hxxps://drive[.]google[.]com/uc?export=download&id=1D7883EbAa8qetlP6bSChgLU7wLP5MG2-

Analysis

max time kernel
124s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20250210-fr
resource tags

arch:x64arch:x86image:win11-20250210-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
13-02-2025 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?export=download&id=1D7883EbAa8qetlP6bSChgLU7wLP5MG2-

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	1556	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
67	api.ipify.org
72	api.ipify.org
73	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2332	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\demande_devi3.html:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
2732	msedge.exe
2732	msedge.exe
3936	msedge.exe
3936	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
4120	msedge.exe
4120	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 5024	2732	msedge.exe	82
PID 2732 wrote to memory of 5024	2732	msedge.exe	82
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 3172	2732	msedge.exe	83
PID 2732 wrote to memory of 1252	2732	msedge.exe	84
PID 2732 wrote to memory of 1252	2732	msedge.exe	84
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85
PID 2732 wrote to memory of 4600	2732	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?export=download&id=1D7883EbAa8qetlP6bSChgLU7wLP5MG2-
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9aee83cb8,0x7ff9aee83cc8,0x7ff9aee83cd8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --service-sandbox-type=collections --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10434982453741596025,10541851375347523415,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1888

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUU4Qjk5MTEtODA1Qi00N0JFLTlCQTItQjQzNDdERUFFQ0YwfSIgdXNlcmlkPSJ7MTk4RkE2QjUtQkVCMi00RjE3LTg0QjYtRkY3RDczRDVFOUE5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDQzMUUzRkQtMDAwRC00RURFLThBQTItMzZDNEEzODhFRTA2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMiIGluc3RhbGxkYXRldGltZT0iMTczOTE4MzgwMSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NTYyMTc0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4OTQ5ODY5NTgiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5f041262c917dce525f204780d88af46

SHA1
661f81e4f78f636546780c72e8ffbc2917e4b350

SHA256
a5ca5288ce9e1fc2ffe0d9f7ab984c7e2f79380abc77b201b79c0cd70a02ec1b

SHA512
9d416e6ecf14a1a7879077100ff97c58818f39bf341ef00d1a348c3dda26f5a5f21776dadd7a65366aeeead08492ee2adb3f6dbbea2bc018bf8cb3645f4ded44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c544ff600d30782508cfd6f34e7cad3c

SHA1
918d25a3b3b4c7050e04dc302b4af028cae90444

SHA256
ece29b73d9506b104284060c22853eca7247717e07b28f3fc01a5a235b403094

SHA512
91fcd75740886d55ffca7b2f8886922cb73af6a706b40689dbcb918aa4c61406530280bc1b9729511d62f40387362626d258fa12db26a570ba67e01b979d0647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dfe9bf15e88bc516747e463fc2f6c67a

SHA1
f307927d7117a95b34f98399dcb364f72dc8ff0f

SHA256
9dc77c4f0339140227bd3ec234d24e786e4a2bda60851d07c97f2c74c81629ed

SHA512
c911b30322c252283f624f31f9992c70b4119c6f726f26a4f65a96b9f1e4aaf683f009cfb427cd450e74a4e0634e5d95cd444a8456c1e8109bf78467c30583b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
775ab575ad897206e737913cef5392fe

SHA1
ae8821a8dd9884460fc5d7e9dc90b445fd3e0b75

SHA256
50a4e9aaa98ba3eaab01f04be342e775d2fef92fdf71a4784ef6312be8b6e8fb

SHA512
339cb85c08629a1377f6bc12cb8593224a7341b897c658512172523c498a638830cea2c1df0e32e2da6d19c8571f1f5b3524d1630af328d465c248c9b303347e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1781da98b4f753b80dfb5077e1b5e1bc

SHA1
3e7aad891630d605a13c90cc242cb44593b20710

SHA256
6312f52a7cdc3de94edf949b84e27452a9ee743cbe3a80b1e99e6de4baf65e57

SHA512
10698b3dfa967375e9f55fa4926430edd156dbb86e4ee3c2f33ae7459bb0707d2fef144cf2b8c994acefb4ac85aa7f0924e114ebdd0735a3a6b64ec118b3cb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5c6ebdb385cd0bf61c2018940042003

SHA1
5075e8e93f7ca0e5a7bb5ebf56ee8ad57a4cbaae

SHA256
c6d907298cee61abd644faff629bdb5de07e05680b73e5d9a655bc8ef057fee2

SHA512
b4f18bde6ce83aa994d52bbc363c64a6408b73b251e9b9e9ee648795556555cbc3a8d3b087757398f6450b71ac38456f28def0eed0164edd32d73a03461a444e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebf2a203665c9b66e6a90dc4589a31a3

