hxxps://emporiomega[.]com[.]br/team-work/template[.]html

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://emporiomega.com.br/team-work/template.html

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
124	3012	msedge.exe
213	3012	msedge.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1340597116\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1340597116\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1416648466\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1416648466\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_810035749\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1416648466\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1340597116\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_810035749\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1340597116\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1340597116\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1352_810035749\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873922397390408"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{2E6424DD-B449-47E3-9E0A-FEB371A7143E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	msedge.exe
772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2512	1352	msedge.exe	86
PID 1352 wrote to memory of 2512	1352	msedge.exe	86
PID 1352 wrote to memory of 3012	1352	msedge.exe	87
PID 1352 wrote to memory of 3012	1352	msedge.exe	87
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 964	1352	msedge.exe	88
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89
PID 1352 wrote to memory of 4224	1352	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://emporiomega.com.br/team-work/template.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb2220f208,0x7ffb2220f214,0x7ffb2220f220
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2320,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2568,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2748,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4952,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5980,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4020,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6148,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6288,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6392,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5728,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6920,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2908,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6928,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6660,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6408,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5624,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2740,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6476,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3380,i,1992117560809586865,14293452649394740033,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1416648466\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1352_1788462463\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1352_810035749\manifest.json

Filesize
118B

MD5
3004ab7c9e3747e5109246e7f6b3859b

SHA1
ac4c574c03611b8bc675e878a1be8124bc32fb48

SHA256
1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96

SHA512
f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4ef1b79d567c4b94354c2d465e65436e

SHA1
a8da8288c8300c575100a465db33050013f83081

SHA256
ab43828725fa5af046763f9985d766b882b5bb4971cd00d1ed3d9f879951d755

SHA512
cef4cf6f93847423c44d835ab396b710af06c1b4852787adb444ebc991931e1944bdc5019cc729f5cfe9945440068634f46487d33177114eeb89b134932fc8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ae1e2af8b148c9b3d23d9e51a508de38

SHA1
beb309ca389264e0a4f005e61359ba3884267cb5

SHA256
e89f46a99e2204b004e3e9c54901b42f1eeb9e8780399e48be51cc622a390d6a

SHA512
bb850538e9f61de17fb30337e13436344f5dde831ab5cabee25c8e0eb89d7958060eabd99afc6b986cb8eaa4b124bfcae674ee8b48c72b1a303d606224c7b47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f797489ccb5f5bd3477cd6bb31a5dfc4

SHA1
4f70fb8922fca883f6bcd1f9d363c87c1388172a

SHA256
535dbf00b6769dcac5035965b6f7afa244ab0344292688f25fb457bd3d39d07d

SHA512
c467c497472d9e2841039ddb750cd2feec36e6258b2a46bbe1c96ecfdbd3a4ff364fe18bc87792f1d0291487e250adb8892fbf05c8181751806d4827cc5a8b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ec673b98c8dd1876723e7547dfd6af67

SHA1
12d9f8c6b886497dd519e0976bd8b4296519187b

SHA256
2aec729fb79130efb324ad3703f7c651022ce9f11a44094f8a7684678eede876

SHA512
860030b3dde7ced3d873d2fe01ee8b28d511f13fa1bb952d76a71e27cfc2299927f953cef91c9a5c392fd35b4046c3c7f5d64402dc462628dbf791e682fc6f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
a810a79fe31151c16af0bd160882e4cb

SHA1
4f386eeec72ac02c475024192a608691a1f8a869

SHA256
28a5f5df6639c7b9fba5624d1531ac49768d73c21cab8d40f4b0274b284f063a

SHA512
dfe38311484b5611e51ca98be38fec663c72304f339dfc286414c28f3c37a1bd904537c0e6b26010e57e9d7896b7b8419a1a5de2bcf410c083797ac7d8d27751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d8d72ac43ddd4421a961278fb7585d92

SHA1
5ec46d18681fa1d4a04a7a268a46cd9b9e3fdc94

SHA256
1b511e73b465ec8c8e04db8b5f6b6e53d0a7359b118acb7189bd228c62981013

SHA512
31f8d07ff983528074797118831f4a95178b7a9498a35f2ea00b4bc9267346799dcf3d2b448e8301624cc124b76f207eebfd9fd2d17ddb870e511708eb5b5aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d6ceb7f5d515b5ecd60b1a26be757300

SHA1
dd3f41fe9c0426634ada569819225ce4afa45cdd

SHA256
e366d4847bff91b04f3a863d5143001a7f6d967f6036ccd0932ee3890dcb1a2e

SHA512
10910d84019e797f5a698b46b286605a41d0a0e83c8cb4900f902e5934107cbd2dd543225d6af91f2542f1ef7b60ce36d6f900d87508b468c1bd5e4c477b0a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
f8cd596d83eece5cc6642f4c851a2129

