hxxps://urbc-uae[.]com/sale

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://urbc-uae.com/sale
Sample260905-ee9cdsszdv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330539533494976"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{CF0E3852-B971-4BC0-93E3-90F0093C4379}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4188	2380	msedge.exe	80
PID 2380 wrote to memory of 4240	2380	msedge.exe	82
PID 2380 wrote to memory of 4192	2380	msedge.exe	81
PID 2380 wrote to memory of 4240	2380	msedge.exe	82
PID 2380 wrote to memory of 4240	2380	msedge.exe	82
PID 2380 wrote to memory of 4592	2380	msedge.exe	83
PID 2380 wrote to memory of 4592	2380	msedge.exe	83
PID 2380 wrote to memory of 412	2380	msedge.exe	85
PID 2380 wrote to memory of 412	2380	msedge.exe	85
PID 2380 wrote to memory of 412	2380	msedge.exe	85
PID 2380 wrote to memory of 3512	2380	msedge.exe	86
PID 2380 wrote to memory of 3512	2380	msedge.exe	86
PID 2380 wrote to memory of 3512	2380	msedge.exe	86
PID 2380 wrote to memory of 2400	2380	msedge.exe	88
PID 2380 wrote to memory of 4748	2380	msedge.exe	89
PID 2380 wrote to memory of 2400	2380	msedge.exe	88
PID 2380 wrote to memory of 2400	2380	msedge.exe	88
PID 2380 wrote to memory of 3408	2380	msedge.exe	90
PID 2380 wrote to memory of 4748	2380	msedge.exe	89
PID 2380 wrote to memory of 4748	2380	msedge.exe	89
PID 2380 wrote to memory of 3452	2380	msedge.exe	91
PID 2380 wrote to memory of 3408	2380	msedge.exe	90
PID 2380 wrote to memory of 3408	2380	msedge.exe	90
PID 2380 wrote to memory of 3452	2380	msedge.exe	91
PID 2380 wrote to memory of 3452	2380	msedge.exe	91
PID 2380 wrote to memory of 2036	2380	msedge.exe	93
PID 2380 wrote to memory of 892	2380	msedge.exe	94
PID 2380 wrote to memory of 2036	2380	msedge.exe	93
PID 2380 wrote to memory of 892	2380	msedge.exe	94
PID 2380 wrote to memory of 1124	2380	msedge.exe	96
PID 2380 wrote to memory of 1180	2380	msedge.exe	97
PID 1124 wrote to memory of 5040	1124	msedge.exe	98
PID 2380 wrote to memory of 1284	2380	msedge.exe	99
PID 2380 wrote to memory of 1284	2380	msedge.exe	99
PID 2380 wrote to memory of 1284	2380	msedge.exe	99
PID 2380 wrote to memory of 1448	2380	msedge.exe	100
PID 2380 wrote to memory of 1448	2380	msedge.exe	100
PID 2380 wrote to memory of 1448	2380	msedge.exe	100
PID 2380 wrote to memory of 4444	2380	msedge.exe	101
PID 2380 wrote to memory of 4444	2380	msedge.exe	101
PID 2380 wrote to memory of 4444	2380	msedge.exe	101
PID 2380 wrote to memory of 3172	2380	msedge.exe	102
PID 2380 wrote to memory of 3928	2380	msedge.exe	103
PID 2380 wrote to memory of 2044	2380	msedge.exe	104
PID 2380 wrote to memory of 3364	2380	msedge.exe	105
PID 2380 wrote to memory of 3364	2380	msedge.exe	105
PID 2380 wrote to memory of 3364	2380	msedge.exe	105
PID 2380 wrote to memory of 960	2380	msedge.exe	106
PID 2380 wrote to memory of 960	2380	msedge.exe	106
PID 2380 wrote to memory of 3448	2380	msedge.exe	108
PID 2380 wrote to memory of 3448	2380	msedge.exe	108
PID 2380 wrote to memory of 4856	2380	msedge.exe	109
PID 2380 wrote to memory of 4856	2380	msedge.exe	109
PID 2380 wrote to memory of 4856	2380	msedge.exe	109
PID 2380 wrote to memory of 2192	2380	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://urbc-uae.com/sale
