fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Resubmissions

23/03/2025, 10:00

250323-l1t8xszqy9 10

23/03/2025, 09:50

250323-ltz6lawwft 10

Analysis

max time kernel
149s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20250314-de
resource tags

arch:x64arch:x86image:win10v2004-20250314-delocale:de-deos:windows10-2004-x64systemwindows
submitted
23/03/2025, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

R.E.P.O/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
73	discord.com
72	discord.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_670662747\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_670662747\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_670662747\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871974004843670"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{D73E126F-15BF-4C7B-B435-8358E3053C84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5060	4828	rundll32.exe	89
PID 4828 wrote to memory of 5060	4828	rundll32.exe	89
PID 5060 wrote to memory of 3188	5060	msedge.exe	91
PID 5060 wrote to memory of 3188	5060	msedge.exe	91
PID 3188 wrote to memory of 5612	3188	msedge.exe	92
PID 3188 wrote to memory of 5612	3188	msedge.exe	92
PID 3188 wrote to memory of 3828	3188	msedge.exe	93
PID 3188 wrote to memory of 3828	3188	msedge.exe	93
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 4908	3188	msedge.exe	94
PID 3188 wrote to memory of 5016	3188	msedge.exe	95
PID 3188 wrote to memory of 5016	3188	msedge.exe	95
PID 3188 wrote to memory of 5016	3188	msedge.exe	95
PID 3188 wrote to memory of 5016	3188	msedge.exe	95
PID 3188 wrote to memory of 5016	3188	msedge.exe	95

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\R.E.P.O\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://online-fix.me/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe5d1ff208,0x7ffe5d1ff214,0x7ffe5d1ff220
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2284,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2508,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5012,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5232,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5896,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=de --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=4840,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5088,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6112,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6612,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6600,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=560,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6960,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6188,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5688,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6440,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6304,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4904,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7132,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6064,i,4822312588695399104,3581941311698654184,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x3b4
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1136309913\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3188_196467697\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3188_670662747\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4a0c6e4ebfdd7e504e01bfde72c03967

SHA1
4060e464bdbf183421216b2413acbea6d3df13fd

SHA256
53f833143773d129f04c252115b4cfc375bb898338f494fc503f1976e0333303

SHA512
cb38f24a6f83c0de5e7f09b31e8b4db53fb2a480510227a9ebd4be6ea3505867877f7b2a7d08b2116fb9d8673e3a4c03a4f77c04610ea78fc80e33c6ca3943b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3

Filesize
255KB

MD5
e80cdded42978faae0ba033638a524ef

SHA1
4bc7ca1769ae8f7d4ae1abbe58776aefb4d0beb1

SHA256
f53ea4b855088dce71229d9760b4c6afef96a764daf95b5e3852cfdcc38e69cb

SHA512
b02648b654c1223ebecba8fbb8509b8e608760f6f8063acc3bc39511e9bf58d20a47d3f81cb627e9cd0d3a86a6ac554a51aff1648723cf20e61775e79982a999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e230a15b37e8d3af0603839a725dfc3d

SHA1
2fcc19342bdb5fd2d15748a740bd2f6de676e32b

SHA256
6a3bef0d7c1de8e961f57401c68649d4ee37ed1985e04407039f527e9eea54d6

SHA512
60beb4b5a70de301cdac654821e10633bc95a2a9dc6099648e05302323147b29a1f7bdce885b03ac7769bab4ff32a06807c6a939097911bda28a11ed6d83ade8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
eb12f3b7b0266f31240221f2ff63c90e

SHA1
5913d841336b64a759ada88d72dc9c38a6749f6c

SHA256
3a0da299c90e410266c83aac82285d0e02ecb022ca4816096b46b6d215e38433

SHA512
37282f7869c2ddc58c726a20345998f6cd882e51cb1573efdb251f7b990732858daaf448c7137c475a0ae6dd835abba46ee5d222f7365c9dcc11e40ab4af90a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586d0d.TMP

Filesize
2KB

MD5
39a3a299ed47fa8b57520d3a7cc552fb

SHA1
7e83912058abcb21b8094c9d822dd41fbfc7b1f6

SHA256
3ea125aa2ae4930e2735cb436885d6db8947770e6fa458cdcb32dbaba662eb78

SHA512
3b267fa0f2fb673d01f91542c7dc28a0c9597fc8e6d19311db8e3fada9d113da9de0ea3d0d76a32ea2bfbd655e5896e889d38bf19ad9b9060cc5bbb81a536e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
108KB

MD5
dce75467df0d1956229077ff11781290

SHA1
88713a6f6bad24702c17c5a326612b536d1bad7c

SHA256
c228c531fd131a1e69706522f0c4117efdd16442666071043bae4fb75b7e72a6

SHA512
da96a8c6350621cc048cb2dee991e4cadf6b84d107630e0958eea7d034fb9c586f466539e6500e75f750a5ab2365a9209747a63172e6128235e3b1e18369c91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
32144987e1ce874c07ad27b203b1cbcb

SHA1
d60fc9240d91cc990873bf7c7b7fb754f9c88f40

SHA256
6f7e936c4a160688d41db5c22cbecadda2a5989b7a017c527f5c6af94f299b77

SHA512
12ee69a7ac4fede7c2b69597c1db4a13132e55641fe6f3214fd03d86150a062199bfb59594529b90043b7670834a54572967cbc4e0fca7f0f2322a4e6c4d211a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ae1f65e97c857eb805b7776ada269b2f

