hxxps://fun-nosoftware-1429[.]my[.]salesforce-sites[.]com/dax

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://fun-nosoftware-1429.my.salesforce-sites.com/dax

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1133432855\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1133432855\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_681299636\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1415170168\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1133432855\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_681299636\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_681299636\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1415170168\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1133432855\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1133432855\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1415170168\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874444930495587"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{04826745-7BC4-4C3A-A0CD-9196471D8353}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 1628	5876	msedge.exe	86
PID 5876 wrote to memory of 1628	5876	msedge.exe	86
PID 5876 wrote to memory of 2220	5876	msedge.exe	87
PID 5876 wrote to memory of 2220	5876	msedge.exe	87
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 4432	5876	msedge.exe	88
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89
PID 5876 wrote to memory of 680	5876	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://fun-nosoftware-1429.my.salesforce-sites.com/dax
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbe166f208,0x7ffbe166f214,0x7ffbe166f220
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2576,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3392,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4736,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3496,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3588,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5856,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5856,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5340,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6236,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6400,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6108,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4996,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6392,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5216,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2820,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6712,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6064,i,4892806611922443438,10645004155860489353,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1415170168\manifest.json

Filesize
118B

MD5
3004ab7c9e3747e5109246e7f6b3859b

SHA1
ac4c574c03611b8bc675e878a1be8124bc32fb48

SHA256
1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96

SHA512
f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5876_1957400916\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5876_681299636\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
fa936ff7675d9ddef5bf618b21960282

SHA1
bd3b4e189ae6f7c57eb521de7787bcdda8922a45

SHA256
988aafa7c9c5162394cc890394cf7022d5afa7d8b3aaa2da4cb5070d14f1f275

SHA512
2a4da54d34d687fbdaf66734c845855998739db401a37c85203ffbebea1cb9f370421bccb33d45b3698183eb4d61e4eea68173e62764eaef14955c2e748f5c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58312d.TMP

Filesize
3KB

MD5
8e5ab806e91df1b1b9891bebcf2a65c1

SHA1
a19e9fa69ae27264c80f88d3a7c2b71c9ce95741

SHA256
221196695629cc914d5f9bec9d71ac37ca477d3fe93d15c87a24fa3853058048

SHA512
ec486629f6a9906db69050bc5e7a9db619d998ff857bc19468e4eca63bcd4bd38e496750fa6e128b13f0e3c250bc17482c18054c16f25b95efb294b0ca6de776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
75646cdd8cfd3a6dfe4447a82698e9ee

SHA1
b3b1da5d4cd1ec4f6bc17b084313231ad9c0ab07

SHA256
d06a3ea569d8adf434b416ac04b1d3b8de81aa916fbea5143a663fc3934e5f94

SHA512
4e78840ee8330429858c854e488779a9303c3ebe86fc1c730d99fa65116e92a58e13a31f9ae61d80735357a7d81a268a6f545b82b40f12014efee244582bc5fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
7092cb960f200c71062657d96428735b

SHA1
1169524f457b5d8b36fd92d80d4af9986dbed4ff

SHA256
bef6462ce8d3be1fd88dc01ee3c854a051471f70c41dcf9cd54e43df43c8fe8f

SHA512
946025d0854242515dff50dfb194b8425483db2b3510bb612c307694874e69acd0998304a6378c4364f7c37f30f6401081b5aaada8b2e27aac95ab0760e352a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b4dddb155f36422e0c18a0ac9d360c9c

SHA1
42069432de3b5d034264accc700a2f7a52c26eb6

SHA256
a29a089ef4993f35e79de7ec640ab7253d611ad8205849da071579a3afedf557

SHA512
4b615ef1060b090fd65dc6f78fafffc1c53f077529abb549d098f0be183ffb3908d5672e3dfc78078359fc0b6f4d1e9caf8b2f14ed65d4474bfcb5c2ec20ed1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
ed148c883803049c10b7d588f2907412

SHA1
8269bd196fc51a9835d4be629bdfe92d18b544eb

SHA256
579cf65b280b2fc1204ff21aacf40d42b896c0823ced15b81bf87bec6da98ad7

SHA512
eb5ed916acf3796bf3e0a71e8b3206ca2ccb6040bf339581a549899b9f8b229b5aeb0ba60e1ab1cd457c1ab267c6832c54cf337359b3a564a022bea267beb4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
0f2351370475e5e3d319cdb8ac567c23

