hxxps://playvalorant[.]com/fr-fr/platform-selection/?gad_source=5&gclid=EAIaIQobChMIit_UrojriQMV3qloCR2tqQhgEAAYASAAEgKtz_D_BwE&gclsrc=aw[.]ds

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://playvalorant.com/fr-fr/platform-selection/?gad_source=5&gclid=EAIaIQobChMIit_UrojriQMV3qloCR2tqQhgEAAYASAAEgKtz_D_BwE&gclsrc=aw.ds

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
4472	msedge.exe
4472	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4520	4472	msedge.exe	85
PID 4472 wrote to memory of 4520	4472	msedge.exe	85
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 1516	4472	msedge.exe	86
PID 4472 wrote to memory of 3240	4472	msedge.exe	87
PID 4472 wrote to memory of 3240	4472	msedge.exe	87
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88
PID 4472 wrote to memory of 2760	4472	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://playvalorant.com/fr-fr/platform-selection/?gad_source=5&gclid=EAIaIQobChMIit_UrojriQMV3qloCR2tqQhgEAAYASAAEgKtz_D_BwE&gclsrc=aw.ds
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92db846f8,0x7ff92db84708,0x7ff92db84718
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2340,3796631300582310550,5841562764726733280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x2fc
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
30KB

MD5
0c5e2e00f4ed60d418e0d081ea5839e9

SHA1
769e7721cbdd2b53d76b95a9cbd22f89e9ef8bba

SHA256
7cc76689204539c35c41bcf4e938b0812e6b5ff6c2a58177e7b06eb23ff5e392

SHA512
f9256d431ec478e3d947041ceb259ae5bb3e3b4de81968ee2755e24e2c3c51c52dab84bcb87749b5d3e65defba7b44a8fc97bde8ef0e57dfcb7dbb3156386930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
117KB

MD5
8a2c2070ca949ffa4297656a82aa3be7

SHA1
5baef079a2eff8b29e4e9b0aecd5828fc5c39f79

SHA256
19abd3f4454c88eb463da45502c6c21deb8a4cd31f758e84758731404aad3d14

SHA512
08e97fb5c71789e4361fb4d7f8a71407e9e3997541773e379f8b79d334a61a60ee656ab7905aac5e94102d0733d530bf34b32408f562f66432969e4a891dc4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
40KB

MD5
4418bd1dbea205cff348482533bb9070

SHA1
e842bb6fbea2c099c57f839f0e729dbb926003b9

SHA256
1d5bd403953287433c1c28681d3664a51f4c034b2b879ae8b2e5273977e924ab

SHA512
b4369cbcc55323641722114a1eebafb8140fa1819e88c864a08f64f6c8e83517af2b323f4db3d1fc36514572585e0beafeb71460379797e868128419a4b77815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
433KB

MD5
f8fa0953c7252e62843ca9e002bf719b

SHA1
d8dc525d3b8655e061f5f38926f59cd928d5b38e

SHA256
e2526fe84d2acc97823832df82b17cd4a114cbee2c2be50304b1549baf884b8f

SHA512
6defea43900dd925a17412d67e9dbe8ebc3e3fd57c95243d7799c8e510a4b4a9ae6e30285531baf98910cc6a9786215fe068231643c40b71de93f0678280f3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
27KB

MD5
c833c8ac81b7bdf66902fecb47793ca2

SHA1
32e59721023dd2d1d961285491bbd268f0325e4b

SHA256
fcf257708787cf2089125e6c5b731c80f4d47d1e00cd75186175257979451b87

SHA512
1ba52e68eb42fd85eae2542a2a784d0f1f8b282aaa8e621750a60c312af4a65a8632354f9ed03c7ae9d6d72dca636467be9015742ba96c5074ad52c3cc01b5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
1b88657e3245f2e8a9224477acc6aeaa

SHA1
f9dd9b01a6ad3fd864b8faf9e2428e4f0fb4ec4a

SHA256
4d59d9627a63487003dbbe4c3ddaf546cb5774cc405e0ce7608c2eca96b7388b

SHA512
aa87aa62fe17a2b3980d9a2f68a8e219650c38b14780fd9ff93798d176e7972a4246aa40112ac2968257b5898c8cf62740a3580859e17475de892d427019cb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4905ba4946a2b8b614d752226942b0e6

SHA1
a97738437d2c60dc414d6058e7df11179569b5d5

SHA256
f8816e603377b3ae6343cdb31df8fa4f7775537e88f5a2893f52b9cf6f693eb0

SHA512
ec2da0c8c0b68b21989f76ff35519b9f0b174c73722d6ece11edfa226ed555be8af3de8739f88090a54e71a84ecadc9ece10d15f56931e94fb285b9b8081cd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0250d961affe1514fed592d9a2ac55b8