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fffd71ec188,0x7fffd71ec194,0x7fffd71ec1a0
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13542075833722438369,15002372874493252161,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,18219889463023417458,6609929203037371002,262144 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,17099907728615868814,13208473256859903279,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16855312923686355016,11439435948769900342,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15427103839739020178,1901141618311896261,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,5698578406163089724,8022689749520019566,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,10933837657191648742,13719623916779617258,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4284,i,4871458007018569520,16346014664034444585,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,7684107703833431097,1449655084881095853,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5340560012615759201,16831288641840351230,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,18008845682858500320,15612862857633151092,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,17822451687274896395,17209917688577817329,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,13340659386636781228,12551912479446620414,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,17822451687274896395,17209917688577817329,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6284,i,18275730670120450216,15767462130659239990,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5292,i,9131682944501107703,12681705377678303478,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6504,i,5535403788629925886,10572550515439588287,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,92102869227313970,8935407639184529658,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6382209917326236508,17798035522619430120,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,9095660147906667166,9139495698586219299,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2612,i,10086481122373192968,4289043898022840439,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,16759843355759102337,9844410447254208629,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,5960967270534591244,7445612918951894279,524288 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5388,i,3735227326113424255,12204491191003134658,2097152 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5504,i,9118106283315745174,17470786641312188154,262144 --field-trial-handle=2228,i,14887172193976576532,12740313286958578752,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1b87229f99cc53c652c227dd7b0e674fd1a7f3d2071ecbd7e96d14caf01789e
MD5 12fe7e86ea55bcbc14173d158228b533
SHA1 4d08fab080251fc755b72705a654e4971294953c
SHA512 5f7f520a3c5a907c7487d7831cea4efeb50450367f23409af02c5269a3fd34cd57d86191174e7c2c1b103980b98f431afe701795717921d9887b0f9bcbc45b3e
TLSH
T199D02B7111090041C40D0032107386054303FF010A0578433C6134252D10C09834E094
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ee93a6f7d4cf311fd0e1f40c0afccee1cee462a0ad5d189e6fd12793542e567
MD5 042b5a81b8f9e5f2e5e1b1ef0b9c97b8
SHA1 8164701b94e0509e7ce25bbd729d9a2a541bc216
SHA512 44a62942afbd847ef5fefcdb060d3b4faa54b5f6b612a09366f3622f4beebbd50e527a67ef727bae51d47d0f4a8145e79b81cac52fb6d9ae39e362c50f423a09
