hxxp://uclouvain[.]be[.]uo00[.]shop

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://uclouvain.be.uo00.shop
Sample260806-ffbcestbng

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304653152210388"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{224BAB00-9BCD-4D63-9BCF-B80F6E78B564}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2160	1696	msedge.exe	87
PID 1696 wrote to memory of 4892	1696	msedge.exe	88
PID 1696 wrote to memory of 4416	1696	msedge.exe	89
PID 1696 wrote to memory of 2032	1696	msedge.exe	90
PID 1696 wrote to memory of 4416	1696	msedge.exe	89
PID 1696 wrote to memory of 4416	1696	msedge.exe	89
PID 1696 wrote to memory of 2032	1696	msedge.exe	90
PID 1696 wrote to memory of 1840	1696	msedge.exe	91
PID 1696 wrote to memory of 1820	1696	msedge.exe	92
PID 1696 wrote to memory of 1840	1696	msedge.exe	91
PID 1696 wrote to memory of 1840	1696	msedge.exe	91
PID 1696 wrote to memory of 1820	1696	msedge.exe	92
PID 1696 wrote to memory of 1820	1696	msedge.exe	92
PID 1696 wrote to memory of 3656	1696	msedge.exe	93
PID 1696 wrote to memory of 3656	1696	msedge.exe	93
PID 1696 wrote to memory of 3656	1696	msedge.exe	93
PID 1696 wrote to memory of 4312	1696	msedge.exe	94
PID 1696 wrote to memory of 4312	1696	msedge.exe	94
PID 1696 wrote to memory of 4312	1696	msedge.exe	94
PID 1696 wrote to memory of 4740	1696	msedge.exe	99
PID 1696 wrote to memory of 2112	1696	msedge.exe	100
PID 1696 wrote to memory of 4740	1696	msedge.exe	99
PID 1696 wrote to memory of 2112	1696	msedge.exe	100
PID 1696 wrote to memory of 2176	1696	msedge.exe	102
PID 1696 wrote to memory of 2128	1696	msedge.exe	103
PID 1696 wrote to memory of 2128	1696	msedge.exe	103
PID 1696 wrote to memory of 2128	1696	msedge.exe	103
PID 1696 wrote to memory of 632	1696	msedge.exe	104
PID 1696 wrote to memory of 632	1696	msedge.exe	104
PID 1696 wrote to memory of 632	1696	msedge.exe	104
PID 1696 wrote to memory of 1828	1696	msedge.exe	108
PID 1696 wrote to memory of 3828	1696	msedge.exe	109
PID 1696 wrote to memory of 1728	1696	msedge.exe	110
PID 1696 wrote to memory of 2176	1696	msedge.exe	115
PID 1696 wrote to memory of 2176	1696	msedge.exe	115
PID 1696 wrote to memory of 2176	1696	msedge.exe	115
PID 1696 wrote to memory of 4616	1696	msedge.exe	119
PID 1696 wrote to memory of 4616	1696	msedge.exe	119
PID 1696 wrote to memory of 1692	1696	msedge.exe	121
PID 1696 wrote to memory of 1692	1696	msedge.exe	121
PID 1696 wrote to memory of 1692	1696	msedge.exe	121
PID 1696 wrote to memory of 4660	1696	msedge.exe	123
PID 1696 wrote to memory of 4660	1696	msedge.exe	123
PID 1696 wrote to memory of 4660	1696	msedge.exe	123
PID 1696 wrote to memory of 4112	1696	msedge.exe	124
PID 1696 wrote to memory of 4024	1696	msedge.exe	125
PID 1696 wrote to memory of 4024	1696	msedge.exe	125
PID 1696 wrote to memory of 4024	1696	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://uclouvain.be.uo00.shop
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff9d66c188,0x7fff9d66c194,0x7fff9d66c1a0
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,14639543026097265717,6711664474126745141,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5539851789346116499,1508626789391051947,262144 