hxxps://comylubmexicana[.]com[.]mx/offer/box[.]html

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://comylubmexicana.com.mx/offer/box.html

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
214	1308	msedge.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1893433709\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1893433709\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1448641879\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1307258838\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1893433709\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1307258838\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1307258838\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1893433709\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1893433709\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1448641879\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1448641879\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873501239972669"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{2EE35D6E-52A0-468B-8DF6-768ED588F4FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1444	4588	msedge.exe	87
PID 4588 wrote to memory of 1444	4588	msedge.exe	87
PID 4588 wrote to memory of 1308	4588	msedge.exe	88
PID 4588 wrote to memory of 1308	4588	msedge.exe	88
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 3272	4588	msedge.exe	89
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90
PID 4588 wrote to memory of 5388	4588	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://comylubmexicana.com.mx/offer/box.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffad68cf208,0x7ffad68cf214,0x7ffad68cf220
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2052,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2424,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4848,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5480,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6040,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6564,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3564,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6680,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6952,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5620,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4908,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4284,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6784,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=748,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3412,i,7276706027373357316,12058420182084940541,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1307258838\manifest.json

Filesize
118B

MD5
791d8ef5b977b40022d73a00d269ae91

SHA1
eee166ddaa96114f05caaee653e81b3fbed325ae

SHA256
0642acd6bbb8906fa49601ab1af556afe9b072cdce3f2fdfdd8393b6749a9079

SHA512
afaeb3f15dfbe6e3374cf61fde33a313f0b94a971fb6a1fc255b92bf921ce55762d180d2ab45fe19c8180105a913c70f6fde6cc9c312f52d6390a45d893df3e1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4588_1356473264\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76a069b6-ab78-45b2-8b8b-5f2f0db45000.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0f14142385091fc1e70e71615157e896

SHA1
fc1fb45963325523e0bad896fa334b2e0b1dd4b3

SHA256
f580eeb82670fec2aab3730b0e99c0dcb0c040383b34ef18e2f8307eb52115a8

SHA512
9d64a5446e8910bba04d281bd517035e27199594123b0df69b0d9016401d0895c244f8c84d6f5e7c7ab43ca7cdf607ac9d60ae8f5082633dc20d440f521c3873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6903ed6b8f833b40cdf32458ef4f6b2e

SHA1
3840c909a8a5886b7108ac1c29797b026981d3e3

SHA256
cb16e2a5f207448a86d808fb8d3ad819b1cb98f8b7f34692f53823319cc885f2

SHA512
2b990a4d8f89ab43b2d81dc6cc39d7795a5a36f5d826b0891509d503a51fcfc98cf880e9f99cc618fe997fe60b98b003aa88bd1bd37d33e1685e944bdd93a29f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
849af212bba75dbe0051e0d30dab1eb9

SHA1
64e86b2f681c5cb547403813a55875ec7e8109c8

SHA256
3995cbc5ad9bd565bd573ceb8d2630111f5e02b4be3658d840f70500144f5ec2

SHA512
3bf09143c3cd8276b2a0eb643fb1d46573504618fd322c4deb3cb91ebb2514f6092d18f38cb5f1aefa6641834a43b943682d91f2a8655e7e942d10fba1714b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b9e28fb80e325bccafdf00388a15e278

SHA1
5613b19cf6b3458055c0f18464f8d81aa2e5e2f4

SHA256
0147f61a97daaffbed3cb7fda152f938d5b27b4397ca4596b4333f624111adc7

SHA512
884fd2811f178e6df244ea022257bd71b3a079faa4d58797d5148c18242f78bdc45e07e6831210b92ad76df1056475b57c4bc84268684900465d10876f4c8044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
093ad0fe6af7b4ca6c8523da3279a2af

SHA1
f6f4b98eeb453217ec5f7668416f3c00d2cf3e52

SHA256
be829038f2bdd5499daf13ec9f9b9eb63f3375b5db6078051f54b98131e5ecb3

SHA512
bde7c2dd7a43771df821697fa44c4e141b298b1a1e95e9c0a8b6227c64042897276382472e6dd49b7ae34b291c25d3c3f02574af331fcc4394c3cc22625bacea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
c01c094b066ddd5fc4f96d65531f4247

SHA1
08c81dc0df3a68b2dccd32104f6c973116842ac8

SHA256
6b9ab6787cf38d5fc8178343b75935a798036ae5c6645ea447fa8503a6f902e5

SHA512
68236995e2367aaefaf1bb05734e51364490a8289b57e701b1874753cffa2d903b52fb138e11c937733b29629e5e599726ddbd63ca8724244821ee83ec97d36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
3e019fd5d047a59eda3b145797dabcbc

SHA1
a6ccfc6fd9af312afa8e88d57223fe78463034e9

SHA256
c382c41bc3899dd9954d2edf51acc1dc1443dba816fe1e2c8d2cc46463356906

SHA512
54f6030ae8a57be62da53baff4a6f360350bcc9dac044933b841923b2ef82bc89b97d2b8cefa05e340bd0140a3ce9b4dc68b321a1e024ad98dd159b60a428166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
3199103ba3e3f1d783419b7117cea082

