hxxp://carrefourduvoyage[.]com

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://carrefourduvoyage.com
Sample260830-31prwabm51

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326079525657471"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{50E4C5F9-2372-4539-824A-16A541C82442}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 940	1680	msedge.exe	85
PID 1680 wrote to memory of 556	1680	msedge.exe	86
PID 1680 wrote to memory of 3164	1680	msedge.exe	87
PID 1680 wrote to memory of 556	1680	msedge.exe	86
PID 1680 wrote to memory of 556	1680	msedge.exe	86
PID 1680 wrote to memory of 1988	1680	msedge.exe	89
PID 1680 wrote to memory of 1988	1680	msedge.exe	89
PID 1680 wrote to memory of 1444	1680	msedge.exe	90
PID 1680 wrote to memory of 4320	1680	msedge.exe	91
PID 1680 wrote to memory of 1444	1680	msedge.exe	90
PID 1680 wrote to memory of 1444	1680	msedge.exe	90
PID 1680 wrote to memory of 4320	1680	msedge.exe	91
PID 1680 wrote to memory of 4320	1680	msedge.exe	91
PID 1680 wrote to memory of 3804	1680	msedge.exe	92
PID 1680 wrote to memory of 2276	1680	msedge.exe	93
PID 1680 wrote to memory of 3804	1680	msedge.exe	92
PID 1680 wrote to memory of 3804	1680	msedge.exe	92
PID 1680 wrote to memory of 2276	1680	msedge.exe	93
PID 1680 wrote to memory of 2276	1680	msedge.exe	93
PID 1680 wrote to memory of 560	1680	msedge.exe	96
PID 1680 wrote to memory of 560	1680	msedge.exe	96
PID 1680 wrote to memory of 560	1680	msedge.exe	96
PID 1680 wrote to memory of 828	1680	msedge.exe	98
PID 1680 wrote to memory of 828	1680	msedge.exe	98
PID 1680 wrote to memory of 828	1680	msedge.exe	98
PID 1680 wrote to memory of 4288	1680	msedge.exe	99
PID 1680 wrote to memory of 4032	1680	msedge.exe	100
PID 1680 wrote to memory of 4288	1680	msedge.exe	99
PID 1680 wrote to memory of 4032	1680	msedge.exe	100
PID 1680 wrote to memory of 2068	1680	msedge.exe	102
PID 1680 wrote to memory of 4240	1680	msedge.exe	107
PID 1680 wrote to memory of 4240	1680	msedge.exe	107
PID 1680 wrote to memory of 4240	1680	msedge.exe	107
PID 1680 wrote to memory of 1752	1680	msedge.exe	119
PID 1680 wrote to memory of 3828	1680	msedge.exe	120
PID 1680 wrote to memory of 4480	1680	msedge.exe	121
PID 1680 wrote to memory of 4464	1680	msedge.exe	123
PID 1680 wrote to memory of 4464	1680	msedge.exe	123
PID 1680 wrote to memory of 4464	1680	msedge.exe	123
PID 1680 wrote to memory of 1444	1680	msedge.exe	125
PID 1680 wrote to memory of 1444	1680	msedge.exe	125
PID 1680 wrote to memory of 1976	1680	msedge.exe	127
PID 1680 wrote to memory of 1976	1680	msedge.exe	127
PID 1680 wrote to memory of 1976	1680	msedge.exe	127
PID 1680 wrote to memory of 1588	1680	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://carrefourduvoyage.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff8e5c1c188,0x7ff8e5c1c194,0x7ff8e5c1c1a0
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,2463611681909811390,16350048883165123363,262144 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6144893049302296786,7401187209578529448,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3891431643615585937,9880819292496857667,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,5304404227643339020,5949245293759861729,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,40499819325583334,2788202727790868969,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,3126508125988386390,17478946509821213488,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,3013675316325849521,18123085197667272134,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