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,15642575612806801433,18126284383598502946,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18279333259024112737,11079447952699368486,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11576071158206905454,9457232543276595967,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,3822124722270913569,6165856723036315662,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5447616926741086755,1011285777167979523,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12648038371376358182,10310645251862343124,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,10596593815138646997,3323304885832023901,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14341918605086648337,15783174409457753745,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14341918605086648337,15783174409457753745,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4468,i,5563557905492364455,2484288783915253228,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3472,i,4568572166481026391,9523452265191305295,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,5118412233855101080,2737758852334073636,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,11175419735508903750,1055004504416159785,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,11901872814928739834,15738195249405603187,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4220,i,15659650783338886723,6250432014697389960,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,2012673503364403475,3503817546231975736,524288 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5204,i,9400319134239452161,3765280200753802223,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4208,i,1330659109831896848,5596425739868375520,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6368,i,11114632681962304310,4707376511149593505,262144 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5908,i,14183837204035206007,7426270567724567500,2097152 --field-trial-handle=2260,i,3895924757375542449,14118232147778577034,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0a3089001cdb48dc706885b3d71f030a31761b55d51cb0019852428f242e4849
MD5 f15e95424949fe707c76613cba0c9720
SHA1 d81c3a726975adef9f875e6ca51bd59070d32b5e
SHA512 473967fa11b79b7db462dbd0d0317c2e131ffe996911658fd4810e381efd8e556960252f9f2585b1b15f473df32e6b408c3c185b862a087d321a5fe223ab8764
TLSH
T11B61C537054A0C24E7600D3195EDD224B976A6EFFD0FAE842190D8711603FB2B5D5D79
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 def0b9110013c1ffa010c360230acfbc83e8ce5abd1db5ae1d98c22a1c59dcec
MD5 9e3a5700326e3d0edd197815a60bcaad
SHA1 2aa9556cf0bbd3c6dd2488009027103477a62309
SHA512 dc39a68f49feb32aa731941d617fd583422f6337c5bec8f6a39001994cd9e81da16a40e7011508f24d3447e22bbbe8f63766a6b6c88f7296cfcb78594733fdae
TLSH
T135115BF3C3D585AE8D0156F05A24AE1BCE2D061642187C15C5D4FF67D3E3075E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad995fcd373358b264bc998242baa4b10ee781ab54e2a04ae558123eba82ec7c
MD5 169642401091020d148afe663f0b701e
SHA1 52d536f39b4769d849a0df3c8903669207907500
SHA512 b6fa50f3f6a24ca9cfb9729767a68007f37cec463f1db7a00969a967038b9eeca639677fcb45fdf9339639d165b5b12e32c6e8b3180ecd35f9ab19648213b69d
SSDEEP 192:sxZXRPyM/jK1Ml8UQmk+/fRsTeyVEIdpAvZHxL6+WNGYvcwLS+Ig5TJ:sxZXvqN+/fRsTeg2HCGsXf
TLSH
T1D752E712AA346977CCCBD219FA41BF53D6F9157292900E44A9FCDA1C00F6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6c8d27828f7827164490e220c45c1ffd9cb62f875fee69e3ec6d3be0706c0701
MD5 845ac9b28df790f30764ca4e112bc9dd
SHA1 f4e89c39e5980f7d3ce177d8216b2da690d39369
SHA512 05c4b960a3d443095b9647453b263d535ddf17dc6fce281127a1bdf329503449d1f79a258f9ca3dba929daa73e731d2a06fcb46c5a339bdacab5182ca4e691b2
SSDEEP 768:XjseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppsroecK:XjseJ3xWvhfynu1jaVcL88p3HK
TLSH
T100D20B2B280CCB7E4F844E6DEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 dd46a4932dd9d5d234f86d5a22b270a12bf705ea6d94edfaecaf382c7e5e8034
MD5 12779e88c869421419068c19f6449083
SHA1 76b742fe05c9a57d229f9476814b63dc53f8479b
SHA512 33b424683d51c46cd51865941b99605bab9d78d094174ee2093aaac62a28783cd56b379496e3fadd210b9f7be30654ee2bcc0bcafe16ecf716797ce04ab448c6
SSDEEP 48:KYHIhKggkXy93I5KIYcPyBGInKr6YzyVyHoMy4YxlsVsIiExKX4PSxTqhwtEY:KYH+KggmG3GKIY+iGEKr6+2fuKoAr
TLSH
