hxxps://266eb952[.]4461649833210ee7cb6f46d1[.]workers[.]dev/

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://266eb952.4461649833210ee7cb6f46d1.workers.dev/

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
82	796	msedge.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_667945077\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_667945077\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_667945077\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027557611-1484967174-339164627-1000\{AE89CD4E-B788-4454-A24B-1E28C8F2000D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3112	3056	msedge.exe	83
PID 3056 wrote to memory of 3112	3056	msedge.exe	83
PID 3056 wrote to memory of 796	3056	msedge.exe	85
PID 3056 wrote to memory of 796	3056	msedge.exe	85
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5900	3056	msedge.exe	86
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87
PID 3056 wrote to memory of 5308	3056	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://266eb952.4461649833210ee7cb6f46d1.workers.dev/
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ff8afe7f208,0x7ff8afe7f214,0x7ff8afe7f220
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2136,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2608,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3264,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5080,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5200,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5320,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5140,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4360,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5420,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5684,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5176,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5152,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5636,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3408,i,17232988587580457642,4776036609871840171,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
  2⤵
  PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1456648287\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1573627292\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1912270396\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3056_667945077\manifest.json

Filesize
118B

MD5
38a783f9ed173a04e5bef70a52292fc5

SHA1
2329da12d659d33a964ce876541d3ada1929abc1

SHA256
49bd6d2f7f3242bc71f47eacde83a0a1a0e7310074f30810223ea2940238bfcf

SHA512
3ae1c4d0ba65528b9476dfd6035144215227c2718104ece92f9c00bdaa505e2c80d1d30f6e1556f1ea5cbbe6c4f2a2a085ca5b3a2e33cdee74d65e5ef81951f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
991dd8fbe9a0cd6dc3637646bc73b6fe

SHA1
cd33a4c3c2cea06b41e5388826af365691769de4

SHA256
7e873150a039c5eda07ab3768e2b49127c3f824319d28909fe07f31d6f3119a4

SHA512
b8c1dbb54394674bb88fd7cf368214885e0c328e51651ee8f412aa1ab85151582c70189a292e24d551a8144de29f82e8e9b51ca5a695d33dc0e3326a78d05263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7a38c8e8d06702be73a59380f2d1c4ef

SHA1
d7c558ef6138f1c095f529fa112de57e4528933f

SHA256
94cb88445044392206f80f031bbe3bd3a3ef30e8115a82748e4971f8879264fa

SHA512
c1c015ce280b53d42a4cb6a3975b6e739b97098cbfd475e5539b4f594c34abe229c978d2566282b6bbac5c55b3061898369617264f76c058ea519701c5cc9718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e54f.TMP

Filesize
2KB

MD5
98354dfa1e0fa289204157ffda7316b2

SHA1
196852e7f6b698cba7949eb20f20db66f126fb9d

SHA256
29cc0994f2108215b5f4cf82f06b1a666cbcf71f47cada2035a8ef82fbe3c31e

SHA512
be8683e0d1516f3dfc4fd93a3b8246354f58afcfd507089a527262616f9da3998051db06ed169ce8ed7244b9c8204946b26c077c9904cb584c72ab230dc727b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
468a124a58f6352ccbf7fd86fa712d8b

SHA1
b6d5018c50ae3a7cab9fc92fcb82521daeab14b7

SHA256
6fe134257ad4ee416584fe597a86b61034b1f26b6d032149cb05b1a3f7093ab6

SHA512
731ed551ebd367f4a8668ae56f62cac0141e6eb95d71b71c1e70520fee77a80d331a36fda4ac0b59cc0562bd1f9be22d8eed99a1fd29d4c8b4c6479b238bc355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3df901fe47504acc00073e3e171e899c

SHA1
6774049bdf37d895688304265a2a8bd04761dfd8

SHA256
1940947c4bfbebbaab04d61d99dd2d04e3e02e44304b0a3fc8d5812348820cf6

SHA512
88aaa5a0bd2fbbb3068e30a573d84f88d75c0d2b71ca99cb5fbc7847b3090e6e79c61ecfe5050c2896dfb6455c753e47c41b4dace782773e9cfdfe382e5774c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b47d1be25e26f3363708eb9a0be391d9

SHA1
86fd120ed9231085849fe6379a0cd95722d63ecb

SHA256
6de7de619bfba24fce8b76f7cabb899a7d511dd96df1f38dbb5f977a9352290a

SHA512
408b1ae7f2710e47a5fab5bf5563e436d7a1979520f91017341fd28ad2b5ad98f301848aadb17c40a396948c10c014ce7300b43c59f8ad1029e5d3fa2afe565f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
62dce8fbc97f0dc582b233f634d6bfcc

