fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Analysis

max time kernel
149s
max time network
168s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
21/03/2025, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
68	discord.com
69	discord.com
88	discord.com
89	discord.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_566222815\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_566222815\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_566222815\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_2038495632\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_2038495632\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_2038495632\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133870382902480279"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{7FFA1741-1504-42AD-B680-D062D2407952}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 5100	4360	rundll32.exe	83
PID 4360 wrote to memory of 5100	4360	rundll32.exe	83
PID 5100 wrote to memory of 6140	5100	msedge.exe	86
PID 5100 wrote to memory of 6140	5100	msedge.exe	86
PID 5100 wrote to memory of 4484	5100	msedge.exe	87
PID 5100 wrote to memory of 4484	5100	msedge.exe	87
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 4856	5100	msedge.exe	88
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89
PID 5100 wrote to memory of 5524	5100	msedge.exe	89

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffa81d7f208,0x7ffa81d7f214,0x7ffa81d7f220
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2096,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4868,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=884,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4888,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2260,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5504,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5708,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5844,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:12
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5172,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5756,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5136,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6560,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7268,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
    3⤵
    PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1100
      4⤵
      PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7328,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7328,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7416,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6860,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3532,i,1472602429269497946,10390572758705008493,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:14
    3⤵
    PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C8
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
458749916cdb5fc7e1e88437d5e4e861

SHA1
ea98d31b218314a162e50f96c127eeb7a8404189

SHA256
43195bbba07a5a5f65f47a2e869237c1d801f8c5c3242db12e6c530021b336cc

SHA512
21f82902d084ce4e76594fcae059928cd30080ef447ac916e30bd479d626f8e4e08c9dfad7f69d8272cb1c36791916b731957d0b298c5e95d3a441f6a7189d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e9924f408e3fe7cec6ef2ada34081fe9

SHA1
347f4cc45db58c42d9bb4e8e6527eb7304bcdd48

SHA256
cca264e61e189cb1580cadf97284750eda6994b5c2ba21ec2f31eee827c6d9fd

SHA512
557e59212c99847a2785f6c27d7aa1e00f1494ca37f2b3b39e03bdab4a8d130ada82e8c39a9ce0b694455b86e4030270603f2bd8bdd4950d257c4c2718b7082d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5928ac.TMP

Filesize
3KB

MD5
ebca0df28d7ea015f78256d56d8481a9

SHA1
41df3c29ed9c4329ce6ad1bc51dd47255d47f26a

SHA256
03e50e0c44965fbccc52ac4fd8c26eabb16309de71ea8164ef332de266e428ee

SHA512
6b008de7232bd41738bb154c3eb3930676b56edd224220b3b178a6588ba5c234f2dc998484fe4554a7cc56475f755a28352910599c95e2699fba9383b626dcb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
63ed08d5653b65d9bc284730e50a28e1

SHA1
b980ffb842bbcc68ed0af9fb0026fa19137bece7

SHA256
215559af4d2afca3ae83a0ef515f61132760e39c387002578665b42d598f5b23

SHA512
aecf7d48dce44ad8372345aa885d6415572586eea16684e084598a36ba2470f70eade964da4c1c42e0ee670c9e10a04660dffdbd525295adf0de81999958871e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
7ca607b8925efbfa1c5fd2e816a2a5a8

SHA1
5a58489579de71e123a2e52078b3e84191aa07ba

SHA256
4bc20f4a38f425f142a406c4451a1559bc8709490b38ee482bd0f75b2b2ed9a6

SHA512
9432a9585fb6ac934addba5a72ba0f050b8ade5bdbb291d331b26d22849e70e070912033faea967c3363048be16acf89f7f400cb8665613fae0b91bd4a07db66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
84f63b3f61efaf5df44186444b4c4e83

SHA1
381a87b6a3e0c88538a20713933a5d570cdc83e0

SHA256
39c378d90c30fb6d7ff9de3bb3eb99650cecd4be78841b00827fcdfde83cc7fd

SHA512
38bd61a691c120acb018a6030b3535c66ca08bac3a7610668af80c281cd2f73720972863dc2c5efd787b803c62b4345bd0cb8dfd79343e14d266ca5dc9d7ff29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
023243e8e3936e63c20227ba4c079e99

SHA1
7bff4bf09a12ff1a93429362d269d29172b40518

SHA256
628701a10fd4d319319d54134058a3da9818e98087f66e2c082376fe74804f19

SHA512
ceb1ba9ac7f571c94c437a739eb78879e935039c0be59e3de3ceab2bbb4b293e206ecd275fd8c28bd8cb767077b792ba41888301837094ded4edb229645f9b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d030767109e4aeaaf2b54a47fcd5907b

SHA1
c2b32f5af173565ae9be001942c9abd593e56ed8

SHA256
a3e8e9c776c6cf0ce40c3eae379e41f144acec8270bc9dcf50c1fd06a118646e

SHA512
81c783dd89eaa99332e022a7a313e95ab32ebfe7ccf61e671ac4cd9b1da8559513acda4106eb6eacd61c11885e9f0dea4f6380f9561f707d719d91d6e0bf175a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
6b83f4254763423d9f4a97b0d1a6d853