T106C1240A317B061339BE2889B39595364F4232B73058A8BFBFB900965D6BE111DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1c1fd40-4613-41e9-be60-5f194376bb18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1c1fd40-4613-41e9-be60-5f194376bb18.tmp
Size 12KB
SHA256 774c8002de9f2e5b6e7ececcf5abcd8f32db746f1224944cc0f3435e91d1e05e
MD5 d677a200852dc7d18150250f8410dd34
SHA1 b7fa21c9005de0226bfd6aa88f9ede6b45636145
SHA512 906b2dd833f702d8b6c220cfe92c4d38b22e42c7f1cdfeec2b1958252d814ed20fd240aa80a944f96aed343bd1e345708bb2e44449644a7a09d23c7cdeece4e4
SSDEEP 192:sxZXRPyM/jK1Ml8Mk+/fRsTHnVEIdpJHx/6+WNGYvxhGS+Ig5pJ:sxZXvM+/fRsTHDJHOGtXJ
TLSH
T17342E8126A346977CCCBD20DFA51BF53D6F91572A2900E48A9FCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b4863b7-444e-4ef5-b567-9f42cd1124d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8b4863b7-444e-4ef5-b567-9f42cd1124d2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 02f9df38d6daeddfb24583c804baa1ae92ba81ed2d58f4f52faf6cc8b416f09c
MD5 68cdf97d8e00616d252440966980244c
SHA1 13bde6c1476f11177191000ba89c8d35243cea4b
SHA512 f55f8643bd522d2e0431d8fffaa1e43874c02124fe53a48090ed35b413de70366a4528b39f1c13d6e6301838d6c060737bd2d359fd8407eb01e9a936b51ac186
SSDEEP 192:u/m+xasuheOwQxMGsNKBQaC30M7hAGQmiU1h+wn4MTCz+FdLlf7i8z1tqycTYy:RZcIhsNKB1G7ii2w4ed1jcB
TLSH
T164627C325C786D7BA9B7B141F48A37135EF4902BD2C85BA0E5EDBF2D00E66A81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c845ec3a43cb10d99c8318e413bbe1fad47daa93ab8b3dc23c9c387fc10aba40
MD5 664d63dda91285a070b9f14ebbdecf72
SHA1 afec7c1afa13e76cc49611e2c0ccc2ccaa35e1ba
SHA512 0ef9aebba7964d4aafc4f8efbbc7d0797277e7d40ad39b92d74f297f88a342783c41036f9ec7fea3d701fb114f1a1ff8dc4bfb6df6cc194d50348ffb633fafd9
SSDEEP 192:uqm+xasuheOwQxMGsNKvQaC30M7hAGQmiU1h+wn4MTCz+FdLlf7i8z1tqycTYy:8ZcIhsNKv1G7ii2w4ed1jcB
TLSH
T1A5627C325C786D3BA9B7B145F48637135EF4902BD2C85BA0E5EDBF1E00E66A81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ff2253b8ee9b4228bc7b17e1798121633a34246439534f163f2be5d5f15926f
MD5 6cc969fa4251514e2292dd3c6087173c
SHA1 c243e8d66a7df3612d8624dcc2aa4c9e2b0fe7e7
SHA512 279f3a161e5ca8cabbc373857c72cfc10a2f58c6b5a0124a5989276837f64fa79f676a998cbf1827d2eb94995a1baed68c07a7485a9ac62286ee77af2551af42
SSDEEP 384:diFiZcIPzsNS8TUNTUlIlv1G7ii2w4edjjcB:UFQrvwgeowlBjcB
TLSH
T1D0824C334C649D7BEDB7AA45F94A32138EF4816BC6C4AA60E6DDAF1D00A61AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90c7d8743c6babe70969739b7e68b908dc149de43df33a530f9382726531da92
MD5 e777afdeedf53fefd3279865aa655762
SHA1 b299fc6870274e01c50c456f2054e516c06a9006
SHA512 3da49bfe5b12646825b7ba381f493ae8a91acb1017c3bd3ce1f2d8d92b44a5b36a00cf5fbc5f79331171fa2bd117dd8567522f8c7ab3b7521a4af50cfb2f7b39
SSDEEP 192:lONZ6vMtPQmiUyVNThTCz+FdLv847XfU/u:lONZ6UtRYTNdTvU/u
TLSH
T18202F835AC786C6BEAA7AD46F48A27175FE4216FE9D45B50EAE82F1C00D764C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8636448ef5662e2d17b6c73b31ca8774e929b4fbdcdf99da0126a5e7b5c9d348
MD5 ab94b177151b4b78f76b6fe14b54b49c
SHA1 82a650db100364d4d260d63c40a5980307db0481
SHA512 88bc362ba19d6708c0332742214a00f93449faf7a5c191d74f301903d9fdb604eac1f0ba5397f1188ee2e7f1122a2a30cad99c5e80d153bc50d3b79853fb23a0
SSDEEP 192:bONL6vMyPQmiUymNjhTCz+FdLlf7u80ItqyU/u:bONL6UyR1jNdVjU/u
TLSH
T147121C32AC69AC6BAD937541F48632175EB4916BDAC46B60F6DC3F1C01EB65C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6c9d392f1790d7140c4128824816ee0839c08637d6b551c38dd1cfc55f8a64f4
MD5 bf87098974c62e083e766a13f0c67332
SHA1 3ec2ee3c01bed0cce2d6624781d93dcd1444d29c
SHA512 54a8b08a13b58bc8a1e6f897efa0e62ce1c6bcc853a5e6dfbb12174c98b6759b416009a065006affff873d6502860e416e5b278384807f58893b5a930209b131
TLSH
T13F41F858B7FA1158B3B76E5AAFF6A86E487B7C372E06C59D00110D4E0673A40D872737
MD5 SHA1 SHA512 TLSH

Submit Download