fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Analysis

max time kernel
147s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2025, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
92	discord.com
70	discord.com
71	discord.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_2034035049\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_514803637\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_2034035049\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_2034035049\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_514803637\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_514803637\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{962137B8-CB76-4003-9A2A-628C68AC23F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 208	3564	rundll32.exe	83
PID 3564 wrote to memory of 208	3564	rundll32.exe	83
PID 208 wrote to memory of 3152	208	msedge.exe	85
PID 208 wrote to memory of 3152	208	msedge.exe	85
PID 3152 wrote to memory of 4716	3152	msedge.exe	86
PID 3152 wrote to memory of 4716	3152	msedge.exe	86
PID 3152 wrote to memory of 4612	3152	msedge.exe	87
PID 3152 wrote to memory of 4612	3152	msedge.exe	87
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 4432	3152	msedge.exe	90
PID 3152 wrote to memory of 2424	3152	msedge.exe	88

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://online-fix.me/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffca285f208,0x7ffca285f214,0x7ffca285f220
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1768,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2072,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3324,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3332,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5032,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4832,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6248,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6396,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6156,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5724,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4680,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=560,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6768,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:8
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5836,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,9160465051555837876,17819111537861694370,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
      4⤵
      PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x33c
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3152_1007406158\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3152_2034035049\manifest.json

Filesize
52B

MD5
8c32b9f390fcc4f061885661dbe797bd

SHA1
c681595df03f9f74ec600e70069c879daf2ca923

SHA256
1431c36e66b4fc53ca74e9b10ea0213245631ad7543fef183a8dd2720a5b4ab4

SHA512
e8bbde18d5de7fe2a8162951d3fe75460efbee71afffb4c0c22f2088dee146fb6bfcccae18d4955608e60a7df716eeb47c0687f45344b45130b368eeaf316418

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3152_514803637\manifest.json

Filesize
118B

MD5
69cdba269c964a19494350e90709392e

SHA1
40270de55e4c670a2e4a20f19d1c8d53048d78c5

SHA256
ae1fb39641c69c58230b7fbf2932ede2eec0c25cf61661306892d7bf433ab5f9

SHA512
b82f3b89da8725751bdd56f22e9cfa256e3e0f6633653480492a2e7a75ae52025b1118470ab3f964c317b4463db7cfc8770675c4f83efbb945a50cfef1c2afa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7bad4be2e62dbfd2d370a40befd7692a

SHA1
9349a4f13f1244525be47feea0fdfc31ccdc6b85

SHA256
fbca1caf0f98a9dd19f2b2a3eb3766c6e06b451af99c416aa0aa96ca22a413fa

SHA512
651caae136589a72b6feb6928e004562ccdf2d2a08ae2c97486f61b3ea6c183ba0927cf8905d36587c5dc53423043d94faf96dfaaa0135ebf0c848090a1c604a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d2935da0eee787af4f3ea44b48f2a649

SHA1
cee09d9126933669f349cc335f6567de99f3b804

SHA256
b996abe146094b11c14cffcf49a4737ec7829e508c48057e0be59bfdc80d1d22

SHA512
fac290482efaf4c1ec344cc962e74e0ca429a9a55492b5583690a4f016e4202a65add9be28d896f934db9443e3d97e809ed10e1760325f3bee8c2d83e0073472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5861c2.TMP

Filesize
3KB

MD5
542e667a275650db108db51d1afe377c

SHA1
79fd39bbc3b9f350a29bca8dfb51301af60ef0cc

SHA256
e05c223dbb40a8e99b1fd4c1d9f09be8de8d36af8130251ec2e7c6dd7a5bb21a

SHA512
e5bdba97b4c9603b0d1d40c714d9d933d52d7020504b7a0e0c42901b32188af5d0d693153e9130e006304e835b19d95d2172d0f157b25a4b3d748081abd80ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
6d97162b2e22889c5bb311aec040b944

SHA1
99f1ac84b4606d7b46225d738c65327772227452

SHA256
e90d4c0540600a180a068805790b8492533213c1e7262100fb80922cf8a63ab9

SHA512
c66a7a2e43e7eb8bbe50d9607e24056ba47ce20627f09257fdf8e4665b2cd4a6067386e589ace057ed30c8856b12785a8628ed33889e83cd4b3036e163c17105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
fe775771354298d2ece2a70dd19353d1

SHA1
c6cf8d8a2dd65c751523d101986d5a37496e17e0

SHA256
26aec3c76898de8995afee1d7d75c1f483dffb0d937ca55202e1759223163de5

SHA512
95991e159b0bafcf65d8295bbc1055d04b56367500355d0b1f90b6426f886278ec95b51d2577d81afa53ea9dc32f7e94e6d10482024c30ec12f84614debb374c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
bf0b7e8618d10c5a81e118b777b4c507

SHA1
66bb9ae3bbf6b6c0839a643990743bc5c5b3933d

SHA256
2b895fb725ebd9fcd25014b4b57feaea36db58aa7614ba718431dba6ad3e51ca

SHA512
1f058536cdf9a7620494b537ce40395cd734308fef696e4c24930353a2b4ad1c0e0a27ad00a70660a1dd4224c1bff820e5a776982f987b8ecb5024da65278f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
3c8fd4b7f6ea03a3fc948763c742204c