SHA1
add941f0fca046dbb60680823c8a8f3ca62b0064

SHA256
509a1a13f2620607535472636883b7ba40d042c8ac34d322f995f94e9d090cd4

SHA512
c104fb32c34e6ad1bbba03be13879fe73182747092487ca7d7bcbf8e0d0660f9de82efb450285a2aeb5dc9b65e7678b783d0503c7e088d7f6432d11872dfd400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
856b30dcbbde3b6e88f50357414a18cc

SHA1
621ac148559d601068db369e7f17d60a9d545ff7

SHA256
888ac0b0b556b6d4cb537df441f4592eda256edbb161f5860a31d880a761df4e

SHA512
9d08b78037d1cd72aafc7658ced11f10b967d93a147d457971da4c1b6222d57e002586dbed654cea3e96c856f16067084b8e769e6b50ee9647ef4b90f22b7f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
d0f6c9127d68a59164a13408ed1d535e

SHA1
bf98dfa6ee361347ceab15990fcf28e4cd5bb041

SHA256
b10182bfb0e47d902d26dab6ca8288c5c0ab16b4b8aa7588543c65d4c758b838

SHA512
d659e91741e1b29ec3b5c7a0b9cc9d8e06f86110a0cebf79020a260f50d9ec9bd4b22185e7f1bcd15d9c03ae4485a4b2ec6dedb47e66daa4fd2d0b2b6cc690d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
df6ae02453ffaaca21614ec003b25119

SHA1
9855a136f4417dc4e905cac26673290b91b2780e

SHA256
1144763e592b1475476135369cac671163ae42a66841c3e5c2e96dad63b5d573

SHA512
ce018234a59273560a4edf30436f0831922c673dcd3139106013337e703ee60412589ccaa7cb85235f9988537d3d4af60a200829b31985e609d80616656d2cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
e0cf563ae2b86282313eb8125dee3afb

SHA1
cb61d933a2bc9c5d67a67e745e2370a6f984a197

SHA256
2fbba26332b4520c2388a3e8104bae1443bd589efa1a40afed83f51de8a47c57

SHA512
ee752ecbfdfaf7f61a4b5ac4ed8201c45e240fae32f3cd3f5b27d0e9b9695d67fb5b51edc5ee428223f0fd2933514401b0ad99b75c4684e043a29220aa45878a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
88d54b141a6d20c42f0669849497a462

SHA1
87174edbaf13c13f662d5a18690056bc8205a43c

SHA256
d87942ec010066ccf2d55031aa6160383b66a679af174f4dc83d4a5ebfd79993

SHA512
b3cdd8e64b3231cbc495a4cad79cb2959a7d1f3b42053004f7aa2b3f91fd37c08823143a1ddf6e5a5fd38aaf2c27bf06bd73fb6afb541725e7631dee5e18f52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
ee94c8da40a6290652131e7ca868508c

SHA1
05a165d696cca225a1fe86a8fb7ccdc7e8a1dc85

SHA256
6da945c2cc881078737920ab1d3ed275ae0b612d4d2c35de4d042bb4a194b2be

SHA512
e40b328b6e4355bd22fa814054f6944218e1768228417c15071a33f466ace683ca31b654ae93dfe2e063aa2b50fbc4210d54077e106dc12dfd621050781d244d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
7b57aec08bcbb0a9690a5c272011c865

SHA1
f7ed1a2fdc5ab81b254e070f7d5d7c32b2b1d00a

SHA256
5ff67e84c9a3dc629afedf94089e179c80817a668318fd1d0747b1360559e860

SHA512
533e256c76d3932b8b86444744755cd48ba40783e4482766bbb683579f0eb01cdcf014e3c9759d2e977280d4d6400ff25a23f0b6ad78c7a3eb98661c16370124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb

Filesize
628KB

MD5
c26015b2460d1acf6859aad730dc8f4a

SHA1
9c772753b62eaf995e39ea5ce1ef86454b58f169

SHA256
5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7

SHA512
ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8a5966bb14644ae1f9a8192295ffeea8

SHA1
9449f9a64455b2e35bf67a33eba9cb0b4318fab7

SHA256
6d4047543c26e865637c0c9e8a6f06c544b24b8e8d18c0ef18ed0d27d0b46ac1

SHA512
18ab7f1653a4fd540abe59ab9f6226d7396cf0ffad5b58d0359e18261ec0c964a2af7bc2ee64b5c1914c9d6dcd71fbb98fd4a79a69fdf17fc09d646e9c91be26

Download Submit