SHA1
d88a5094370fc2cd2df7ef804d28e0945181eb2d

SHA256
943b81fdabc23a4078d35a9af5e151cc19b267185785b46f84741833fe7b8ada

SHA512
ab751ec294646e248a62843a0b84e16fd543bd1a55f1718ad29f4650e86eab5d61e34edbb44a9c64ccbf5f6275df829f923f98a10b619d489ea290719124b67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
b2bba5db9e616293866321412320d973

SHA1
4eecb80fe47de8b0888c6daa27507fd27c8d4a6b

SHA256
7a9cdc6fc33f3f6c5dff4505b15d1d23a98d3d3bbf3254f9e064ff8f1e32c837

SHA512
1860dae73e95af329a1ff121a46ab633c2c6e529097755d2692617701e9a3ffdc3585ccd3e951711e6eca5be28862351edff7b5c4a6c163632e54b360451e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
5e17ca422f17e97f92f6e10f13dd4142

SHA1
0ae82452c0cd92f309ba82b8035cf37ac724e178

SHA256
798698ef05cd7376f5269117c8b9ea571b9087734f19edcfab937f8896364b54

SHA512
a956a04815fbf676dd664311e1de23bd3b1e8ed9e1ca57f9957c877be09c608bdc3d41f69c99227f7d35c839f24255186ab7e29ff3a98a2df3fb6995f7e781a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
8d96c5879500643c98930e3db588c9c8

SHA1
f2adb23d7b06a2ecb78a4705dca9161013aaff95

SHA256
f73a3f2377bd46ff39787dea737772b128f8800a4f883df675a384c56b03da00

SHA512
a7edd7c16cfc4cce96de27d6afbe521de36177c0b5822ffb59a4c3ef940a19d5429c8a11e338f5c5a5123bd6c24a051519a7678e488129e46108773a3334758a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
30dfc7df7bb2640063df4d63ca012357

SHA1
804b7cb73707f3a632d95717476f2d78041fa324

SHA256
d9328f551d58d28620b4aad6cc5c5ec8e2b03a5acc8e4eb369304aadc220b6f2

SHA512
a847bea9a0caf2f0d0caf84e6521f2f3579d77739af0f0aa9410841b35e5ba213b3a7fdf438174e23e1a3d039619cc6af28033cc98d50cfa5edc989eccc66f81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
46297f83011f3b3c6fb258219ac583be

SHA1
ef9ef9648c797bec687824222283db498498e389

SHA256
9ea9e0bd66128dfe738c32defadc2f489c0ab1517211706015d72e25d73bfb34

SHA512
9c536bd507501de4ef899e3b8a69f80ee00d49e94676407e43b1a47bbd59d252040c9107471ccd86fa04a4b5e6f656cb5eaf8b24f2b5027105970e20b4ee8efa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
c37beae4cca667546d1273cdf439c255

SHA1
86b06acd538ec0bb0cf255a97f82c0af9ab082ec

SHA256
91ce39e00cdbb6daf4d9386b88893e5a933bace52cac2b8ee4069b3e7bf1329a

SHA512
50e97ef097a4b1e37260a6c330fd8e7d43300d181a4fe7448c45ef1ac01accbfd833b350960e1cc525b7063bad58cc0ed5f844dc8043cc3e95618c1b548b62c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f2b96dead7f8417820852b9d7f8b5cae

SHA1
a401f9f067a8e9e075f9da042c8784c08232e827

SHA256
c86444255ff15f89d9660440ceeade5e9ecf8f301c1f0a6e9bdd115051aee707

SHA512
ed6a9af5c240d0aada815d5152fedc9487c5238b1a49ca8fb27c45a465370d57a86042f5fa4549486e9159891504d8fbdee86e21f5ea9bfd4d104e6524f60f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
d6fc03b176dfb368c415f1168b5ac096

SHA1
ad7976f26853ef5647689a6b785f55c45653229e

SHA256
8172dfb70141de58fa91c467d0a689c412b8f2c00c03e2a29e45862bec87ffcc

SHA512
9e2cca63ba81b2572bd078419f46daffc90098e37eac1cef909fe6abb4ad96dcb33f01ef36cecbf1bdc6e28fda1427ace325c7157c5cbe32fae2c1c0944cd8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.24.1\typosquatting_list.pb

Filesize
638KB

MD5
c58dc6e76e524d25a1a8cf23ba450518

SHA1
26179cb88c8f3c2db96aed106844c817d8b08d29

SHA256
695140b50858ab3ff19e2519e0aff4b6a358d16e4cc110d5ca1bb6283b37be4c

SHA512
4d74793a2b91a5c307e6f23521622611dae00dbc8717ff0e7b93451ebe40313ace05cca8e85fc3b2e23094b07219040cbf6ddd88918bae7895ef0352db1af71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
fb279808c0f3c156b7cb5791927944a5

SHA1
cb83e622e6313c8745ace2e5d3f8861d8debe02c

SHA256
392a7d33e3217e48cea0bf8cabf9a0d43fdd05f957d61a501e9f6bebdb91a471

SHA512
c001d3779d25041f1abe66709f36eff86e40bd69b61088503b99c52cca3ded0f69a4dba88f80b833290388e3c61703662f529a4e32f823e2d7fbc9dc50781c6f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit