90cb45275a80d650c985127a657d45dfbbe376904db4d39fd12e4f6fab4c615f

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2025, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www.3dmgame.com.url
Size

122B
MD5

49cbfed4fa9b3fafdc9d499b6163fa62
SHA1

28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb
SHA256

03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11
SHA512

64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
556	msedge.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1581889311\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1086931544\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1916617853\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1681605939\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1681605939\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1681605939\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1416419220\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1086931544\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1916617853\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1681605939\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1416419220\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1581889311\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1086931544\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1916617853\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1681605939\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1416419220\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1581889311\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\crs.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133868293491522679"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920955164-3782810283-1225622749-1000\{D8C5FFAB-7D1D-4A3D-AA89-9A51A725F244}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 556	2508	rundll32.exe	85
PID 2508 wrote to memory of 556	2508	rundll32.exe	85
PID 556 wrote to memory of 4608	556	msedge.exe	88
PID 556 wrote to memory of 4608	556	msedge.exe	88
PID 556 wrote to memory of 4932	556	msedge.exe	91
PID 556 wrote to memory of 4932	556	msedge.exe	91
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5984	556	msedge.exe	92
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93
PID 556 wrote to memory of 5040	556	msedge.exe	93

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.3dmgame.com.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.3dmgame.com/
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7ffd3064f208,0x7ffd3064f214,0x7ffd3064f220
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2156,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4620,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5848,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3780,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4328,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6172,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6228,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4264,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5260,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3784,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5736,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6548,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,13703850958295952386,14657793739682976026,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:8
    3⤵
    PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping556_1416419220\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping556_1416419220\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping556_1581889311\manifest.json

Filesize
118B

MD5
9191c4202582ea72903a86ce4e48a007

SHA1
91377355303e460951f8d4af612f80d86e5071fd

SHA256
945cd01c82a269c67b1bd6b76dda407b9c4289e4dfbb4a5d07e4a6b389430b93

SHA512
c4784538afdc8c3de223d187001c13a7b6c0309feffbcb88ecc689357ea04252e0521a5319f7b28b208df9e6b3880f54ef7b08b0ba33ce458f1277b3afcbff7c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping556_1916617853\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping556_625366956\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
c37f9d2c357647fca20f2eaa89c18edd

SHA1
cfd1035ed2d057c317b48546f467209cbbe15f2e

SHA256
2ea3a0b7e6145fd110653b1a77cb827ad7e4a145c29378344bd3d28f595b2072

SHA512
3563f4aca9e47f35de8cb38e42a3c0448bb3ec4c9183fa392abc28fee4ca08bf16da028ffbf31cf0c0f8301ed810238961e745590e5c71621bc5a2a889dd12f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
291a0ba0af6c25fc777954c72f1e47a1

SHA1
8fded9bed973cc2bade341f391ba203ce68ef17b

SHA256
af0c368f27c13430efca4aa2ad03fd1b7ed17a189b613e26bdb7fad3fdbfc972

SHA512
f9df88f84a1c45237b8021064ffbd39011b72c94e1e8f1c3c3579defbbe26a8f66199214ad1dca7c3af45ca80c4c27d298a9ee6603c47b77a09a5d3333f868c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
c500ed104fa5e9d16164f7b3e9950377

SHA1
8a5ac6ce8bc61b3717e2efd6a653831a01eebf84

SHA256
f9ecd9782d78771acbb6f21418976630b036c40411cc384c78d996c11c763f5c

SHA512
73e5b42343726992d567478c2d44e7affa8d14a46ac507df9219ac174ff089742a807281d33c4449cc0d1d38de87ee368ee10aa211e488609f7c7051f00e4a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
535ac1e0d804af702bc6f30136b0b29c

SHA1
4785d634a1ac1937871ac2e71b99abd273d289af

SHA256
be4c3e827ceb859a77db2fa313af0ed69fa935521a47d4ee6763177ed682b44b

SHA512
3e2cf6733e387699f1fb6e69563aabbc17bf6e81255df959d0b0128fc58aa1f7db0bfa4cbb2cb43e0d724558c28bdfbbc87ad91b2cc34c3e3f7bad68e66ee6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
6c42d320cefbcf4cf87c91921627270a

SHA1
c543ee6e3347407a891a007392cc549e7122dcc9

SHA256
a31db88db52519de43f07dbcae5306b43c49742bfe3cb03ac24bc185200c4843

SHA512
5a69114488f7298256871a95a8de3df2f0f3964acd5894e322ca16f517c2d450b60552bc7c6574bf976f23732084d9e1094ebc288a0330764fe725a2b2ffcd5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
3d7a4ad631caad99023c66a35721b2f9