SHA1
7e0e9acf5a87c58feec86634152384fe1bc1504c

SHA256
9fa23e35114e0cfe0f5b0d42fe9ca911a2cb0f7636e4e8683e13007603966b5f

SHA512
a6deae92005feab04dd6ed6d0ef4c97802fbd86a4fdc422e0f15b181eb76df8327d35582ccb37661c671162d7536c5042752d0026c414b40ae3820870ba71615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
63787dbea3c3d513164cb0754110d6b1

SHA1
00e0d0d81890823fcba4bf87a26935d0f4ddfdc4

SHA256
89567dc4d7c653f911eb4c25b36b1d3a4b9d649e4d0794937ab51d19afbdf47b

SHA512
44db45a68fa40f0d5ae92caf09ec72a97c48be65b6b59f9b67cfbff35bf8f733a742a823689304998bf6a4b884b76d91457a7c012c6ea0f96694b1fe0475ae7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
3e7e188219a8d5a92b43323382948fce

SHA1
b7687a020f154090ca24f15bece3ece9bd01b85b

SHA256
eeed54a5d05aa25ba3ca7a88dc8826a8a46230d8f6282cf89f1070e365f8a0a8

SHA512
a87df1c7eb98f23702b9ea7329a678972731823e202aa9728a614cd3ea3dfd7d851ff6531b4386896e8ee08cbc59200d3733ce13eaee2182e9cf730ba78e309d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
ddebee3c0802607e50041e8b332d8ba1

SHA1
89679eca22ee5dc375d2bc63ac10ebce52a50385

SHA256
280edefcab75bf274209886349aac44380b6baf084af3979d1ca31835aa4347d

SHA512
1ad4866061e180bed7d38b75c8a8349b1bd5470328e5a744197876c733479d70f7fa775939fc9d7f165586302e72ad99475155aaa7ede165cf41e1f92031671d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
24KB

MD5
f7dcaeff8539b57e8807a1dba0b42858

SHA1
fc5b9e47e7a8e5880b51c5592df10c3792beb624

SHA256
9114d026efbd4b7f3dc454b31bb1065992e15411e89601128315dec800f75796

SHA512
c894a324568a4dc6ae8bf1adda59b141a22f97241dc3793e56328974878bad33313b28c2a6e15ed5281c81de12a74674a74dd569194e9b3e8b9d309bfd9a267c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
44dea6d1a9f1e036f45445d2b753b6d4

SHA1
654d5e4934b96f30b0d76f27bef42f3997f38e1e

SHA256
51bc8d9014bf6c870851a6a493d69237c5f5496839a7377e1b9fd83a7abf9481

SHA512
5404f6218e08cf98c4ba693c3f151b61e66de812f3c3101f510eb011ea1553d88a209336d322422611452308d56efc1cd2e8ff351f5c43c67457a0595ab1c8a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
f1493efb8dbd29f053b7059cd8d46bdc

SHA1
0f94727992c57a66184b8d0a73b2d0d67a58f66e

SHA256
0c80c2288fee7f3c68adc9d0307ebfb1f18cbc4c9fd76f2597502697280b6bf4

SHA512
7b26f38b360c6c91e751b6c2f84e99851df181df526e01cbca115169765bc678fdb6a57d80e4e06060e7e4ad116dcccacd46bdd791c2f70c7f8e0b5dae12bff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
9c540c08d0f21e336678a7223fdec4b7

SHA1
14a7a391c13832643f4e0105df19497f0d0b9bab

SHA256
05182d4a87c7407e5a8c908489dea723fdb4dfdd8d9a9fcc58b1130694f09801

SHA512
84dae03fb8a19bf36a80417878eb5bb394b3258ef40d5df80951be0128f6834770bdaea9c69438673252db0729a4f4abe819b5c7b60f793eeed97925e332094d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
7b02ad881bf097b07ed3fda2f4cc56b8

SHA1
aa6cd99bf67bfcf10922a7424e9da52f65a49689

SHA256
50b9c32f35c5e275d07fc3c2c28d4ec8f7103f7991b1854e67dad1affc019389

SHA512
bd94996b78ca5b6e406399563437c77cfa37ecee549ad5b22913b349d1004959ae4314fd39f4040d7c2a07197eb49265a1e1585ec95f44a821e7b8ea86da7d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
54f291184c8b2633eeb853f9aa701aef

SHA1
ef56a44c7530dddc3e97863e5c725f3b97318892

SHA256
82c870efdb01823013f6d030e44f07d55109f06d40ddbd0891857981e2d699c6

SHA512
0eb0f341c59cfa7eee31ad70b1c10a0cd046ce619ef8ded7feac14809fe6222bd31fae8532e190ba87131ab4448cd20142479d341166ef83e58fa5372258485c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
453f81a4784c1cfa8db00284dc399ed6

SHA1
3ba5e0ea1a02f1d01d28aa83c19d5f63c54e2d64

SHA256
3aa2b806aa1cca7ada5b99c81fe49294329eccc56fee93d62a9fb051ab758d89

SHA512
a6643a18967e37fb5babdfd1aab308d9035c9cc4ad1fd216a64c0a3c3d601c42e416c5df487913a15765e3f3796811f82140e37ffd95e5d773e7c26c63cdc950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8fc105435804bb6df1b1d834bf8e6d73

SHA1
2d19414c13cec92fc14bc35d4d3a3959c45ddb57

SHA256
4e46b83c59f29a3ff14a1f31ed733e8d34c827e4707c1916b8ccfdcb24db736f

SHA512
2aedacddf4b669ba07d0891e0534719e475163c0e319cee9ac8e9fdeacb56f18dfb1e4c1dc2a9ad302b0b915c7796da5d2b3bf528dbfd2a914e501b86bfe3943

Download Submit