c9e8aa02054d4c2eb

SHA256
8ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e

SHA512
163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.em2540

Filesize
148B

MD5
a35a83bc64e10f91f3316eda0eeedc55

SHA1
904b220a7fa0882a10d06529e8a42260eebf5518

SHA256
4ac838b18c1d6ebc0bc67ee7321618be6ce802356f30ae9aff71ba4a1933bed5

SHA512
0275145da8822399124910c20c35a44fe76ed5e39b2e96de57a0db3d7f51932010a5db663cfa7cd121e0949c974adf2ed227c52b84e0017775b3348c13c4797c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
9332e052cbf156c8232e0efc23f2707e

SHA1
089b4cf108a419605c0a5ad12d6813f9a2212038

SHA256
d7a6a61482b0a3c2bcef64ca7e3aaa569ce2728fb21f0f2eff6398d271082eb0

SHA512
8b8600e4aaa1d85107f8366c23050cea088881894eb89dfb5ec5fca2a899eab63489583aed87ddbea02546f294407f890eb5aa8e8c9ca041b1b67a0f433174c9

Download Submit
C:\Users\Admin\Downloads\[SubsPlease] Oshi no Ko - 21 (1080p) [60D2B506].mkv.torrent

Filesize
37KB

MD5
2bf09d794a364a19abbb9eca95cb57bb

SHA1
b1a68f13717d9679cf79bc7fbae81df24a2df364

SHA256
6750f8833247faa73ec85b42479c2421698c0a2cdeeec099d3d829b27df788f6

SHA512
aa12c24ee6e8070df1a7d49a2d08e4b907fb8921da2560a09eb70067159a9808281d0ce640a5c574a19cd09cffa1eb0bfdb8c09ec3f2e9b11efb11bc7c1db29b

Download Submit
C:\Users\Admin\Downloads\[SubsPlease] Oshi no Ko - 21 (1080p) [60D2B506].mkv.torrent:Zone.Identifier

Filesize
109B

MD5
7a818def54e881c927d395fed3d2d671

SHA1
cd45d4c29f44266ba3ccdcedc06eb8f44f44c937

SHA256
63104ce0b3da4534a0912d4eb6258474613f74f13c85929c500bc47787760f3a

SHA512
21f548b70170da2351bbf60e4f54950becf0890872bbcfad71390703d69d1b015e5af53a37caf6c1ed46a09c0e7258f4f02cb1e7364ca9d589bd97ccd046ba61

Download Submit
memory/2540-503-0x00007FFC76640000-0x00007FFC76697000-memory.dmp

Filesize
348KB

Download
memory/2540-492-0x00007FFC78FB0000-0x00007FFC78FC8000-memory.dmp

Filesize
96KB

Download
memory/2540-488-0x00007FFC80810000-0x00007FFC80821000-memory.dmp

Filesize
68KB

Download
memory/2540-486-0x00007FFC80960000-0x00007FFC8097D000-memory.dmp

Filesize
116KB

Download
memory/2540-504-0x00007FFC75F90000-0x00007FFC7609E000-memory.dmp

Filesize
1.1MB

Download
memory/2540-487-0x00007FFC778B0000-0x00007FFC77ABB000-memory.dmp

Filesize
2.0MB

Download
memory/2540-502-0x00007FFC766A0000-0x00007FFC766B1000-memory.dmp

Filesize
68KB

Download
memory/2540-501-0x00007FFC766C0000-0x00007FFC7673C000-memory.dmp

Filesize
496KB

Download
memory/2540-500-0x00007FFC76740000-0x00007FFC767A7000-memory.dmp

Filesize
412KB

Download
memory/2540-499-0x00007FFC767B0000-0x00007FFC767E0000-memory.dmp

Filesize
192KB

Download
memory/2540-491-0x00007FFC76800000-0x00007FFC778B0000-memory.dmp

Filesize
16.7MB

Download
memory/2540-498-0x00007FFC767E0000-0x00007FFC767F8000-memory.dmp

Filesize
96KB

Download
memory/2540-497-0x00007FFC78DA0000-0x00007FFC78DB1000-memory.dmp

Filesize
68KB

Download
memory/2540-496-0x00007FFC78DC0000-0x00007FFC78DDB000-memory.dmp

Filesize
108KB

Download
memory/2540-495-0x00007FFC78DE0000-0x00007FFC78DF1000-memory.dmp

Filesize
68KB

Download
memory/2540-494-0x00007FFC78E00000-0x00007FFC78E11000-memory.dmp

Filesize
68KB

Download
memory/2540-493-0x00007FFC78E20000-0x00007FFC78E31000-memory.dmp

Filesize
68KB

Download
memory/2540-489-0x00007FFC7AD90000-0x00007FFC7ADD1000-memory.dmp

Filesize
260KB

Download
memory/2540-480-0x00007FFC78280000-0x00007FFC78536000-memory.dmp

Filesize
2.7MB

Download
memory/2540-485-0x00007FFC80980000-0x00007FFC80991000-memory.dmp

Filesize
68KB

Download
memory/2540-483-0x00007FFC8B440000-0x00007FFC8B451000-memory.dmp

Filesize
68KB

Download
memory/2540-482-0x00007FFC8B500000-0x00007FFC8B517000-memory.dmp

Filesize
92KB

Download
memory/2540-481-0x00007FFC8BE00000-0x00007FFC8BE18000-memory.dmp

Filesize
96KB

Download
memory/2540-490-0x00007FFC78FD0000-0x00007FFC78FF1000-memory.dmp

Filesize
132KB

Download
memory/2540-532-0x00007FFC76800000-0x00007FFC778B0000-memory.dmp

Filesize
16.7MB

Download
memory/2540-484-0x00007FFC81AD0000-0x00007FFC81AE7000-memory.dmp

Filesize
92KB

Download
memory/2540-479-0x00007FFC81AF0000-0x00007FFC81B24000-memory.dmp

Filesize
208KB

Download
memory/2540-478-0x00007FF7F8B70000-0x00007FF7F8C68000-memory.dmp

Filesize
992KB

Download
memory/2540-584-0x00007FFC78280000-0x00007FFC78536000-memory.dmp

Filesize
2.7MB

Download
memory/2540-583-0x00007FFC81AF0000-0x00007FFC81B24000-memory.dmp

Filesize
208KB

Download
memory/2540-586-0x00007FFC75F90000-0x00007FFC7609E000-memory.dmp

Filesize
1.1MB

Download
memory/2540-582-0x00007FF7F8B70000-0x00007FF7F8C68000-memory.dmp

Filesize
992KB

Download
memory/2540-585-0x00007FFC76800000-0x00007FFC778B0000-memory.dmp

Filesize
16.7MB

Download