TLSH
T14FD02B7111090041C80D0032107386054303FF010A05B8433C6134251D10C49834E094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b96c2268fa7595b0ab33fa37b1040c262929d8ddc5a459b407631316ff2df85
MD5 4a7e2031365805288b6689947253d0b3
SHA1 3841f3106f65e47067e8e74ad6e3e7e786374fbf
SHA512 ff7f083d06cac9feedc1b6380d2292b1013bb259f17392d7b5acae4b53e60474b131c9914b47febaa7a4191f111e6ffcf2080c000be7b522d86016f94ade8d27
TLSH
T19C612757061B058BDBE142316CFF6644F9B1D59A39E78D5242B0BEF6391EA21CCB1108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586b86.TMP
Size 3KB
SHA256 cdac56564d525502d3d89d9e4db26db29c3f35a3a19ce7bb69339c8a50532508
MD5 d220970804f8cf8f5b4aec0ac02ff282
SHA1 a84e90e3e510dad4e95a064d7409132f91e4d90e
SHA512 d7635b9b892cf56d438821471ac99f70a00d97b7cc5745c3c593f75d7dc4f25bf828ba98c6bebcdccab6bf9b07d3fb962fa3af8d60900aeeb6a51e1ff18e33e8
TLSH
T14A614953060B158BDBF142306CFF6604F9B1C58A39E78D5242F0BEF6391EA21CCB1108
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bd4b76fb6518a845a29ceb1490146db63d24f32f8781c27a4c859a12a548c31b
MD5 562b92cdd67c7ca8df56989aa87afe81
SHA1 9002417175df5db58ec6689166900499da0d6a06
SHA512 93021f8d37d87c15e5d57478ae5143be7754c50d5363c30356cc85caaed1046f400599cef06b94e4d8502480d68847e1b080b498562f329f7d40824de40ffe2a
TLSH
T10B21ACF3C3E1956E8E1156F06A18AE2FCE1D0515431C7C6A89E4EF2793E3071E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5a98960716a4e34a67b917439eafcfb85941a299867d0e1e9bb611f63feee39e
MD5 f89557093d300c5275a7ee2444c5104d
SHA1 4871cc680989f85e8bd291f1626697547fdaedc9
SHA512 da0d78ec50c5fff1a1079e33927e7b8ebc0067eee95df73f08779e1d91834f3bf35ea36a51ce3a6abdcbcf513bc37fcb84f06e8f4cd426a7fc834bd950c53466
SSDEEP 192:sxZLR1yM/jK1Ml8UQOiFx/f5sjjEDucOIdpYbx/W6+WNPs7/Y01nWsChIg5FJ:sxZLdqzx/f5sjmHfM/bs/5AB
TLSH
T16652F852AA345977CCDBD219F941BF93D6F8447292900E48AAFCCA1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6dbbf95ba4e968a9e5b973bf729031d13c5e5ed95dd26eb8afdc27ed06f0a7b7
MD5 9f4f7b8bcac90f41e3c13cc3563cbe6f
SHA1 92771a12df71b2214fce21ff87bd0cfd3e3e0271
SHA512 1d9dd9d464330f0840290da3f5677ba502b2b3ce527ca6057d03f714fd9055e74832bdd953222ace9109f1faaa8ff40a4b3fa5a9737bfb61c8bd22ff99a12569
SSDEEP 192:sxZLR1yM/jK1Ml8MFx/f5s+EDuSOIdp2bx/W6+WNPs7/Y01n57ChIgrJ:sxZLddx/f5sRFfG/bs/5K9
TLSH
T1B652E852AA346977CCDBD219FA41BF53D6F54472D2900E48AAFC8A1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 df78cc8b254719153ba45221f04b1f8b30b437491b521e2138ada2507343f094
MD5 1c030b0520df36fb7b0c8902de48b46c
SHA1 26a31b0c395f5d49c06fdc69409928c6a98cd3db
SHA512 601f297c1d44947b459b66cdefada076f48b16ee8663752109d1792dcbe8d32d7fc22da6848f499c7aa5bf818daaa0ffc9b1409b0bb03c8d590f4fe91ea88cdf
SSDEEP 768:yT4bSV4b+8b4bm254bRWRmG4b/Qn4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4F:y0u+68si2y1WRmlzQ4ju1jaKDILpZ8U8
TLSH
T1E4E23A3B280CCB7E4F844E6CEC26AF966ED801DB66684D4447FE494C03C77EB512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 42889e9b739a8854c45a0750ae308d5309ad11a43b98d33c142a1723d79c2c54
MD5 345e86f43175ef28678e6851cd75ee4b
SHA1 332797d65a4aae0cf8aa97dbc255f88b719f69ac
SHA512 3abdb87639458c29f7cefb61530b365858a522ace253b955ab7a77db03f9896aa25699f9b5571092e1a0a09d4ed41944d9b8d7f2fa7522e186f712d8f1a4ee4a
SSDEEP 24:KdefxijawdEg84UA+nIjm8KiPhaA81EeTfKpgaFd5pZ4NJ+0IjVZKiGhabZ1EzJD:KwzIVKcEq0ITKZq07yuIIXKdGcjytd
