e36962c7613c7cec9e09e4e20d044d59f48fd5b7f969bdc0251703f2dd0998bd

Analysis

max time kernel
145s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2025, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
74	discord.com
75	discord.com
89	discord.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1033510667\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_464459914\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_464459914\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_605337764\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_605337764\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1033510667\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1033510667\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1033510667\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_464459914\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_605337764\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3944_1033510667\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869570909058107"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{A3741825-F046-4537-9D0E-B3DCF003AAB2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3944	1236	rundll32.exe	85
PID 1236 wrote to memory of 3944	1236	rundll32.exe	85
PID 3944 wrote to memory of 5768	3944	msedge.exe	87
PID 3944 wrote to memory of 5768	3944	msedge.exe	87
PID 3944 wrote to memory of 4844	3944	msedge.exe	88
PID 3944 wrote to memory of 4844	3944	msedge.exe	88
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4848	3944	msedge.exe	89
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90
PID 3944 wrote to memory of 4856	3944	msedge.exe	90

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffe8328f208,0x7ffe8328f214,0x7ffe8328f220
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2876,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2172,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4792,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4944,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5860,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5716,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5984,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5224,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5144,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5076,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6148,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6540,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6792,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6792,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6976,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=120,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7104,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6896,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2572,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7044,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,14294484300491916740,2339960610091020076,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x3a0
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3944_605337764\manifest.fingerprint

Filesize
66B

MD5
58b1f2bb9cbdd687225daefa2539f180

SHA1
ea7b7e392e50dfeedd5e638b558c85a1aa6f0a63

SHA256
92eef18ef821f9ec4ebc57e0de333cf0b5a76c74b6bc931f1a1e4dc46f4f7351

SHA512
b652d8d9b06a534288762eae872dd84bb81cf1b992152ce4cbef7b0fee6abaeab57863a65ba77f7846146d47c88ecf1b58d6b6944d779d903d30084e77b88bc1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3944_605337764\manifest.json

Filesize
118B

MD5
395a738237cb5606743da99d5459bd59

SHA1
53a2e376dbba8020189b4d629d1ce452c43abc42

SHA256
6a15b2c0969575a4ae419e8b0eedc7c5515c8ae3dd73771e431e484689684aac

SHA512
0ac1112218d23328eb3cccf777c9bf7b0c31b71387fc620d0f91fec73994661021524ae66d8b81f26d1d7f4df8ac60c12f7852c72c65030d0c106a0ba773a8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65654b7b-fe68-4d0b-b8f5-8871d489581e.tmp

Filesize
17KB

MD5
4baf57e73ee63116e673e4628ddc08f0

SHA1
5126ae16880879aca085341047e7944ac4fe282a

SHA256
dd4e75931cc48abb558d5319ae17f12eaf9c3994a7a53c8aef27c49f6403801c

SHA512
221ff1ae20c373aab3901ea6e2c66dc312187cfd940eaeb78db132325f195bf865160689b8c9b9593e2b3c962b1fab1df87ddd7ed5eacbf8406d8987d95e52a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3d94129e508e229fca0260577d7f5162

SHA1
9103f941d6880665aaa8f07e6e240db629a5b50e

SHA256
eb145a723e6b331c004ec99049830e5f6c054d87223224d57a03031fcffd6d05

SHA512
cd1f1284dc0fe9e6b6d74bfa228a24d9e3d5c265328e0dcaeacc7bf7bbb8533a359d2ba48386a7b7d4f8afab262e81da3bc12d08e3ffa4dd3236edc0532ed33e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ff357a2477590e2b9e04d3b95f69fab7

SHA1
5c74784cc44ce7714b3f8d162d46b94bd160fa82

SHA256
0475786d3dd6a1673266fe4ad4325b5ec5c1d8ba5f166573f25319c0f2356084

SHA512
55d9f508aac46142dde01804f4d83ad31d3ba31dcc63cfcb079b3bab63921cb4f1f43c1b8f2005d276e5bbf068846af543ca08d90de99b0195490f59b2c1eed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58118f.TMP

Filesize
3KB

MD5
7b7d4ecc1f0ed007bfdce1d9f81b8b92

SHA1
13275bfb34636aee9e620f2e8ebde3a892b7ea43

SHA256
4a4404d2891e0f4c85515f0b6349c91b239416ca63d2c275a593cbea8b8a382d

SHA512
a47896c3b9f9566aff731274279ef96626ea50a06e579b5534f0e02fb9ff58a769df29404f7d2a6e44ab9eb0029b22c2b39c9698d55edaaeb3d29210d34f7203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
01f0e8c26ef5a91271a4b462fc93bf8f

SHA1
d0ff1121cde36d152b119cb7f4c86ff9d3504c07

SHA256
c389f8c2c70693dc7b5446707dba2f7b5a715124c237d06ce42d57f121a7876e

SHA512
a62ec8863f123f148eb9d390ad852f21e1e8b8a3f558c37c0b5f5a1848c9ed446f080bd385dc9df39e9a2c7c36d88810757bb8765bee97e9bc8b20277d3799d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
604070de327132af971ac262484ee6c6

SHA1
da574cd71449395dbdd18cce06771b26414ce164

SHA256
e5649009b7bbffef577d742a6346e881db3c6e44fbe7f47c0518d83b1674d33a

SHA512
3323ccc411cdafbf59b7917db5ca748ebef05d0f7f7088dbe012201c2e0650fbd92b7a0186274add05ef685a2fd5b8872fe33d192b22e30fe9b6c88bdcc23ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
0ca20f6e6c87ecdaa59a5a66a209f365

