hxxps://ability-nosoftware-3662[.]my[.]salesforce-sites[.]com/cj

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ability-nosoftware-3662.my.salesforce-sites.com/cj

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_238951832\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_238951832\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1488395111\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1488395111\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_238951832\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1488395111\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874447903802302"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{CBC177A3-5292-4293-AF1F-31B0D827D431}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1688	5460	msedge.exe	86
PID 5460 wrote to memory of 1688	5460	msedge.exe	86
PID 5460 wrote to memory of 3988	5460	msedge.exe	87
PID 5460 wrote to memory of 3988	5460	msedge.exe	87
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5868	5460	msedge.exe	88
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89
PID 5460 wrote to memory of 5272	5460	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ability-nosoftware-3662.my.salesforce-sites.com/cj
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7fff0d64f208,0x7fff0d64f214,0x7fff0d64f220
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2632,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4812,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3392,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5860,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6196,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5948,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=564,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7024,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6104,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6176,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,7569889592218851308,1730228228403754649,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5460_1488395111\manifest.json

Filesize
118B

MD5
3004ab7c9e3747e5109246e7f6b3859b

SHA1
ac4c574c03611b8bc675e878a1be8124bc32fb48

SHA256
1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96

SHA512
f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_238951832\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_305162154\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5460_33226549\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cc10f75f253bed042aa18c5dd2919858

SHA1
561406699a043eed0d25daa53ec1b35a8dcd4852

SHA256
942f8e61a861c1b2793f4159e062c071ded6314a8a543995c8633b73b9c86aac

SHA512
91f67052d329c69276dd37ad7ae6a917f2aa7abdd6e14f2b24ac11db32e51a3b3797eff2b1d91583ab42c2e6a46ed97b968f6412962f5ba55932fe00f46267c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
308e592e499204b63f0ab4e33199a4a9

SHA1
e6464e12d8c62fb9807c2aea1accc541d7f32b8b

SHA256
66060be409f2a2332132dc3a8a081a960179adf801a4bc1b97737d01c218f2eb

SHA512
cf5add0338f3ae4d11ed1ce020010f0d5eee20edaba63059e0886620b647700c29d15e560c3cbb16687857b58f38e62b6360ed81c546d774a56831a0a8ea2f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57a79a.TMP

Filesize
3KB

MD5
f94fd1ce64374d207a6cf81fc6a940ea

SHA1
6b9235a0d8cf0f982e9d878c6ecc0c3e2c7012c3

SHA256
46b7f2e42cbc52bb1a2d52b6c285f14c32c0aedf3f668a624f47656f97cd2ac3

SHA512
9f93d7f82c885a679eb45ff91d9f98290c855177f4a364d93cc2ae0d396adea8b9c1c4667c2e8ae11177810e9426490267ab0dc0202f714b2139775243f9334a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a70c4cd2d4151c6db3968e0a76fa436c

SHA1
74c23d295e26a7a484e6a731ed4e5c1926f07d6b

SHA256
6d2b20695e8ab3fde5327e7b90664b500903cf0f47618458652c67dcc8f5a660

SHA512
809b90ee691bac997334401a269dd4740a2ed56fc5d281614d9c4ec46d66cc7fa9c8f767a1164fe18048bb9fac9c915bb984aaaf68021af65fe81a7d965e82ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
b2294369ac2a508e2c5d428f5f5053db

SHA1
9b518f1170f592a73ee5f5ce6f6498999b21b41d

SHA256
b4c172cd98fb3b7c576c3fdc878a47b0f9da334c5870ecf2ec1888eb7103dc42

SHA512
0d3e32ce78ddf15754ba55fa588956d6a906798beecbc5f0f7a5651ad11be6a0dfd05946d73d03a0e173506218d4966dd5689e8297b4a51a425c63fa08b86486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
a604ffb3cae8c626f29492058f4fa038

SHA1
535c23047b1d8a8b964723103be84222aa6d921e

SHA256
1c8ea05bef233f2d86a521581795786536470c07d4ebba24fb5564a0934c79df

SHA512
57d850d73910b57e6f3ec0992e70ae06b43d618f2d73fe64e1039c8550417836aa92f5317b5f9af16e7713fb1f9ae098354313ca85391848c2dc3de28b0e515b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
dff34a8d7e26895f3aebce924f630fd6

SHA1
04f90a14fb8a331875eafeac8c74e4ab2d07d59f

SHA256
cdcfc4f5bfc11f775946386299fdc02af41b0114b39f66541956f62aab7e9b28

SHA512
6533e8ab8e8a95ce4d46fa37dafc67e7c0f9704d5fc8125efe4e2585c99dd3e2b9e5982dc8b5f38203b9e80f82d428383a48a119dce256229311c2a77946cd14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
59b95e85bf89e06cf685716c3d90172d