3572,i,5135414223693547223,820080605911630994,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3516,i,11421120159219589480,1624451932114642135,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,219278489078159077,13367976673585244496,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2351048772235993554,11205426204070339504,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221193777253802642,16543390564087231775,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221193777253802642,16543390564087231775,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6344,i,12789090359856135377,2160948994218188372,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,2789030562008698388,15221237512183458262,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,13086145048062682722,2061628709859031554,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,8458650290496524799,15864810383390048050,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5272,i,4974002044139278402,1887596772988825842,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,10643846956233312330,10541742196286537378,524288 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5864,i,16892340439635438557,1433452709487970278,2097152 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,14061089703255282611,8459958917411219310,262144 --field-trial-handle=2312,i,17513029643723925461,12632492189622579926,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 218cea792c68430c6bb6d6e0d21aedc711d676a4c0c0b5f5dec615a75271485f
MD5 cf6ff173c85048a690aa17ac23eecf17
SHA1 44b5b16019b2de36014d92f66b731e24f5beebe6
SHA512 91eb841ad4496206aa6d73391515196a76f725e8a5d3e737c6a6b08a07c90ff98a58af5a93678b87401aca6a31dae0df119b69f4b425fda310cfa1dd4f2ac38b
TLSH
T1E161E835022186F5D3EA123294D30E8C75B586F6F9077E0B69D4DCF7E7A5F620029946
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58adb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58adb0.TMP
Size 3KB
SHA256 b06e591c75c259f5a112a7b995c45c13247f7335babe30e524bba2bb05c2237c
MD5 21372a462136b3cfa54a34c2ea066d87
SHA1 ad581813552dc00fff07e4aa3f747c4a1c23e2d4
SHA512 e4acd968a31b2208829445de3ba30aef3496a2e20e4fb95640f183dde42f6766162f4fe95a3cfd056c3d9a1f6708f6f66969f75659071eb693e1dc1429765a55
TLSH
T1E361E834022146F5D3EA123298D30E8C75B586F6F9077E0B79D4DDF7E7A9F520029946
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7fd0541f7f95e7301e4e32050e3128b380448cb45d461d8249cfbf3e8d6cac20
MD5 fb190ab5b4484aca76c818aa5f642ec0
SHA1 ce0175894a0090d81a76a1f693a43ce2e5089df4
SHA512 f7ca3f8cba786b5b3f35f893dcd0ba0842f4edb0b74134a370ec1d3e14bd5a478da508be7811035e22a2d1a0e67af27e4575adb47e4df01cb42f2aec982e691e
TLSH
T16C117DF3C7D595AE8A0116F0AA24AE2BDE1D0605421C7C19C9D4EF27D3F3075E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6199f307bdb591ff69fcb965ea527d71a5038f03a37a76017fca87c4d68b364a
MD5 068965b756bf2953c4c9a368665b03f7
SHA1 cae335b34c049a4dab6c670d85c0469abfa99ad6
SHA512 822f9cba988151a82119161d1cca3241464606f0548197a2acae0ed4b019fbf4358222982c0b9c408a533bb151d580fcca6f7f92051e5e92255ca65c35c7167d
SSDEEP 192:sxZUR3yM/jK1Ml8UQPk+/fAsuDumIIdpUvHWn6+WNGY9IIvBJ62Ig5EJ:sxZUvq8+/fAsuDuGOHFGQNC
TLSH
T1F952C612AA346977CCDBD20DFA55BF53D6F5547292900E44AAFCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ad06332d0522e8125f8b682ea713f06d32242fec624dbc7316c9e4ccb5922587
MD5 2fb6ba6216e8cf4cbd8088aac925ac8e
SHA1 75f4f559bdf31a704afbad66d6ea733f802f9eb7
SHA512 3c15e379571d30e0ccec064fd2180e7a592c31d446be8eb88e3e0f376da35e6626201350f448c4b75300086103947614b1c043596a5407e37bb07291038b333e