SHA1
4d62f1cfddae5f9883fae4ec0f761c6f94ab6252

SHA256
09a3f0cf2733bed24791ef24875a89b2083c7945199a0b618447437237504baf

SHA512
75f68430c3e87bae3986153c0b79951ee677c952e5758cd2c7f506b26d5754335d1ad9f266e5cb2f5c753641f0e7faa1fedb36b111829a6e552bdcd25057d3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
08d671c1644e32aeee78d782b40eee9d

SHA1
6d02de85543723ec72396a0f56216ff671601958

SHA256
2832537e8c216268a4816e8bfb16553cd9eda38696b3e8df407375b26c64e097

SHA512
ce1843bc1e622c4f5e854a5ac62b91353b4395dbdebca7527d91cca0479b9c9f3c03e305d4db12ac108219d7047827c012308affee74934bf13a01e3d903f198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6cd88ab5915be2b8f882e45306092502

SHA1
3d7b2a6061e40ed62ee6c71292888691426ff44e

SHA256
49c4ecbb5f0b6b9ff35599042395ba2174b176f2703638966c48b2f03e0c630d

SHA512
97513407b39955ea3ea94b5b6051e587e0493e9b3852feb68935ff3e58c5087d3ec8756203d8fc5c605c0367fada735f7b2604543db36f2564f41edc6a7b5c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
a583f56c87c01c70c28ba62db2c1fd80

SHA1
9d75fc738d92f637aad41bf3ffd00374c3f9d803

SHA256
99ee48f3b9ec53fa18579daaf5558f2c9363b21a036b35d0f187279b29aba305

SHA512
6ad797601c76af9ca34603544d0d4ff08b70206446fd29b41de74717d06abe30b519506070ff3e1a2e3498dd43938c4f969777b0ff0c10f88978a88657e05033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
2798f217908c81299153901fd96da006

SHA1
ae7f2146e584b17be3e8b1014994d59b981cf10e

SHA256
4d36d89c540bfa88947bf52462bdb0e6ef3d2df022b447e87ad476f449a5368e

SHA512
670f7707f11c73fbb842cf1602cbdecc2364420916bb8cdcde1120d65af9067c73ec9788f5f968cf724453e308190f978ed1372b5e54b0ce6507f4df9b9db924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
e39b1b5424d1c08c50dea14c51914a68

SHA1
e061976df62f26760a4c6eef5cf98c9b2bf664d1

SHA256
d6c8a0681a601315ce7de7830be7e67037928952b5138e6aff7f14b7ebbe5c92

SHA512
138bf28c67d282dd6a608ce31866352fb25bb818f75c639cc1cfc5fb7ddc65c3e992b06512bc838877b42d046b65f71238fffb117ab862bfcc90d200a6d23848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
e8883db1885470a1d876c9408e7651ea

SHA1
5d71a46f0a92b82a63d6fe0e1ca49a856185dbee

SHA256
bb852b17b5d511b6a9ea40a9262033aea62acd7b4bd77bc9f932ed60411d337c

SHA512
792378c04412b9dfd7325a55d790e411a81b92d6bfbd1a773446602ba8cf2c665a6b3a5a9e8abc54fbc054495336a9833d941e4c6f2f29b6e13fa803b30f0397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
3657ef72d125f0bf9b7af77e6a933095

SHA1
972403f877b807142233494abb706019c3557229

SHA256
f10be7053df7ed89c97234b3c371bd67bf9e943eae19a27082d73df37cd48a47

SHA512
344765592754803996f7125fc3f5c0dee9d2b8dc7fd78455cecbf5d26abcf585bcba42a3f305c18643950d287cb8697e9e63d7f92118160afcdf5a64035db687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
346df9b201055f8f5c7e3e82a4deb92e

SHA1
4e64fc0c75827d14042b5b3ba655b63ebd7333aa

SHA256
d7fb18a9ca090d7b65f79127cfe70ae693bbbcc33bcfa5d22d2860baf043c741

SHA512
87b6cb8c2f01b8f7cd9ce18db181bf560e3930a16f0494465e4d4b8c1f1585adc068ea026d2bbbaf8a81c1549a9caaecc5ac52e23cc86ef2e4ff9dc41fec3c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.21.1\typosquatting_list.pb

Filesize
638KB

MD5
a1fbb0296814e30fa4e6710376dc2cd0

SHA1
1720d466dccd6b64bb839580c6c36c08f74b9c2e

SHA256
7c4c71093987705407cdc53acf99584947eeffc828e933a47bfc6b335d646f12

SHA512
d514eadd3711fa5c1e51d3128b5c89de7a0f966d767b689bcf6cb1e4b9ce278d5f3d49cb9f0867d4c022c604bd04fe113be67449123974565d35ff47d1f7dc11

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_2038495632\manifest.json

Filesize
118B

MD5
6e8ea78b63bbcf8e6076d56a4b13a200

SHA1
4ed655b43d639a095f5dc5aa6b4aa2bc0e97f031

SHA256
c6906891b0fc56f40719778327f64e28165fd3f86fa9c199ec2a33bcd647ccf1

SHA512
c015babbeb7f94358e4f48bb2e2157e27f7d6266463cdfc826ffe86f6271fd1198bad91dfd5ce1dde2e0412358136138982c38e2c3161616804963da34ca817d

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_566222815\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_566222815\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit