hxxp://steamcommunity/50$giftcard

Analysis

max time kernel
79s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity/50$giftcard

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand steam.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{B7024949-B8D1-4D7D-8A19-EF9DBBFF91D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
5036	msedge.exe
5036	msedge.exe
1456	identity_helper.exe
1456	identity_helper.exe
2248	msedge.exe
2248	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4388	5036	msedge.exe	85
PID 5036 wrote to memory of 4388	5036	msedge.exe	85
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 1660	5036	msedge.exe	86
PID 5036 wrote to memory of 3476	5036	msedge.exe	87
PID 5036 wrote to memory of 3476	5036	msedge.exe	87
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88
PID 5036 wrote to memory of 4920	5036	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steamcommunity/50$giftcard
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,476774004860544172,1993483645839244451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1bf2a408ha03eh4d3fh9b04h1a8f35461328
1⤵
PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,7053640228019544768,13822183667792085470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,7053640228019544768,13822183667792085470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,7053640228019544768,13822183667792085470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff7ed4bb2b4c7670d149eed5894e6b0f

SHA1
40eaf2c66d6bae8001eae1a9594f9d1fc8547054

SHA256
99be4d3bc7075bd17102bcb89e2b6fa1c35edee1625380b9e982c5549cc819a3

SHA512
cce0705c7e6fbb80015a0ec0f436a04e1f4d341e2ac603d0692df9de5a2844fda6d930e9e095fdb470463b5a2c2e0d047a58873d3442e859388f9c73a7a21618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ef13de7-47de-45ab-b7c1-5e838d04785a.tmp

Filesize
6KB

MD5
29c2fb5c03d87eae10035e31b1c02293

SHA1
1b0993ed95c344698adee6a7613af746c4dadbb8

SHA256
aff7d8f8bcde518f70b819ef369286bbac335a2e14f6ded16c4ac0f99a4089da

SHA512
86262cb517f595178fbd48437321a72c2c766a163e3377715ca6b8c20ce43d38c71f820252e60a48fcbed5fd36cf5bc8f64838cb4792716ccbdbf4404ad78bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e9f4f5d36526bc49ab66f103601e1e1d

SHA1
7b59f6cd1776f8ddd183e8f144b348b2e81fc86f

SHA256
613ba807133b27e270a22f3804e4327e7e1557480b404ce9e107ac31263cc8cd

SHA512
3c196347495280fa70e567772a751fb4e0f11c6a27accdacd57b61fafbd3fc3dfcfc57007c1de5b339a36bd0e3fa5785db43dddadb81085cc79c0d405111b8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
48978c0575462c047f8260990e8d171d

SHA1
9301b5d1f5024825606d2930d51b7006a9b927ed

SHA256
37b94d199c2afc1eb05475a4cceee0c5a3694da56e2993b2875ba4b52d968055

SHA512
66b3299e486bc29b43ecee54144249d01e08f80e439a6a91a349285952653c7d11c2d6daffa0f4d7edb388fa7d5d426e1d32b0b0481e5f4c08b5604158fcbee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
2671b7b7881ca1cea6b45b4dc2c434e8

SHA1
379f54a5ab2074fa6d115a1da570a0c7a8668ac1

SHA256
6ff8d1182f661e03db061240809ccf579846006a75c086284184e497605222f6

SHA512
df03df2daded420d3400dd6b3b63efe40e6b530125f2fdd090e125bc2c047f571e4eb23e7d18062933d782601c8075dc1fdabba48e81910caaed4e2e017c56fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
483B

MD5
b79104c32ea6276651d2233c69288232

SHA1
c923f864c4f416fd7dcc1ab35bde81aba73c8d26

SHA256
df3be044803e440fce68c8d1e5b94e06adcac59a0039537c68b763ba25381b5e

SHA512
a35fb153215ca650940f8d5d04bc63f5a4e50722f4effe3e620d89c45571d8408c6667aa4ca2d9fb83e3e96907904b10afba90b50ebbccd56ffbc6e4df550c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21aaf3ef8a25043853ef6335226a220e

SHA1
56ad4c986ba9e39bed9400d53dc468f118f4d98e

SHA256
e1d90ffac902a8d0850689bbc7c72b059fcb1fc2a0015de0d63dc958ca69b9f5

SHA512
0793bc93b674716fc2e239962888298fb7928115ea949bd1fd5418bc729d59bea20b9a95fad18831ea802889393165d6e82491c2a8ce3bdb3c6c50b6f22cf089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
428802e58a22e7073cb6fc4997a22d21

SHA1
6fc185fdf6bf5260a06f7d89c250d59941a8644e

SHA256
7f9373adc0a23997b5a8d48af44788a3abccefe0c77c3f5a906ce07ad9c286f5

SHA512
d6c50ed990b3d8060ab95e86c7f9655795e08a1b29eaed7e0d925d3f721d54a804d36a102b3e61c0a4937b859f45745200a2164eced6cb28bd82dc6614fe99e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
727c85ee983b088b7eceb3407c3ad185

SHA1
df79c41f9f7af728883f6cf91e3af97b632a6599

SHA256
c1dabacf4e7c01b723c8a8a6b50293ccfbd833d283a056891b9c1faaf3b00713

SHA512
c3aa56b70a4b5e21446f62e75e23da84fd89bde3f79fa0eaa5182ae30d9cd2877b31c9d0729d2ff76f027d0b7eccf7b2cf907f87c1b280eb1f0ea285279e62ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5bacf1c7c973717b588d6aa13b80531