SHA1
9aa606a4b24b033308608ec8168406993b76fdad

SHA256
214e01c11ad5dc2ef3176c64e73f5e3641f126adaf3c3d167c8b316a6f883ba0

SHA512
e9ccdec34500382171b356dd318825d94fe2bcf53ece4dbcc40326ba2f062c4542c50775391eabdf2e71bfd75c3f5f6493b1a31b9a92e30c7b5d65aad52db31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4b488618a726fb79525db27a3807a97

SHA1
d1efdc29326de9734fb3a78f9a8d5677d670d56a

SHA256
b9f326317f2e8b8cd3fe98eac19598b8a1291955ae7c171bddcf97ae966dff13

SHA512
5b3d32d3c6d326a925e5c81d76a35815f1dfc1107bc25228fa8e9d15b9e568917f6750eadf6e9a749c696e8c4c1caeecaa14caec2519978f645979c73251c9b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cec5a2f1ea1e9fc56122395b757689a4

SHA1
d30a4b88aea8f513417cd2b089c12a567af23519

SHA256
0ffd54282ddc8bb2061461d98f632f27fb0ad715bb31cafb5a14a0564fda8c41

SHA512
817983fe9bedb6e0fd0623d464989204b806425d07bdfe4701beb0df691bcd2ac3a334463c3d6ed4d3c48452837302ab927181e02e1db99ec235a359059feb2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91423af3adad5eaaf4540815281422c2

SHA1
dfada13d5acc1aec4b63773f90c01f29161afa35

SHA256
be76b8ba9f8ebfb9feb2ae5054067ec7394af8c435fbb7f3a5af3b3047c501de

SHA512
fe5675a99b20abf57e7ad676064d6b8400070ef7ea261bdc3ef70a7e147148815daa03a57a78fc9e990afb77dc102a1207720b37df77d5be0da66b524de55c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
25KB

MD5
7b90c019d6d5cae42f0ea30f863c147b

SHA1
f06c8b24d7450522123d8f985c8b425517ebd8dd

SHA256
eb31a115979f8089ce75f5b4210f72e302de1f22019003e657c476682d8ffb84

SHA512
fed96a8ed34a2321c360bdc4671f06a21b160816fc298adfa4c0468d37c55df6f5c423eb8c027ee4d25586062d7e8d70c64434c58e00a79ba3b74d3b96c9941c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e33841ec768fdea75736d1f8024a059c

SHA1
1412c510b5a6fdcea2b38adabb34ea22574339d3

SHA256
b2a98cb16c240427414c03a90c7e74fc8d17fcba119667f354a2f1e98a179e39

SHA512
f5a1121e31b821041d9bdaec4f0022cb8f153a56acacb152b0f9128ee8656e5db9f68caa8e262f44bfa282c61e1d9d3c5c018ed970a29291f30789eaf48ea628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58118f.TMP

Filesize
48B

MD5
80958bc5600881ac0d792033577faa23

SHA1
cd5b28740dbb5c1c154a471986b2db3bda6e6d81

SHA256
12e74a7502c4c1d891f01c783074a4a23fe71ccf4da9ba0829ecc47eaa914581

SHA512
3791e6898361e30408989949ecb555efa71c6888f6fdeb19532e701a358bf9b8d2c67e5d8af4fa098bf0b6b890f8e6573ac9ab108e42d1535a56f0307a1d0b72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
2960145381ca29a3e6f2fed2d1877ff9

SHA1
cd77c62a56262f7e37d7e810c956ac05e14f980f

SHA256
89df61cd77ee41d1a6a3cc15f52d63ab3696659856e75c39fae6f01a9f8b0738

SHA512
b60aa24dfdd67a223f55a1558880fc2fb8d6e2279daced2c997406ce114d62ac5ac0824a0fc909042dfe57e9de883862785d9dde190657d28b38c4f574b7b420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580162.TMP

Filesize
537B

MD5
ba0aef44642d8aa8f02451c312caa8a5

SHA1
d5998cb924df280df88c4a6e4c6acd8fe1c332a8

SHA256
9a56e508368d48f95c6f3c70574ff9708a98b7b5b1f54c1681ca32543e1bb8f8

SHA512
b2b79e17362736d8be2fe1dd1ec9c99faf8a305e6cb7cf1352fea85c11f1e30a569a6bf7ee8a514119470fd6abb39b2415f110c88d93e5d37cedfca47ed49fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fc0c75afa13032f8c4a7a03a0bc67427

SHA1
354a5a8768a513a88f958392da5eb1f3863c00f4

SHA256
0a1cab4e50a4103baf753326bfdd137ef66c342d7cacb04031848819a681e178

SHA512
e03f777edf6ce4a55924e7b31a217b2e9d11313ffe4d42f34a3e37e9ac8af94b54561e599199695216c464c18477454eef86bc932b9e58c07e0314670fa862b9

Download Submit