SHA1
6b1bce253fb1606010dffbdea583337fbbaab71b

SHA256
68714c4c40536f9e3e7fff7b58103b46e8ce0f777d78b39556338998ad4adf24

SHA512
36604bc017e7acfac250bf520c65d53bb00d08f62eab0d3b26aab9625cba2ee5c06afc31273e9fee4963395cd11e95634687d85b76f107fc5ab83f980658223d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed7bc0d85310ce168ed3dabf14552b00

SHA1
7ca94e2936eaf3e5c96829f57679c995916c6b18

SHA256
5ce4a2565c8d785a744b5556d4b98328cdacfa1aab7468c9d8132cff6a2642fd

SHA512
38f16f58a603c4a2c4eb234db4dab6786d2d5d7dae7937e2c4184e50138779919a646ad96943431b8c894f9460d10a2d11633b927f37edfce3abb9967d64a9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3063cd71f52fa41b13535f88248bc28

SHA1
a4df8da76212c213066f7a83a521dc72431f445f

SHA256
5da1ae1cf6f5c06f2a97f0a2f9c6c3b28abc3e49f2940e4036da7974726bbaef

SHA512
976422adfd7ec9295be312dc2c3b70e48e370423e46e1bf97897742d6e6c6243b71969d445858f44585d47ca4f2d9cdf140ff54fc63158f0b2758c0291e3943d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
acde26791957c658025450108bfdf3f6

SHA1
3d6bcf04aa0f7206b1eb19134facb324cbc6a920

SHA256
e19607497e9f2390831050f15b6b35f930a2e8f0776177ebc967627dae13159d

SHA512
16826a811519b8b8d88c531f2804213e317b26675f3ae5122d472265537a43426c45a23bc8b123d0d550543e8b27993cbdcc710b0e2d8a7a3e86ffdd25d25aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
162267ecf66d69f235e447b1b0ae995b

SHA1
481dc4c99db3a93a9c8f2fa2f1bff040b887c74d

SHA256
7ac36d6ded968e073f01f3f653b605496aaedb46b5cac887e358471fa9e3e93f

SHA512
4a7f006d4daff2545fea092790a12bc247ac24692ec2ae616c905dccc560afacd36b310174fd3cc6bc750a3899a637cc4918d4e0b80dd17dd1594e629ef0973d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
85733e7f323e36c09faf17bcbd7f18c7

SHA1
514bff1022f277ca0c04e8aa246405ce964dbef7

SHA256
62e7904c8b7ef98e896f6318884b18eebca5749903c2441b552d8a0effabc5ee

SHA512
4c377d5cdf57be2811706ff09ffa79826430d9c3a9233e7d6475e807873d521d4155756fe90595aa69f6e788ee1bee33c827093d90419e0197a198cc229ce19d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c63.TMP

Filesize
371B

MD5
698871fc071bc655e907641cde848b9c

SHA1
b9311ad3e81cd21eb2a9318982d881c413cf4487

SHA256
42306fd39c0d4c5d840910a4e8796cfb88fe6cc2a005ab9177685b3d12040f60

SHA512
2a0fa0ea328a5bdf65e170e514d3f0ccc016a20af2ec160b5006488da570493ace94181f7b6205c4354f21b6f65a3d638bee3098e9cbb957063b0d8561f73ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c87bb2f782f938a10e399309af10ce35

SHA1
d5fd93e84813f8242e4d18b54a427375bda7ba7a

SHA256
14a5bc9dedbd0559a794ef3ecc1ae5744ec08eed0adfef5de6891669ca539ebd

SHA512
a64c27808e75a9645a5ba5eb5d3c86db3364679774c4fbd7230364f19875b6909d1b1982b105b42c32d3bd3e01a0228812a17b44ebfacf040457a699c34b3fe7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\demande_devi3.html

Filesize
4KB

MD5
2fc1b1e6b033f9c99d8f1e24f61f7cc3

SHA1
f9532f67dec220c60d06f1f0c31353f06c1c1dbc

SHA256
bd748827eb0bf3e761a4036205a195754b76081535a66f74e52cad31df62737d

SHA512
5b62a212ffff1eb42176fabd74c9fcb8b36c264f117888239066db1cdb90f3321b00053592129bf98d06b45ada562d74025e384046d0500a04cfb15e09604369

Download Submit
C:\Users\Admin\Downloads\demande_devi3.html:Zone.Identifier

Filesize
134B

MD5
9df570c7292460cafb75ac503bf66633

SHA1
484564e8e88e791bdc07c9e7c970c753d634ccc1

SHA256
adfcb18b2429341a49330e7350e49c9a7f112406bdcaa4dbef9332c1d98c5562

SHA512
5f0bbf23e65ec7044895fceea959d430d4cf3f99b8eb1099dd57fb59d0549246429377a3730af165ca6907c1e990897ceba45db69f4de96f0a2315c65f59b353

Download Submit