64a32ac6adbb8ccada1ca74ed4af18eb3e38620b90d2573b2f8954bbeb6364b3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	discord.com
57	discord.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1036738909\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1036738909\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1036738909\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1359822589\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1359822589\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1359822589\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871390903439832"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{8DFC9BDD-5EF8-4525-8FC4-73F098821168}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2392	2908	rundll32.exe	87
PID 2908 wrote to memory of 2392	2908	rundll32.exe	87
PID 2392 wrote to memory of 3880	2392	msedge.exe	89
PID 2392 wrote to memory of 3880	2392	msedge.exe	89
PID 2392 wrote to memory of 4804	2392	msedge.exe	90
PID 2392 wrote to memory of 4804	2392	msedge.exe	90
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4796	2392	msedge.exe	91
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92
PID 2392 wrote to memory of 4652	2392	msedge.exe	92

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7ffd5f73f208,0x7ffd5f73f214,0x7ffd5f73f220
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4964,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5788,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5588,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5360,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5152,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5068,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5732,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5020,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6844,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6844,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=120,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6880,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6916,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6964,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7000,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6984,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5616,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6172,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6548,i,13862701952846035935,2297824974380168136,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:8
    3⤵
    PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x3f8
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2392_1359822589\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2392_498510165\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2392_661588568\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f419216a2ea078c3b7725bd349645f2b

SHA1
858948525b7db3a6dde7b928382e03e011b2b1cc

SHA256
35dc7c9d37b4e53c4518ab80e4596c0efb0d99eabf03a1d30afe06196fd0cb7f

SHA512
cff74185ae01a8a04feeb60f73c98552387992a4819f847639090e0e4340910c2a9b9cd720d059977a1204a6f67d1560659e865c2deec200787ef05b9e865f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0ebacc26f2284d73db85181ab7d5e7cd

SHA1
96748a2d665b363308b0d5a70c7122c9e37d3c4a

SHA256
db1d93b5f1d87a0c45d7a26d5b717cf0d2d440b98c9fae79302fb151adfd68ea

SHA512
a4d167a1d22211fee2a5aa4be89f095f4bc574dcc3b118d4c3abd84357b21e9f8de319d6191db759e7c4264eacc84b5c7e82b7e4e07fa17793b624dfb4cb48e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e743.TMP

Filesize
3KB

MD5
d17413b38628f2ea917bee5d8f5c34b8

SHA1
db6c1f75c405b33cb8b950c4d196c16f5917e621

SHA256
a9fe4ef95beeb03bf2665037a5b67f4ee246590f06098f50a4514fc303376732

SHA512
3504df4b11b31e5a64fdcde7915ddec32b5155ace33bdadf4ae66b57042107c599ffc321d214b3a32fe375654ff8c3f100cbb821145b34df9729c0e1e8628ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
ff78368f8b679fe52de56fb2fc5d7908

SHA1
9825e8b5d3a5607ea769342596d6c9921921b709

SHA256
7de5f9ce501724010729389ffa748b19c19c373930cd1f6c4fb93e64efba4349

SHA512
7bd0f714da35a703a954f6960fce78a90db2e83e97d26cccb9490aef1f65ba31e26b2ead73f5f2b175074cbd6bf8c1790780feaa45c586e8172558b6e2c2867f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
d5d7c30f4286e3d4572ff1c4acee81ed

SHA1
ddb8ff7275f853dbb2bc1f0669fa984d21ff7690

SHA256
1a9ba0bc23565179b78cb2701c50543e8a625754c24c1b54a5054da2a170a7f5

SHA512
80935bee24b64bf4a8e10c90ad3ed0102f0a97ddb3a1cdd69ba5d153c5ed8a4dc361cba1fb94d1ba67bdf947c0290158f7e02218c4322710a1ab066c7aec68a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
dffd12ed45b92f73f8c5d2e06e418880

SHA1
6fa5bae6700f63362e70b29d0da04a75ef2c7614

SHA256
b6ed9631083c5942a0abcd85813a057d4a4cc0ec6f27bbd45a058c697adac44c

SHA512
020b5b57ff4020aa02c197b3b79888c78c0a9b1c4b1b1c3155a7543a66f18286d2479eab7610780e7d9bbe9da8148d02156156b89de04c79e3ee8bb04a33e77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
4441187ef9f5e4f63eda844fd641abf2

SHA1
941a826a39eaa4ba2a656b3e9b8b41229b2dae69

SHA256
86920b3db7ba668b8a25d38e15c3948d47960bb8130167a032f16f1f46d35da7

SHA512
1f158fda54f78ad439810c09db86a93a3a7683db3ae6b3678413180d3554ca1178ecb6969795e89146fff80a914362bcada6bb97cd30da1715516ebaeb489113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
e4b7529cc42b6f59212f6db579d2b0ee