SHA1
025fb0f13cb727fdad733b3f5e71401993cdd44d

SHA256
3b1270031db6fed5b9e50d5aac694a803c8b7df0e9cc9315176a31f542983186

SHA512
ed5f4367f348f4a21ef42e298d3d1c77c39aaa376de0419abaaab1d7cb35bae56fd916f042f49d576c07ac3d3d4cb177e2d9cad4bd11d443b9f080697a467ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a0d11d9b7a86097c006bdda26dcf81ad

SHA1
ba7e1eead334b896baaefe127c1e8cd190da3e23

SHA256
f36a2b834f6f50da5242e201ccf75a33b9e715c7d118449746890a9d555a61ab

SHA512
16312f853f0e43f037de8b5dbbb683095de7ee601b259067e53facfe8a70d64ebfb045fb7b936d98f9491aaacba07d3d5396ed767cd7f3b92562b9a43b5aab79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6e629d5c6d7076e553081e01907517f0

SHA1
4491d914908dd5a78d98696282814967043c710b

SHA256
6d9cb6ed9912dbe31c4919c2ec1d09b9dc566a2a49d5408b7c5c2d0cbc170bc7

SHA512
69c066ac140ffbd1e9aaf0424603223cb1d17183239967cc0a2cce757f12c2b5d116210b6971e3127bf0253eec78d14df6c4c7e460ff4456cd8d12771220b629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.9\data.txt

Filesize
112KB

MD5
fd8717bad7cd0f60163e7c2b05210aaa

SHA1
1dd620b2a4b49d16a63d3b73495bbb0388cbdbc9

SHA256
d5facea6ed705ea08962d52a30ebf38f6d42aea50a7af21b103d0388b7dae34a

SHA512
7b3d3867977b04efce86c5cce45ae0125d25344fa85347a83977faaa9ecd205774a976be63d6af48b953b4ca355405aa090d6db482073f77d71607c948acb5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
bd47055cc81e2f04bf9606af418097d4

SHA1
6c42ca3cf07a92613e8f24bf5ad83a8bfd863913

SHA256
184b88f604faf7f96fd7b98f50d7b6701b1a5b42787d49c0f88bb234fc27f3b9

SHA512
f5707b5a44b16bc1db8bae18597782c6b23e9eb4540a9dbe658fe54c590a38bf5caae07bf21113b54bd6aec303da87908f161187667d81feea776b3bf6a733bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
db05af976d4f68f30abcab7327096c18

SHA1
0d7d43613a5ecb77b8cbbf10ea435c0aaf937906

SHA256
a2748d60f58e34edee6573f7ac598cf242aff80d625bc1a8dd3201e9fc598d10

SHA512
57adca302c693f87cbbf63266c7087a280c0da504b42b23681e4f19fdd9857bafbe17d083c4cebab7330657b8acb7700559e2257b750170214c569b89f687ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
cbd08538c1a3db2c9a654545f0a942b4

SHA1
f446ee612022404e91916dfd62d467bed0d4da1c

SHA256
63d0f50f03b2531b059ec08040540c8c31e3c8bcc0eea08b134f2f5714f216ba

SHA512
d05445bbbdebe9af4d5d3c2d9fa2b018556b5a6e42c4dd032293a43b3a64b3481d2b1621df81dddc57ecddf7ff516780ef9c48594fbe5b01af584405c468badf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
60b2e1abc6ca8c95f256dae6177b3fc0

SHA1
a0dfe4471c53dedc594deb5fd2a029f6633cb552

SHA256
7d5dcfe982d3c7aaed11172fa3b133dc1bcab8f81d56425a204a58ca611aea18

SHA512
a01eba685cd0d06841ec5d4b060272c7a7600f2374ef09961ec551d488fa7e4bcf9a434110fb83be8e37e2b297381f4f4fd11c76aa942f10150af917de653d4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.14.1\typosquatting_list.pb

Filesize
631KB

MD5
d92af9553af8973d79eb61a32aacca2d

SHA1
b60dd5bc7a4194792a05477b7e661b120a0f9d07

SHA256
8f04e34ef5b125203b8be86dd9dbda42d7396685232bd94c87a250545f0e67e5

SHA512
a7bb5559d56b7c48ccf6b0404d5893da4fc9b74301cec6b0308e513d773e1cfc02ced8dc41d3644a4a04476bdf87ad78ff2bc1abf207f43d2e7141fa66f3c763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c14e812a6ef564aaae4d23b692fb1fa8

SHA1
7d77ed051447d52c7ab7b6fd58681b5e888a74bd

SHA256
8e1b24492a2ef0a62693257ef4e2d09df4d257574821181634825c746b36cc97

SHA512
fd068d2b64b96714b8e0f235fd77ba1999950b86766a40c27c73e53ba66aa994efadcb518997ce27fed3e1dc20a8c44199e528cb6ad17baec2412fa56fb5e193

Download Submit