SHA1
80183016913a1482795c4b4baaa5811437903b26

SHA256
b2f0f9b0db150699eed01c50e902d575d8cb0afc2075999092567ae4c618783b

SHA512
c4fc09d453e4cfdd5ccfb7a04d43fd349a3dc73b9ad858018491a4b3b20dcb009b46af6905fcab1d749648fce47588532a82a154b83699628d8bd0099c3878ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
5ad1afc223f584bb7f42050a8ea92bca

SHA1
72dfeb87d46978928d9da31ce5bbf241bf9b2cf1

SHA256
b306d19c2e2635e39250af6f329fdf769402a13e14f3d277f4c289df77ea0338

SHA512
1d3b5170782d5470891fa478e516e60b7f2a1a45b4e131de148331f9b7b876795e90a2f5cba1877934f39f93168ee095b541ec7a4736c13e2b99c5b2bc280d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
3753eb99a46ce396282302af0564538a

SHA1
ee82d7170a68d21127157c49e8622d14a3b087dc

SHA256
96c47328b4b78d0da149e80705f70ba65d5ece969664d90773511602e47bffcd

SHA512
1eccc2a9007b5219639b428bf4abb2d7d0e19d9536c24d47cc9c0b4f370be5fc7ef1624fd067b71bcd3a9ef81f9b06ae7bb2e10e8917a3a514c95a8a44f630ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
54cf796017ddfe8377a6af37c1589d59

SHA1
379cb57d29ac586ece1f7ecf3b4e648c4242ba7e

SHA256
61b1c746d96e5fc85772e01ef889b0d67ce45dcf0487c89d5d827bd00375bfc6

SHA512
4ac54b54faab6d9faf14f15db56d67f20baea7a516cd5cf19d8196aae786eb0bb46d2394b3745a1569b678d62d2bdabb044329f55efb5f83a2930551b86c6336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3e76bd6b5d1ba3bcb93760267aad780c

SHA1
720f13c35aa9e8b819ee081c0b654f1d05cd8ed8

SHA256
8fdc909d2fc4b2c7d15fa2d97c50d035e4917f775fd39ceb97010da35fc26452

SHA512
b74bc2372ada1787bd30a33e1d2097f188eb7095489971ecd585494ee6ed52ce0114fe39bc89f952c783193ed48824d2ad422a4104d7c44a6285d5de841b3e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d09b3b01ccc003fb05f1300c39769de2

SHA1
c3f838b4dc6db5d68261a5da6efeca12f35cb176

SHA256
de92206fad410399fee0506983936dd5a35675b7d877782307b70e737959d8ab

SHA512
3139ae15ab92f661f96ebb301a1090e4e1863876ccc6e2a37c960d0ed496afd1c96d326be0d3fd92c202f34d98d20029e0cc4459c0e8aab19cf9870441be114e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c707f20abbf387ea077d3e5780f2e945

SHA1
62934a956cf981f55f62f69a1eff7b30bc088a60

SHA256
a5206a4e6989787c16e3273a4a3362a2d6c236278afa8d1f83d9b190abce1135

SHA512
89088ddb367e41a239fbcd2e2f9800097b3e3cb6a5e20ea009335b25b996f0fa6f181037b7334e591dd7a236b9905ab175eddf5a16ae1b42dd722dea6a9a5048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
10f3f28936c94d9cc26fa2d5e631dc5f

SHA1
d7283244452fa1b678cd9319459c103e0b7e48fb

SHA256
b073ad2af69200e75b525d397bcb9aa5fe1ab36250687a3d9f1dbcb2a3dbc4ab

SHA512
c32f8d332b3018d84e45999742d7323fe7782f0d3fd3ed3ddeffb886f5eb76812832738a1c5acce967cf5cdd898b2db86f616f29e9f8b4db1002b16220f05893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb

Filesize
628KB

MD5
c26015b2460d1acf6859aad730dc8f4a

SHA1
9c772753b62eaf995e39ea5ce1ef86454b58f169

SHA256
5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7

SHA512
ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
88c50c1b4aca8de5c78d189cfebd0d47

SHA1
a3f21a9c894756b7faff428dc90095d655f16127

SHA256
8a0783b96b1334b1d09a8c3fda8aa4e83948359198d3eed9aa3e571d285e214e

SHA512
6a59a5678da7079b7cc301d64b0deef058d616031016877f1f9e9d136608cb8c364ca1ad21aeade044dd662c75e651dd18e09af13070e6fefab91e016d5ba778

Download Submit