SHA1
2d34ce5c972a79bc3701b4604f126b9d661bf150

SHA256
d7256546f4f4e330f99198e06d51f75136dcdad25128f7960729e1a219e96032

SHA512
2d99c6886cf4d2800171ae78ac3a5ab82aa80f365a2e5fa5881f4d266b52b3927c4322394243159c5b111bb846c8a647cbaa1c246bf5fcd6d6f7ce294db0b0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
a424ba6253cc77ef07e058f47e04dd84

SHA1
7b93b664a0e325ba0c888ae227cc4933130ded2d

SHA256
6d60006ced789c7b59b6d8e7dc8dbd07a7d50cac7c629351f99f398f7d937d7e

SHA512
22c8a21a55faade1d2d2f9e1e66db1f9a660192f4b7f3a02760227686b8e405bc9957e18abac449bebffaa1d781049d5f76090cfce882d329b1fc8514691130d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\101bf889-f930-4986-ba88-b9b710c4975d.tmp

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3c74de5170513df3f1c228c57bd9a188

SHA1
82af133cbd39b15a91150264cdd6bb7bfa57614a

SHA256
6123b249ff653b48b56cd47bba62892fa0c0f17e336dffec473e5eff93fe4428

SHA512
5456e26a30276d4177854ee18acfbed826f76c70e886a34afcb11b946429e637e029eac259f5bf0b65d6d93462d8f4418323b4b9d104783dd464e42c0e53c2a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
029c289d449156712b0fae1214f07ed7

SHA1
bfda81d077a3de417804ce1c28cd1d28d3160d54

SHA256
787fc8eb00087e948640350ab7d027d41f6b40e0e31f96cbb6e95451b064a548

SHA512
f89a22ba7c5cbe2e17ed3f95d12577c4990064aa3d7f2f3639d2016bfa5af3cd4a3725535c62b9ff4a1eb63dd10efd33d0df7fe5fe8f433ee294668a883bd7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
b96a84f1bc9643c2323aff1c215b3957

SHA1
e3bda54e137c0f764c040d7c8d7fb48ed3991b84

SHA256
fc4d9c0eefee089f98d8a37d4d7c4404a24e5f97b47f456f5a7dc6c371d0190b

SHA512
951e839dcedad101ec693829a5de05685e00dbc580e5c7d933a33225a7bbbfd26430db9ef39aae2f6f043aedea5e0fd9a35b1c477059a10e2afd123ea28629c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e8fd7bd0adc601fde2e261eba0f82e34

SHA1
0f9a04b44ddf6066f6234887c783cb1479847b65

SHA256
7f2ae6b9f9bfa342a99cd7b356d7402aa54b7bf007d90b4e23cdce3b59b82b6b

SHA512
5bfe543483932e1b189760407097ab338d99f605c97ed8b90af3044e4e212b701412ec53c1486beeff74cabfdabcf0ff2661ae157221f39abda8b4ddd046fb29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
2539aff4f1d88d2f6a671e4f46914a84

SHA1
ea9ea424b82c3ee0cf4733416870237a067f764d

SHA256
548fa98db658d1fc066a75b861323a5308bb55d2e92c14918095859aba5399c2

SHA512
671189db32ec4fcc977079865cf2dd0e2fa4f5c324ebdbb97f8ec7a39f96c7d6961aa309bec20502b7e13a84af3d4964517df8b6f70640ab2ff069e3d4b4377f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
dcd90c92578302b69ba282c450dfeb82

SHA1
7c79f95e6dc89c44c72a4030145c02f46458bdde

SHA256
a7f067d760cf242ab8bc40d3555bea79a61d2e5bded0bafef2ac404cd4232246

SHA512
4e03a4f5fb0bf39deaca2681b762a1317046217eb97ad417aa2344376e8fa0574da0e853c113fb4e94c0d5da3a14ab58743e216d0a3dfe2d20d230230254b8a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
419eaa0384afffaa69746cbd1e047aeb

SHA1
19e10ee0ab7a715e46998907f861782606d43123

SHA256
c23669965683876491d8ec40c2eb9070e6f6c7072358ba7f722b917c5e1a26f5

SHA512
a581a3c9b38c4a7c9a8f4e3c94be72b1af21b69035f7d2e8ce0cc99b2afe77237b6093177706f74ff6b422b9072238e3d3e730e48bcfe60bebca87c8b429a57d

Download Submit