SHA1
cb20307418bbfc3cba92726c8527d59de7e5b74c

SHA256
eea3fe404cb442338210c178ef58e6b16d290344ccad97d3c77c3950fd375f9b

SHA512
62b918edf2a2a4f0aeeb2542347456b7bd722b2a6f03355ee46c31d5154799cbac096e79f815f4683b102e0d377e2c5bcc43f49e5fa3119047de043dbdae54bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
3888916133a63ddb21b6c1f609b91a15

SHA1
c5db4be19e74f24578f9fcd646796c8d507a06a6

SHA256
21fa83243c3ec21f591b3d9364120e8007dfe7319ec8275b00c84e934791dc7a

SHA512
105fdb557dce77d278c8eeb3af526ee1345629ac3372f0bede2a5324244d906f77acb34e7f9dc88a26dcec4dbd40ee90fa7ad0a57c221c25a5581cc9ba90fe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b0a13908038f02ed5628afc85f185565

SHA1
8e5402e607e53ceeeaba895a0da718462c0168ef

SHA256
93416df91ee052b83765c7396ee6ac90698328f7ed11b62a8b9e66017a18c277

SHA512
22fe46f7dd1a5263ab74f8dbfe67df3ceb80094932c2a708192c1df59bd6b6acfa58d84471e006a2e08eb43e22d8f46072ce079076602becdede219b22a98c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
d5e7a1f15fce1ee5cf90d761c709ee9c

SHA1
d91bfa4839dc69c644694e79331567206496ea4f

SHA256
619d26b9f16a2986aad2c804406a6899afcc7431f28dec3c8f2e2eecff2cfae1

SHA512
3315d474155005dc0f3a000bfe0760d4025bebc3c5e8ea639c1d11fb54c5f971357b8d04b59b6342525f23bef4d364e0c75a001b7b702d6baf7a791d50dc8a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
9ed1dadeed2b2084c95a2c08ffe967f7

SHA1
cd416be0671362fbf2a872c0f925df84963a3703

SHA256
893b96cefc32ff5d28a39228616da6d2509d0c9b5394233dd2e70528c241a6fe

SHA512
e59d003f4714b4c0e27446e31d19284277f1625101329442756040cf81542fd7f55c8e1eeb0c9a8698600bbce0be13b6598652443136315aa781ad37c13f1784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
083b79abd8e7ba2014e505dfcc2f2716

SHA1
2c5a617bdd7bdb6c8a49bb4296da1479c5077dab

SHA256
bbdec4c0da0c59e3db071afa5821e3f7064f188f04d4fbac334e165d0e46099a

SHA512
1ca989405d55439a907889f2f0fd481af99df35aca447b0e2b25616ae004efce8471c7ed04745bcd95f74a52fdade4da4c869bc829e5390775d6ec08ddcf4c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e250edb4b63d53ace1449689e7c72911

SHA1
325f8c0610f7e4fd532d35f870cca1f2ecb27f38

SHA256
09b185ccd0876b8c68fa3725febbac7bb102bf509b6718f9c045b46f68f3d512

SHA512
7c0178a067956156618da294d0eb008d3612766b71d1a28b717f4d4564809768d19bc256194cb071cd50926e3893d6622afcd1d9d87be3f83eec5ef3ddd23ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
fbfbef79bf6507ef787fad038e6972ad

SHA1
e05eaf0bfee215d62528dc81d4dc4f1e24d3b17c

SHA256
d2decada04e918842193554be8d100be7bb2692391bf3e6446f5316e44a636b0

SHA512
47a412f452cf7efcdf6cace0e1c69f3805bd3f811557e1b00951644a194db6f89c16cda900bb78ea44a9790c1f37de3794c57901c05d7351d53b9a66235de07b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
780912b19ec2fdb14e38c8c026b3f35e

SHA1
cc5b9e5416a9d07d616f176d57df2b4562067bfd

SHA256
e92afd9747529ff8dcc534d108ea45fa17d6cf6b0594cdf46588da1fefd6f593

SHA512
aab20297c3219be34ef47138f74a86d92a6c843ba177431c4eebb4ef858e632c9e22be77c119536ea00958069fca904c05ba76cf0f22c6d83453fc403d3b5f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.20.1\typosquatting_list.pb

Filesize
638KB

MD5
da8609745ded15c07f9b3b42a794f1bf

SHA1
6f51794da7f06ce1e79ea3e42a22f67d068525bc

SHA256
7dd01720dc53471b5cfb185a9b1e39be94a095c53e5dc8a295818e425ca265c6

SHA512
a04bd2845bd6df19cd59eb6d62be863ceffca5841f8c878c289364418a89e4b0f1efa4224f3fb0d10a010ce73a23a60e81e6d7437ec27da3541f085e22ac938b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c0e41f989cf018be780a3b2761f7c48d

SHA1
86316c25f1034a88cafe73b0c4affe105b2d6b48

SHA256
e8cd909a3c5c0e5f9464366da6b065ca4bc0da57216875f608c4049b78b96408

SHA512
72a5efc2eae10fc3ad6b7fcde0ae6b661cdda0258fd48360ae98b7a111c26fd88e2f3b002fc76f35d95511664a75037fc7b3fad7e42d13670c16d61cfcba960f

Download Submit