hxxps://unigamingwars[.]com/home/

Analysis

max time kernel
80s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://unigamingwars.com/home/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{06FD82A3-9405-4614-AF85-764D92F9E39C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
1760	msedge.exe
1760	msedge.exe
1068	identity_helper.exe
1068	identity_helper.exe
3984	msedge.exe
3984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3260	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1624	1760	msedge.exe	84
PID 1760 wrote to memory of 1624	1760	msedge.exe	84
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 3388	1760	msedge.exe	85
PID 1760 wrote to memory of 4212	1760	msedge.exe	86
PID 1760 wrote to memory of 4212	1760	msedge.exe	86
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87
PID 1760 wrote to memory of 1020	1760	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://unigamingwars.com/home/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb026546f8,0x7ffb02654708,0x7ffb02654718
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,14512701817096140426,11098859224835304870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x240 0x244
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aa88cee186e05158dc77e2786f20faa8

SHA1
9fea9637076fbfd2a7d033040ef1cad53e4e881f

SHA256
0a76f1699f3139b67ff90eb812eaf7fe6f9db6dd0fc5b7d500490847f4fc485b

SHA512
9f32aee6a144b4bfbfcc8bc6b66642760bab3daae7765ba4c0dfefa4ef82a413d672eb4be56c9454b040e424abdf87f568a40c98ece6fadfbe001b19c8b0108f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f492879f8b6a42f670f400be03e25cd

SHA1
1f82dc801664149f3af4ebd4fb2c5afe2c5cc8f5

SHA256
1e8285edb040e7a7dfeeb508b8ad03c76b465a6d8d964f25b68174be6565557d

SHA512
1d5f23934d16285da02cb867a557aade926501dee0543af49cca9ff5b5b857b7ec49270f3b093dbc0cf4d023ac40c86d006ad21eb8668d68b2eb67defb147e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d082415c2f32803291918b1854f02f9

SHA1
b855dfd341181583061770691f347b7234045fb1

SHA256
9fd8377036d1cef65fa94b62fd4e795a6c9c1c8e786c4d6e1dc730d6510dbe07

SHA512
5047e433f8695db3b922c194be02d56d4cf1eb15b2d4887abc8ca08e3175501f54c2d3fb1f17c0f7b6ae1e627683871d7b64af766627b2498004678e88ea8611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7ad27a2a2472c776fc41bf1c51f18b7e

SHA1
6f2f699aef1b36bdd40f49379d607ab5f2eb3eb1

SHA256
3c5b76038e18db7f065da45672f718a202219c889e4fab0be9963f195c27d101

SHA512
72e5b558be86013eb05ee77e9c9df9a0e79eb3a0625b7b6829b2604cb499c94cf00f4ee13c16c66a3b2d8e7cb9d3e77daf118a658bd43061b09ba3d98664467c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
7c7f9974bee806d3334f26af4faacb0d

SHA1
c937d29c191ea3fa1a364c76b54c58053ae7ed94

SHA256
5f906b35e2e7867f03bb9c42e59724036d832664eb2ee332a63154d936025f9e

SHA512
2b5d1d58b25a7967a844c3be364bb4d0b6b8b320e0440e0329ac51d892671945ce36f0024cd08bbf28c4608f3183ef96e40f4b33c1994be5c069a07f0cde6eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
8a9abc401133bf24ce0593c82b4acf63

SHA1
34720dd406e5744c96bfcdf3561dbcc1591662a7

SHA256
fe14c5c210cd4e9c76e5408f9a39b05014a210ed1f0ef99b8fed21c99e76e555

SHA512
8313d30a846202c543a4a76f247a84f783f038da451ea2438ded0a24f4650ab9ad6009a309300e489d5fb94ea74771098a802e0fa76ee2b2d26e46e55d901bd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
6dc9fa99bd3a3c72f0e12748def5c896

SHA1
70205547d8f7b57ece471cfddbd6ee49efa6d7b6

SHA256
a92c37563987781a747fa6d289873fe91340a74e7e9bdaa212d144923998345b

SHA512
f1e4c88c2da59a55976b636e384be20b364cff47a4083759c632ebec30b6d0c1b19049f91a3c2d8cd64bd6842e856ac2a15d92ccda236e9a0cb0ba2c68199e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
0f4d50fbe75d12b59e8eb6a2e0e36bad

SHA1
e67e1378efd2dc00b070b6e430c0c1554f6c70ee

SHA256
1a7261da45904bbf6d7a3dc899b1dd3f22f4dd15edc6a6ac61911d4e8a1ebaab

SHA512
bb1f9a9d80a97cdcf36228cfe41d6c473de5b84f0d45677b22a9cd9b35379bc1c826874a3805ee571bc3487d692c4c55ae201bf42926de3b50367284f3f5d7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee4aae1b0101a63012e1b0bdfbbd6a00

SHA1
9859c71fff332e899bb4b21fdeeee2b8c8e47aca

SHA256
9c9c9a865a76fa20910416ea4862bfed72cba3b745963a4da005f44c8056a7c9

SHA512
f93a8069f3ad22a4fd94015eb48654a6ca7dcd56e364df8d09e1567bbd0a392e2d45eb9559b115e75682de458e57a18e824996ff64cdcae8525b244b8e61f45d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589536.TMP

Filesize
536B

MD5
0718af94d22fa59c40b9d086d9d595b5

SHA1
ce977153fdc32a149a109e63497bc7a2bd71d118

SHA256
3c49098770e3db6721f575a67faed779de6d5514c75941ed5b6324f7d1778e30

SHA512
93e8449ca4c9eb350fab5bbca2be32e4d62bca3b4dd61f423167a74e75eb2471bf11e06a1add36b0bcec196b8801256d1a245c7af4e20d189def652973cc1050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1b4b286f26c511227f0c2070f51d9a9

SHA1
3e613727248ea560ecaf06a38bd4a45aa15204d1

SHA256
227bb692a688e7926b49d3d5df4f8720a9a6cb967406d6d45436b5cc168e9ff6

SHA512
18a5316d2015898f5d004fa8b7259351db971b7a930de71366d0b4d4592816cbee81950acc4eba45c39190fc1242d8f90fb395cf0182b6fa9908b284d3aad88a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c69b18362621374c275f5415bbf4b470

SHA1
1fc4095bb82d099721b797c3843b27a40809739e

SHA256
34a21c7d849a8c68be6ea9266852bca37d06d09688bd9641e8420b9007ad29dc

SHA512
f6ff1b79a763544fa1664f8d8a3605ad2d7869d1b4e02b8ac49ccf91aa4ea37c6d5d5c6b8064653170935ac6f9804638732ccc4f8122fa847983c8b2c9b0982a

Download Submit