SHA1
d40826f1d1255fb955ae110d42b34fa2f0b11a50

SHA256
22e4c3c08ee5407126fa781856acbdbe5ac20bff5937d77e296cd131c882dcbe

SHA512
8ba3ea40070d6aebe56e80bf2fc938e1b90c6f5a945f6a19648d6606b581ea5eed5f0d7804577c5d0723d69d7a652cefedc1e77b8d322dd34ff4b3933b006bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
1ec1f5f0fab092f69f1bd6680f2de49f

SHA1
77afb3c7f39b1845c5481626016b9b171881b1a7

SHA256
4f3e798f6fcea8ab319d714b499faeca74b5f199974aceb3ef14317a3d3d2a62

SHA512
6a56bf24d015b3d4914305308947007760c88e3cd09307af2737f9c7d837b1b55a1e2f94203ac5f15968ec9548e394fd65a1d6b564c63af7578cb84ce42eb950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
18KB

MD5
fd9548e62ab13827953e15933fa57d6f

SHA1
bd50f6c4e955d157efa10dc221b0f3393038c141

SHA256
5d1172d20dfd06d6e848d9604bbf69a484beab0dfddafaf9284bb75b84322536

SHA512
f797745a9f6c9c89294d0611bb96967f89d64a3ca4b07cce45a20a134a223b5ce72f9a638a55959c5ecebefc33b8360693f01a77911b135f53a55f4e01aa7ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
10a196e05835fd05b59cfe67b60fe9e8

SHA1
97a89e2ad5124c6d4208ce924fc18f421a1ac8df

SHA256
d1ab7355f9055335a6fc83d45d099005e6ee1ae513e39e57a62c7d1245ee87ec

SHA512
d0da85e6248157eb3043c38d341d228b742c575ca21e9038d4740da41028093fd9160607f6b970e9db856056f3e7790e8117344e1326c274d1fbcde4e7e4beeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f7d7f54a9f4a59459eef0c561487bc79

SHA1
8818abee0a2603670099d505f90b0cce33a8b34f

SHA256
bd3bc55eac01e66ced8f9c4e47081e7710c9dfbfe890b50f3e2e5fbaba082cfa

SHA512
78ccddb56e2b8fc8c161cc93a9356b3ec274e83d020ddaf6fad13fe827cdaa222ffeaf0573f2b0472a387d3b4eb673e4d5ce940c628ad8f7b3c1dae7f9ae5aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
2911dadac7d097c537b6d963d431c17c

SHA1
a5c848a508dc49386152107f7b9165dd32d510ca

SHA256
eb30e1fd7ccac78bcf6dd8b773641815bb180d6158b81b2e7daa025fc3227650

SHA512
1ea8d504a0b8f1085a971a627bebd7d32e5b8fd0e4922ab3479e68706fce73f194cc6027cfe971e345201f23f8463cdecc44f9475a0a999800007a1445ad7efc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
99c9b64caac14141515bcfe288ca9ceb

SHA1
ade52bf723f10d087801f1eb0bc360ebfd2a82bf

SHA256
785d5e37c4883b1e7968967f9c8a023c4b9b8e0f22840b5d926a0a638c75c149

SHA512
d0525a4a021f8cfe60091f0736560a6506f776fbd0c76d459260d6aef766d01e09d0ca5a3e04e2ab6eb430a0441280896e8ba2a5fcc03ccf4f9453a983dc0476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.18.1\typosquatting_list.pb

Filesize
635KB

MD5
9bd22564aa3ca907ecb09074d0f011b8

SHA1
1f15761be36f2fd400e6ce7f9fbc1d613be8b81a

SHA256
a295e802149a6350aea7d9e132e5bf99c36085bb18ed5654b501a9c1d24dc4df

SHA512
47b17689549f292e34957c2a89dd273ace59a69975c0450cc9a88ee3cb5c2fe72543c370d858bb15e14002fc387d3ecdc1fb2eada53497ecd9fec8e0d6b2aa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
5bf1dc6500f487e0c4e4c4f808723df5

SHA1
e58aa97883b958cec2e44c6fe5c4b82df85785ec

SHA256
88546652c80718d0e2d47dadd34ca72dabbb90306da7a9971622b6218d5b4430

SHA512
265a7151709571e87b9628402b00c33bcb7b10f8ac938847309d0a41f2a0773f844a9a57d0c1b96985e059f98c4f9065bf68a51cd9165fd896333a48e027d4c2

Download Submit