SHA1
e1eecadfa329bd59ee18f71e9fa973c84142f4d3

SHA256
089fa981205ccc845b789be062d0b85cef74eae3c9035b8ea1f05312ca0dd122

SHA512
55949e8be5f709b63cb7c26da71835eafecdf40e529752bfdd3e779b803b9c002239288f43f6c7af83a3c4090d169578d829cc6c90455ce161d116d59e0105f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
cfbc235791b962b9e6ce9d1c6b9e2742

SHA1
9ac357f52f638035efc7ee3ede57ec59e23e6756

SHA256
3e5e66e68f5464d912cff272714dc83e82b600350fe1268dea7c6d318a28bc87

SHA512
24430d77a987d9ec24e6f7434ff2bdd3f4683ad84133b433c8ec98f1ab35d599474de78d3ae183f80590752e275a53939c0fef969dbca2208a3701f69277494e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
802d8d8ca6281258206682699a68f7da

SHA1
fb954c816678d037ecddf9f35064821a69aba663

SHA256
1dfd1892841200a350daf637b93febe72ec674d8f908d7d4a4682a0f55c94e09

SHA512
02adbd57c02fe3f1c859ca2f7e8e2c7cd450fde4a15d197bd0406a4ad2483bcb38fd214d16c91df4679e86720b5561e3e22859187ef55293c1784c91e4717202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
b92be5ae7054ef654fca7bd9578b524c

SHA1
0f2d08867227173fb257caa4139abb0e739de3f7

SHA256
743b74febe1f25decd46574ca5023c2aea7ab955bf59379bb5c4e3d95433cad2

SHA512
cbb13e5c761b2bb8171bcddc40d405c450b4d7d613d8168e74f8888706bffae2067b6e27382a820757a0e4b05d0d409f95b34aa9e67b3b6a382678a50783dabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
936c93af496ee728eb6db1721ccc270b

SHA1
3c3c6c4c18c1952aca8cddfbc5f1eb8d93139754

SHA256
7abf64aca13668f290a646da05ff904f85ca99b36c9a475729478943d155445f

SHA512
8ec565bc30060eab8ec7a907d761d4d0fe578a328feee026ac2b2edc8b3a13f0d589b973657eef3c82b7546bd6a6bc1ac024f7ec5c36255fdaed2ed721f10242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
809d1dfad776195d99f5060fcf4aa4c7

SHA1
aa979fac12dff816a49fb3df69e81f533c3c8359

SHA256
a395a2523836391a281125b24ed010361b451aa99a3a352001598259cc4fe981

SHA512
ccac7b2128c62cf383b00856f9e32b3cbed7f15cf5754f94cb05e0caf4954a0f0c4a542aae9ce66cf58e56f2e5b15dc4707c3f0317c5fb7c3fb897254974c329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
137c8e53c387d033701b244c41ccfcb2

SHA1
01710ebeaba0a5f192bd6eda6373ff85bcfc7e49

SHA256
717eb7759f17260f4b18e1b2a3354cad380b1f7939e110c5e1f9339451842051

SHA512
130d05cac2ec6773ee65732c6582601d566f2473f51fd80aabfdd73cb56a08e177f46f33997eea5d69ccf3e35ef2efc180c87ea29b2de76f09474a09383463b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b68df204f957517fec61c4e7dba0e005

SHA1
ac67606b3b10e5a4c8e5083ac3186e8e79e4bdcc

SHA256
3cf2f04383845cb760f7b20648225bd1e76cc06b37ce12463b4d4fc7ed5a3026

SHA512
ca9e4bd6c14b7ad528c7ff720e684df48542f7c1eed028535fdd8b19e27eef7d5bd1b1accaee8bc138bda5d257fbadf061d5ab0020169f619cc59d59aecc56db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb

Filesize
628KB

MD5
c26015b2460d1acf6859aad730dc8f4a

SHA1
9c772753b62eaf995e39ea5ce1ef86454b58f169

SHA256
5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7

SHA512
ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8044ec9835395d80931e2823e2729dcb

SHA1
b12e4e1de9abac953357dc12058b9da420f2a832

SHA256
e3fe8b2adb84fcc2cc57b72ef31cfad77803ebdd3f34c0cf861b4862620ac2e0

SHA512
aa2727665be4066403dd36d1ccb0c10ff5878da1aa04e864b6ab21928050ba5d74259a2141cffd71c96236c975470c08d223cef1942b7ae888a99ebf2f89eb82

Download Submit