SHA1
2216f9e301145895c7ef29e3c4df711f4fcd219d

SHA256
f690f751d397df4dbc0c6ced0d3fda4b5c5614694f8316ae9637b8f24e8f9865

SHA512
2b7831e09a253d133ca78932a96d2559388ee2c0c5fd6daffb77f48397e0c1c9c4a21141f87f9c6bd39253a59347c2b671fdf43ff457000aa736eecd5c572b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
3af412b52d21d8300e3cc5f21ea0dd73

SHA1
d30541ea656bf90c216da7784011b722887641dc

SHA256
cde4c403cbcbb4103f14e87751e8935c87ba3b42329072c52644d0d323dd76a4

SHA512
744f692e69a278dd0b0ede8dbfbebfec99011d9792079ba38ca711adb99d4d1d2dc1ac317083a5f9f7d37db81c496bc671829c1c9c7bf9f0880dd82deeb5e68c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
d95c04b02a8c693401cab1c538d6c9fa

SHA1
4048eeb1d70dca50c62db544a72f560361141730

SHA256
b316d39f6d5513c6d04a061074907d0b2854632900256e2247dacbd0d0e1d9dc

SHA512
d1b2967157024c49645e6ccc3acda4e255c93404e0900ec42872ee6628b58e9c8e864e9ec8a7937d12303ecdfc325b236fbe910950987f69b06c7cef9dda3c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
79390909aebe38167ef272ee923b2d11

SHA1
3be4ee50d6449d349305f24352437de6f1223b57

SHA256
b0c83c5fe86c0a0dc916ce02c1490a93cf1262684a485ef68a7316b3b83a32a7

SHA512
60bd8bfaa68e91643300e03bf92dca5b30693615f3ac713ea1a2e6ae7b0125adadd9e030d6cd591ce3749853110833776e517f38c8f24f580f5bd6f38abbc305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
b1756ab35623802be187d75284f4be89

SHA1
6d1a8a30d6f1ea1459f7a9066a7bdf2eb4b19557

SHA256
b3a94b2a41bf1058724f4d9e7ff9981aba033d885533bb5bb936461bed33ee22

SHA512
caaad6d6af3a5b5fb4d11adb67a459d7048657263a85f605677746bb247f4064aa4d81e44ce4f2c0921e0c95bfff859298e77171da39134b67e2b277edd6fba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
e75278dbbb98eb5301f715f0a865450a

SHA1
94f62b32d866ee44b24f522a93ceb0a6fa0149b1

SHA256
8dea0ab04095bc0f5a925e441501b8a821e22f07062940a8216d52537fbf0248

SHA512
b61b3e287f34f751cef9e5bf9b48a233c3460021dd273ce8d0d27428ad31b34e007b8cb33e13c3475f66b27d80ea419ff193db96609c855f677ae9ee387486be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab1d9f55526fb5c04750798c733bc75b

SHA1
d4efafd92e5179c879ab4846b2643f2db0ecb6f2

SHA256
fafd7f33f0e3767142a184a9421ebec4179fb611f35558a84e90c8533e75c9bf

SHA512
c29d7c5ce0a3162748ff2726fed90b749c9e8fb5b94cf79f7b78088ef49d6c3923db87ad5f2f2db7431e78f6010379c23032f6e00bce6a3ab096e4e507bc40ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7f921ddef774f8a2a1557f4783c3d24b

SHA1
41075bd22d8e82b8f33343cc9c8c539b9df238a7

SHA256
d9e49a61dd69b58350da8bc3d3963fdc01591e383eacac28e085697f7e2989ca

SHA512
8b5ec81b160cdca64b46308afdae8be1b68bb91aa6aa91aa9471971bd645cdf0370fef8f8883369fa5556905d8c59931f549995f9c353e2b82ca89dc703bf7df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f54caea3257ba980a59cf20c13a1322b

SHA1
59da86748bba2e5c8929377553b2bc57c419cd7a

SHA256
10b1f35fd2f2c0ba74cd3fb589754f7b7ad71cece01b7623cba79996c679bf74

SHA512
e381dcae2c910d28a50848b478e5130175f2308769f93de55daf6faf9842b9c46769ba0c1f2981398de68e28f79f366befd146a554a91b4b88cea083c6f5a48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
4B

MD5
364415d048afad33c3b8141a45ceb8a1

SHA1
1e9777fc3b62b0294a9dcb8b1c77fe26511b0f37

SHA256
f22e224d777a18c7503f5439f1b12a5922b6cd55afcb5191b1a4469370045ff5

SHA512
bff384eecf1052d1f5bfd1d76b663c7e3b4e17305335d66ae4564d145f98db4da40ba897a7d489859608e1c8b185fa92b0c4cccdda1aa7ce505d00e08e575dd2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
13bb903e7a2d41e52b57dbdebd5bd740

SHA1
e518c0e0a92fa9002df3246a5feb727be0a21fb4

SHA256
b8a99a43256f9be72656676047b575fa0435109f3bf1fc5c1dca152cd83acb9c

SHA512
9b627196ee946e53952ec4034fb24299a3fc238de59fed7075e9141e9ebf3e6b616784cbe2f6e48e921ea0336b0298921a2b1dd4e1a728cb07f3c7a0af057c78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
73f7f19d87b8c420fcf443b44e0909a3

SHA1
194677530875b2e6b79df90879ad75bc79791f4f

SHA256
76035a40c16795c3334488ac60fc93e197d5d7b40f057db6de1287ebea388220

SHA512
4f9ddb661b4ce4cea71255acb4396aa909e428320f42fc337f1622321048e18fd8240704459e90426301b4dbf9582ccefd0fa38ecb031670bb2eb6485690934e

Download Submit