hxxp://steamcommunmutty[.]com/gift/activation=Dor5Fhnm11w

Analysis

max time kernel
94s
max time network
97s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-12-2024 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunmutty.com/gift/activation=Dor5Fhnm11w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_343351697\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\nn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1041124692\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4748_1481979770\regex_patterns.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133800781420076411"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1411052346-3904498293-150013998-1000\{700E7237-DC1C-4CC4-AE4E-B7B93F11BD23}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2096	4748	msedge.exe	106
PID 4748 wrote to memory of 2096	4748	msedge.exe	106
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 3496	4748	msedge.exe	107
PID 4748 wrote to memory of 2288	4748	msedge.exe	108
PID 4748 wrote to memory of 2288	4748	msedge.exe	108
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109
PID 4748 wrote to memory of 788	4748	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcommunmutty.com/gift/activation=Dor5Fhnm11w
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=5132,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=4296,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
1⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5616,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
1⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations=is-enterprise-managed=no --field-trial-handle=5656,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=6136,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
1⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=5516,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
1⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.109 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.86 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7fff206e6070,0x7fff206e607c,0x7fff206e6088
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2212,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1896,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2536,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4448,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4448,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4584,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4656,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4732,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4876,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4884,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4768,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3812,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4488,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5124,i,3593974626308718406,9284659183907799059,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.86\elevation_service.exe"
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1162a413-2139-423f-9be8-ca732ce1ffb2.tmp

Filesize
64KB

MD5
f815e857f9dbf5c0fc9dd090e59eb3bc

SHA1
26db24a3afd907757ba47fed4e1348dde42d6665

SHA256
3c0131e9d339c896969cc246f118962c23d25affa407d1ee184953ed60dffc44

SHA512
1947493cc3e51391b4b7b46f76444e4f4a7c9eaa3e63dc6bf05f3d5d5716a2baced98152fb6288ac4226fb0af71f2d55b33a03ca846bb21fe1565dd3c4f0bbdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
436dcf48cdee5ffd971637c78d627b00

SHA1
188db0408300cf36cc9a9497ebdd8ab7adee06cb

SHA256
3a17c8b46bfe38a4af27efd3ae5701e42a55bf1a247aedd48a47bd8af7f109ce

SHA512
332de58da98e577862bf00ff670fb382d76a3b393d108749d58385b5963b4837a968bb1344e6779524292758b10eaa167adc3f4d640a2e3a1b6218f116912157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
b7e653840fd6e5b82bc974554420fd50

SHA1
d574b1db7c657d49485f71848bff6ea994c02d85

SHA256
fefa9bafc5e580f877e463edf149833f398c87e8ccda06876b0c67bed63ef309

SHA512
68a193a9f28d94f3d2c3e452f3235a26fca175276d9544a85f9b6b691404902a8cfca8fa1b3965c7869065c77c7d7173442757c169eacff1eb351edb9597444d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
0eb3a5fb50c24fdfe6e27c81e8bda32a

SHA1
708219e8af830a1886909c3fa19898e68fc8c9d1

SHA256
680d4bca9d4febaab23e36b51cfd2604808e4869d8808e7787660925fb26e50c

SHA512
70d433005419be48d6bfce6d878b8e4f6a516c1cda2ab25a8201af8b4c76197d752a2ffb7ca8b1abd5aaa061d3b670199f24df75aa0defb9e82eb6998cd5e636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
5KB

MD5
593dfd3038eb2e3239b3ca77759cb480

SHA1
0a876d207357e6bf02ca0d812667ecb5ebcf517e

SHA256
df799e5ef5931f2188e695f303c71e33108e88a9b9d377b8e243220bb0943df3

SHA512
6cad29020d919a6c893d0f7bc0e90cf0802ebd20badfd9b6346d7fe436431e6c78a5ce6aef1e1cb1af676018b4d3884d58ca401b580c385370c8c4137059d32b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
58KB

MD5
c9ad50360dc17491079fbf77006540c9

SHA1
2a3a6e68255b7b2a59fd0f33f6ec5cf90f467c22

SHA256
7e2a86e7d56529979cb450158c7dfc6ae31a2e1ea2429e53ae750730b021c548

SHA512
1c0a53b480ef978ba494ff83eaee6e57ef0bf28b73d3e7eedc9579f9f2548584450b71b1de8b64cb85e72d3c03c43c41dfd4828aaa81689606346ed63f080876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
45KB

MD5
e51d5449a8c079fff94192c7ed62ed21

SHA1
78a94f5e764b3470aa0bedb70cea4439cd0db906

SHA256
9605647ef38d3c56f833bde842ce265315b6ee54d7c1cac304dc90c40e4c5d7e

SHA512
98868335f3a9d4d614edff2c80e6cfe31eeec2eee0890b4622bd048c57f44276fb84c4bb5884d429a594066b2de7e2c2a5275492d602dde59538752291c7be25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
44KB

MD5
58ae4ed2b9e9c68d4fb30376d8f856a5

SHA1
45fe2adfdbc85e2b45ae5d0339a8e400e331431d

SHA256
36a9808c916aa50c35d4bad045b27dbe237cbd51dd7d1639c9577deba03988a5

SHA512
0a1376a0ee78e52406343b4b36540c2576389d77fc0681fd989d1e118a48a1a67a5cc5e1b93e8021fd033faaa7fd3a55c8eaa14629c35f98fb713e8c1bc80665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
fdc0e78bc8749ec6db591164ed7afc6b

SHA1
112ec7e9f596935e24881f14fba0b8c392148f37

SHA256
e9116eb642f6075fceb5603691834824c5658dde467f7581c4f630d992d07ce6

SHA512
74b75091e06e77d42bf880b94664c14f52abbf9e44d03e8a42b2c9be965c9cb105ddae4ea0b1236cb15d3bcb321a8fb53ca25cd124889ddfe8ae816b5de8a119

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4748_863823686\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit