hxxps://steamcomunnutiy[.]com/gift/activation/feor37569hFvrba1

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1392040655-2056082574-619088944-1000\{67D11D3C-6238-4893-A57A-1C158E50B479}	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 968455.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 968455.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2480	msedge.exe
2480	msedge.exe
2132	msedge.exe
2132	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2132 wrote to memory of 2428	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2428	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 4540	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2480	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2480	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2384	2132	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcomunnutiy.com/gift/activation/feor37569hFvrba1
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffefda46f8,0x7fffefda4708,0x7fffefda4718
2⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
2⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6148 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6176 /prefetch:8
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
2⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
2⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6024 /prefetch:8
2⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1637026294942280027,13520475296567076855,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7128 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
343e73b39eb89ceab25618efc0cd8c8c

SHA1
6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

SHA256
6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

SHA512
54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d4c957a0a66b47d997435ead0940becf

SHA1
1aed2765dd971764b96455003851f8965e3ae07d

SHA256
53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

SHA512
19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034
Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035
Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
e000d1c52c69063fbafc0d25f949341d

SHA1
8f1ae590db58a6389e66b9029b3ef055cad64846

SHA256
ec6e10bc216fdc771bd9e17c800b18a28683cd02325502fdc82db1dd20a5cfb5

SHA512
e84ee84c280dcf8a4097bfcd2a8a496d34de79c0110857515e7744c078fec8337936ee0ceabc2fe10374ebfba4493e847ba96d2c1349adeb6eeeb932777ef3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
6470c9c0a9b3eed52a23b224b7cb0e3c

SHA1
f5f4879a64f9cf5b7bf48bf277f6cda999523548

SHA256
da4e6d3b624f16a5fdac6dd2e4ee1a70121d545478dcaee224119d6ea885840b

SHA512
6aed01920d616668a20606e5688df1323251e82aee4359fc0120d28a126fb87b56f96c1fe6a8f3ba0e0dd5ec61b3efa4f860e22d23f93fd91036e5045b30c321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
543B

MD5
f4b15af3de6b4f5b924a2f0b844ca036

SHA1
b2ea6bdf0f99ee44992910f3608385ffd51f88d2

SHA256
76c76a59914bd2e3c78fc5d3db079be0104758f849f4d3f93609fe1283be5f12

SHA512
f3f33bd5fca624fd2106b4657e9f8e00471f397cb596f6db74a9fb53dbb173e2ab17fc97f1c4636f752333be8f7772aefdf15da5b0574daf930e08d7d140976d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
983B

MD5
e747306f6255e8fcea778558bbc55ce8

SHA1
836ff32efc7cb969cb0abbdb3e949cf2ef175115

SHA256
4ddfaddbd43a22052f010451323fdac89386b8a5e37641496afde5799010c6c7

SHA512
a354ddef2d77b7dd1fd67179e710cfc5cbdfe0841c75da3d6e1d3b4627638a35feb54cdf787acc1dc25f6343b3ee900fc22f2e4ce1af5be4b73da9c0bbbaecf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d281efc2289ad7304423d91f3df334dc

SHA1
f0b1e6ae904557ffe2d38eae9c4360029db911c9

SHA256
6dc045fb11063fd94eb1985d4ce66e7c9a1a00141a44acf89e113e2c093dc8d0

SHA512
4ddbab4f567ac76f509204d644f33259133f415130f4201aa5aaa8893e5e897b8da4eb8b863612ef3c9320c10258d2efff6d039534ba02a6f5d072a5848e11bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
40d910c6a3cfa2be9a65aad94284e744

SHA1
3d4ddb0478165e5af8d3c03d6ab8b304db648f29

SHA256
e313cb2a42e50b4062d2c37df61cb243004f42316bb2ac5f88eebefb384f129c

SHA512
baafab7fc3c14572238a9023eea52a3bcce35535510b211ce1c2ced7947fcdf9557e32e366f3cd295a7edea6a70ca2de7adb9de9bb60ba750290da4884d13e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
d4b40306d261d5e0f08ee9d0c3761b97