SSDEEP 192:sxZUR3yM/jK1Ml8Mk+/fAsQDDmIIdpevHWz6+WNGY9IKK62IgrJ:sxZUvM+/fAsQDDGAHJGP9
TLSH
T1C442E812AA346977CCDBD20DFA55BF53D6F55472A2900E44A9FCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e7e8dff7d5faef3c579e9702bd286ed53f12421fb21f27f30659b2d9f26e9272
MD5 1cf092bcc54c0eede38e9bfeb6ace0fd
SHA1 dfddbff67a297d27d083ab6e81835007d698022c
SHA512 2eda6d5a2304e8467d1ef9c7288219e65abff947f746b265e118ebdbb3bd2f82f1778043613a8f687f072cf61a40fbabe110556f6d4f89c038dd32a431f75cf3
SSDEEP 768:H8cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNcroYg6t:H8cv21wWvu+Z+u1jaeFLeRNHY9
TLSH
T179D20A2B280CCB7E4F841E9CED2AAF966DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 714282ce4b1b32ff30cf4d057c277d337274a4e35d062a192c82cd49131e8fb3
MD5 7f630873cf8a824604ae392bdb8009db
SHA1 80ea8ffd1c3964a0ba1607eb50ac98033be06dad
SHA512 14b950d1d519e56b1a69fd28d0ddae4c5424cf66284d92788544207ffc906f6aad2946e57c121f7629e53711dfaeeb710a044cff80a70d8291ffdd6accdea595
SSDEEP 384:/5NZcIQsNq8ZN4nwzi6z5Re+C6BRuxMrJrZ9JG0X1puLLyo+:xVQ0J7tIi4MrhPssyLLyp
TLSH
T177927C719CB45CBB1AF2E244F54B36179FBC8063A6C92F40D5ECAB1D01DE69D130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a56eeb18b552c89ff27492b242d40be6127226151494ec72761ac1c5d515f5b6
MD5 082b94b7ff60c60d353f48e2de4f5329
SHA1 e61488f9de5304a20f3ed1bc2fb2a13d9014b355
SHA512 326aeada2181da173507913336aaaf21161406f1afad5e17e2517db0cb1378c6f942705f4b86282e3fdf5a80314deafdb2ae6f6cad501fe6ad48ea7952d9d375
SSDEEP 384:64ZcIhsNqTZN4nwzi6z5Re+C6BRuxMrJrZiJG0X1puLLyo+:6GhVJ7tIi4MrhIssyLLyp
TLSH
T1C0827C319CB45CBB5AF2E244F54B36179FFC8063A6C92F40D5EC6B1D01EE699130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1c4dc13ada980e66c39f396d37dda82b5bc0aadbe8b9da8159bd3a9c22ae2c60
MD5 023dbd7b08f7de3a39c7e228fb7e668a
SHA1 2c36dad9f5e47ba0c6f8ae6f90bc9a4c754b91c3
SHA512 9459b2dc272a22cf12f4b96bbafbb8a3e7761cdc9791bab70c78cf39d24a3f264aa5301bb148b87f5315111c3afa1957718e86125e4c3f71e8a63969f2c22c39
SSDEEP 384:354ZcIhsNq8ZN4nwzi6z5Re+C6BRuxMrJrZiJG0X1puLLyo+:JGh0J7tIi4MrhIssyLLyp
TLSH
T1E6827C719CB45CBB5AF2E244F54B36079FFC8063A6C92F4095ECAB1D00EE699130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f4129a002070d73429761e7c9b499f5642e62ffd95a808fb430b0bc59ac193a
MD5 5ef1ea35240b44c507a2410a5556fbf5
SHA1 ec9c5f942d5b66c55ecaf8ed70262947aab907d1
SHA512 9ef6f789029a87681ee77caa0fff62283c062517ae7cff64b7c985cbd81ff064f6b8062d76ad24775a7822203882dbd8b5fca72c67248297e722afdb30322c54
SSDEEP 192:JONx6v+YLNQmiUyaTZh+CG66BMAuxYus3lU6:JONx6vz/3Zh+C6BRuxu1U6
TLSH
T17602E839A8682C7B9FF2AE05F58736275FE91177E6962F80D9E81E1C00D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d001b43f94edfca3968080333db77131509873323e1ab9148ced1cc045e9f1d
MD5 c8dc9023fd10a53171217ca65266fe31
SHA1 d29d957653b331cbfed8c293a6c9dc60eef9b0e8
SHA512 b5f4bc8a955b94402d77072c408a3ca78ffa1df861f629fddc8d5428751dc271c9f9c615f5378c75da32f67fcdb3e5c9d1314c73c46489fe3d5ca4ba95e3ad85
SSDEEP 192:7xONj6v+YLS6QmiUyaTjh+CG66BMAuxMcSJrZBCHJhqXU6:7xONj6vzG29jh+C6BRuxMrJrZGJGU6
TLSH
T136120A36A8A45CBB5EE3A544F48735136FF95177EA8A3F80D5DC2E1C01EF65C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3b1f5eb97856a24bf1fdf6776de90db069845324a77293340edf84f428fc2dac
MD5 56dfcc11958072c1a498b0d1e1705822
SHA1 b4e015e019e665e6ade4ae497d5b5ec2aadb61f5
SHA512 5ea04cccca56a269df9d3008fe7e0e8b329d4db300d4f2536537729bbf2ca6d59469fea045fa37c46e039efd56818c6b92cfa47179772c7a90dfa797fdce6a72
TLSH
T146412899B6E91148B3777E56AFF7B86E447FB8332E06949E00110E4F0623A40C97173B
MD5 SHA1 SHA512 TLSH

Submit Download