SHA1
e77994ea28dd3ec8509922f57cb95af843c5e77e

SHA256
8ea77319d83ee7da2070e651a43f1d3b542796f33a7578ef93e544e9bd8822bb

SHA512
a559118269ffba5ce2dd34cdddf40f3df0a8c4b5f9e143d0395604d96715b360474e98ee9eebdd81f2050bc40fe246b90280f4f362bc8893f5135448c051c967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
b713b6e431707f9c616aaf18d2d5a1f1

SHA1
d40ed829d0435d03305c52a89043353154bb86ab

SHA256
8f85ba948cab2a42a0f48f2d09a15ac87bd15c8a9d53b0844202c6b865cce578

SHA512
d07134ffffff782f86a4db83bcb7f1999f18461af3a70527fe02c9e6be01348310f73d0d548e8c1e9d7e2381148a09b6d97e03fc937082ccae60e15629d06bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
d4cb8d08992b220056a4165422c8b58f

SHA1
bb3b4558f32e7d66734f69f1a3ecc23471cf70ff

SHA256
08540add2dacdcc76a64f20aa88f27425f7ba7043c222fee73d985b3fbd76211

SHA512
7432c62b7ce71c333225f326dfa43911dd92aa11336abb1e285012f101abc1be46c33a6c7ca91c978961e59d8f332fcd93d0c66f8cf7e7315cd922d55d10d68e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
112feef7400e0b4b9d437dd573267fe2

SHA1
6753137017ee6d9042396a648111636ab7fe5322

SHA256
a4ca13293692e3d256fb77f45eb35aa1e388d6abbcffcda3fe4c6dcc03f9f6a2

SHA512
0d31c965f6a79a84a78a473cd7d37b27bce647d5fa2d03ac6678f55afaf8f8951fe59b3829a04c57afddd089cb7a075979b5ed3946d3ee1275d844eb11720da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
176c74d72c6d49724be7189ab8b12b06

SHA1
923aeb3cf91b7e97ed32d7b5b2ce974dbc962d0d

SHA256
2575c119c29adba77eb8fa46c3a5caa2e66febc8373ff67327cfd48819c116ab

SHA512
137b59c4a07b2944b107a8698e6fd601f06ec72e62685c6332144b8304fc750a548fb77afc927512f2f968e96b29f92bcde16e9237c6e00bd69616ff604ef528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
e6cf3a7a1055459e6a54519d1da53c63

SHA1
1e6ea75983b7b1dbe86fb1eb6c2ec31d118cfa78

SHA256
68d7943fc169b145675fd2a2b1d1d0172b35d83d06a9d81afa7e756ea8201858

SHA512
ba5915389c2e305b71f42ec25a3069cf5ccd9215af63e13e0e062d454bcf4ffd83eca0527978b7b946533c6e60319965a26f2ec065004c4a5d6e556d48384fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
1d8ca875cada8dd890d331050317f5b6

SHA1
43411417b631d250e351c2855640d982172c405a

SHA256
df30044940bfd3c6aba56290a05ae356f2d347621a1be6db2504d314741d9255

SHA512
f898a7e4fd773b2de05515b001aca9d71ccbe5e6515949bd9a6317a92b3405b66539de55b2937be0dc127acfe7c04b39dded56f21b8c7e82582e5c406c51b4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
46KB

MD5
5d6ab521f2c83af8fdedae52f14094c4

SHA1
8a45bf392db0ad74d52b0984c8dbf58becd47292

SHA256
0984f80d52b73a3b36a4122224d9b006d20148610b693b07878980232e6b96d0

SHA512
b2f308d50b2c05a39600cbe0ea0f93c6f694a36c1a8b832f62a086a7c9e4d3df5f32fdf758b5fa9f7ac5f37108fd6916fdeeda06058a9121431e2a04f186be5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.10.1\typosquatting_list.pb

Filesize
626KB

MD5
0104f1d6d013bd1e93f9d9da98366a4d

SHA1
38291eff21f6fb2680eab78418f54beda8e77114

SHA256
0060831feb8e7c25fa67fb62023111ca8c767e4c48ee5ba8d64ff7b9f88dea77

SHA512
35db78d2916a71e73501d7c3d18f3e7d655ca668863b9142ae4e4f99ec2169b2104e41991835ae3557c533d0fbbbe5474847e6027bc41808e18a4dd2cb3682a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
89c814e52384c7398c38de3f15cbfbe9

SHA1
931d3e947204251c91cb9021a9c4611e2987e582

SHA256
b8e18851e32da40c024d65d5ec97b19563b58a5f80844a199e1dd1dbeaf14fa9

SHA512
1c645dba74d0ba1b9f07298b448c66d5511de0c89da24aeb48ff576d9d48fa7f0628007d87b82019dfc4dfa9337d7d7868f6475c8342b90fbc67829c2b0c37cc

Download Submit