TLSH
T1A9910B47B17A02413D3D6A0D92A1DB2B16417663351CEA6B37E850BA0E67E381DFDDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e476e349af3bf040c70c776512d2bc993d7bd3895b592e5656fa5fbfc6d1c899
MD5 ff37c697cde38db290195e03cee05fff
SHA1 452ad192f5c28dbf96231e6a1d9bd31581d00cb6
SHA512 8f9d3771e8583bb85c439957c4b00006490401042f3eebd27060c0c4bf6670048508bdb32d29d5c25163e84a23de13a25a3acd0126e0e22a36e9a1a56c555201
SSDEEP 384:BiF4ZcIj8Nc8TUNTUlIlcsaLrIsRr3b+AvOytWb+2gKe7O6R2Feooldog:oFGjhwgy51rpvOWclgv7TR3H
TLSH
T161C209F218D78936D9AE8747A77E2D038EBDC063B5855984B3C85A1DCC8A5BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 00ed376e0ffb1f1b8ea57a2d02b0daa344ff070bae6df85ae98365c9e5ad2da2
MD5 d4466f3219da0fb138a5b3328cb4aa70
SHA1 ba6c885b26cbcaa27922465128d0a1791e5bf73a
SHA512 c4edc957d870f54d2fe99e615313f0966a92a1b6c1e989c01fb3f29dfd3f4c0aeadaf6e3c0af79a9998c09f1f11602d1ac9707720e659ab5810d1b9e9b5b8aae
SSDEEP 384:zZcIe8NUfsaLrIgRr3b+AvOytWb+2JKe7O6R2Feooldog:retR1rpvOWclJv7TR3H
TLSH
T160827C7228789C371EF7D149F84736038FB9406796C56E84E5DCAF1D09DA6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 289c3dfb90c841fe36d0bf779311942420a47f352a28e01841ad295472c0f29e
MD5 d7f2c0344ff3cd26fc8f43d8f111808f
SHA1 28e98fc3e4987bbbf3fe3b8776dbf148f95e38da
SHA512 b1ff3b40784aacce41173b44f002998ec94e271787d7ab0805dc45ff5819948334dc99e0886bd993329486c901b6f1ca8dc28dea9742dfc25589b2a5266086aa
SSDEEP 384:HZcIe8NUrsaLrIgRr3b+AvOytWb+2JKe7O6R2Feooldog:vexR1rpvOWclJv7TR3H
TLSH
T103827C7268B89C371EF7D189F84736138FB9406796C56E84E5DCAF1D09CA6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47346ef16e1fbd7e6b5e61be4aff4d0de452efa3beab0ad4f2eca85859a49257
MD5 a540081e80856fc9a59863655f22a1df
SHA1 bbaa73e1ff3d16c9479a52a4d83c9b3f9da0c0d0
SHA512 9c9e103269f91a50187f7f7e67a2bcbbcbc711c02f834e7f0c356dad1cf76fc63042df4f369f67381acbd0b4ef2bafd2d4f5ad2d6cbfbff2a698f3b46b0aaca7
SSDEEP 192:nRGNl6yMQmiUy1JmP1Y3b+jcvOyfR4MnnMU6:RGNl6xGg1Y3b+AvOyNMU6
TLSH
T1B102F835A8A86C779FF2AE49B98737139FD8107BD5912F84D6D82F1C05C725C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 762b72e33d74d4e55df2c142f302ab8ba309c36694bf496d33250d98223940ce
MD5 889fefcb3ac9dd8afff40b8d8e185b21
SHA1 be5cc73ffd2afbf515634de951de4ca7502d00e9
SHA512 96091f3f733d60725f6cb050cfb22a37cc107b3ed4f7720be64dc03a6b6babdc2efd2dcc172e622d27cebbd03a9f22750bbd86a25a16ddccbf7493aa3c9b62a6
SSDEEP 384:WZcIe8NUcsaLrIgRr3b+AvOytWb+2JKe7O6R2Feooldog:EecR1rpvOWclJv7TR3H
TLSH
T1F9827C7228A89C371EF7D189F84736138FB9406796C56E84E5DCAF1D09CE6AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91d2aa1989226d5c5428704652436659b3a1c6141b8311f14d44f63fc45cf2c9
MD5 417c23044e1a1cc535f02191390c7175
SHA1 a7d2214b92d593b7565d7adc2ec0e5b956d86787
SHA512 5658bea80b71c9f8bab249a9686ab0f70d054b7b8fb2713743387bdafce0b969b85538e0a0d0a299be20eec0fd7c32713ae20a0c9c821cd7779c53f646258195
SSDEEP 192:JGNt6y7QmiUyX0PjY3b+jcvOyfRDWb+2Mq4MiqqeU6:JGNt6cXjY3b+AvOytWb+2zKeU6
TLSH
T14112E83268A8AC775EE2E544F84736138FA9016BDA857FC4E1DC2F1C09DF66C234E856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63ca283c-fcb2-49c6-a442-01ea80f0e108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63ca283c-fcb2-49c6-a442-01ea80f0e108.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download