SHA1
bb5de78ea4dd04bfc514f4147b89ce91d052360a

SHA256
11d2881af50daf7c072a93d3f04841dca76371056d709dd45c329822123715cb

SHA512
f77ba052f9f5e0b1e22ddac5fdee59e8b162ef6f94c7d95cfee4fd20a82215089723d5e4234cfe880c3203606af0504959547d08149bdfe6d16f61d1c3ea974d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
5d4ee4f4f24d76e9f0f762f1724cc83b

SHA1
8e680b42cc6f36443a156861c577405d1dca100c

SHA256
90da004f692d15b85ac584d1e23841f8f562c08587989f073fca715e9d2fca29

SHA512
fff7edc38bcde2b0844aae221d10e114173b03baadbc1843ba2dd1553d6b23479a47049379bf51627154aa386258fc07fa89b9dbb999ef12579f457ec3187dff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9060de194e33d8bf997627274a0f7575

SHA1
d3b53d3110ea891321e10c83073bfd42dc9ba7f4

SHA256
274919b595fb116552cf84f75fb05234477269b346940a44d7e2555d80b40b5c

SHA512
70b1ce4974ae06039be23e27367b102d2a085afe6281ca4bfad8825dbf40eb3ac1e70150d8ef77fffda67228f23eca9bf93d8e1dccf5c7c9c0b5e06efc7ce249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2fad2a2e9c6472916e85db56b265d984

SHA1
230dfca3a781d6f3c805de0fcb9673c3aff93a11

SHA256
4e3c4860e0fd02277ddea146593132e0037ea9f4fbbd9a7d54a35d2280ef00e4

SHA512
29e116e7c1a5622a3f49ebbd5083ee283a0727bdf9cf422d43f69dc570cf9e998b17304f7a8429102e30c0e00f0c0b58c3198769f239a43a05a4859c855d0db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
6b59612fa8ae564a9744e72767c59acd

SHA1
94d41e4857a1e24363c7bc854ffad65054ada3c3

SHA256
88237c20f881131a84959069daee5d38f359b3ecbb8e5098115f11fdb080ca34

SHA512
79b7ef06961723fabaaf970ede5fd594eb86370bb87f7085d68518d7aaa0b26c1a2f9f6f59838433a69ba01dac7937289c24dc7faf4fb13f941f04ae96f1ecf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
8b709bd8555e1d9d9ddd8867bd955fed

SHA1
586bd299ce4fa8b62bba5ddea329c73a42623966

SHA256
fa5a83629c2029ea6eb17b42a50987a0384c1cc9141da4c301122e89e3bc2c8f

SHA512
cd2f29878ee21968d8a00acbee4a6e5e488c4ee75c945e38b35d17ec305f715f7593ec1c1508f7b6ba1390642adc840e6fb6d50a710120c5d28564b8cc127e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5862fb.TMP
Filesize
539B

MD5
578684dabe120b487a879199e2e06ba6

SHA1
6dc16fa4d851b56c8983bba60519f82b6c713624

SHA256
ac512e9e0f7656bcafdadfc47b3b95c8a076fcfbdd2f9232ebc42c5f6cebfbc6

SHA512
d8b68bacc3c1494c3c0803a654f8edc15e7ffc2ef7a535db29d8019a78fa3c1ddea3844157705e4566e2a7f433d93024356200731db1371611a09f89b2f175ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
37b370e978c830c3958d982db31cdc43

SHA1
8e34332c7add4b0100107bd408c31571b4135cb8

SHA256
f60211e9e71e6e3726d72f55f322ac704b737740d9b51bd20db7dfa7e87afcf4

SHA512
60acde2573d66ca04d925bcf795e819e26ba130518b2801c56ba6e2f48d6b0e3fe99d27304238b2c55fff10edf461b67507a3726614683f7aa73a5dcdf1c3130

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 968455.crdownload
Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit
\??\pipe\LOCAL\crashpad_2132_JOJLOQBOHIYNWJTF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit