hxxp://raqr[.]frizzhairforecast[.]com@SSL

Analysis

max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://raqr.frizzhairforecast.com@SSL
Sample260720-xjc4vsdx71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290471731024476"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{83551301-78C4-4C38-A68A-CFDBA2164619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4832	2504	msedge.exe	83
PID 2504 wrote to memory of 1940	2504	msedge.exe	84
PID 2504 wrote to memory of 4220	2504	msedge.exe	85
PID 2504 wrote to memory of 4220	2504	msedge.exe	85
PID 2504 wrote to memory of 4220	2504	msedge.exe	85
PID 2504 wrote to memory of 4100	2504	msedge.exe	86
PID 2504 wrote to memory of 4100	2504	msedge.exe	86
PID 2504 wrote to memory of 4928	2504	msedge.exe	88
PID 2504 wrote to memory of 4928	2504	msedge.exe	88
PID 2504 wrote to memory of 4928	2504	msedge.exe	88
PID 2504 wrote to memory of 4004	2504	msedge.exe	89
PID 2504 wrote to memory of 4004	2504	msedge.exe	89
PID 2504 wrote to memory of 4004	2504	msedge.exe	89
PID 2504 wrote to memory of 3948	2504	msedge.exe	90
PID 2504 wrote to memory of 1252	2504	msedge.exe	91
PID 2504 wrote to memory of 3948	2504	msedge.exe	90
PID 2504 wrote to memory of 3948	2504	msedge.exe	90
PID 2504 wrote to memory of 1252	2504	msedge.exe	91
PID 2504 wrote to memory of 1252	2504	msedge.exe	91
PID 2504 wrote to memory of 1380	2504	msedge.exe	95
PID 2504 wrote to memory of 1380	2504	msedge.exe	95
PID 2504 wrote to memory of 1380	2504	msedge.exe	95
PID 2504 wrote to memory of 2392	2504	msedge.exe	96
PID 2504 wrote to memory of 3364	2504	msedge.exe	97
PID 2504 wrote to memory of 2392	2504	msedge.exe	96
PID 2504 wrote to memory of 3364	2504	msedge.exe	97
PID 2504 wrote to memory of 3380	2504	msedge.exe	99
PID 2504 wrote to memory of 4448	2504	msedge.exe	100
PID 2504 wrote to memory of 4448	2504	msedge.exe	100
PID 2504 wrote to memory of 4448	2504	msedge.exe	100
PID 2504 wrote to memory of 1344	2504	msedge.exe	103
PID 2504 wrote to memory of 1344	2504	msedge.exe	103
PID 2504 wrote to memory of 1344	2504	msedge.exe	103
PID 2504 wrote to memory of 3052	2504	msedge.exe	111
PID 2504 wrote to memory of 2860	2504	msedge.exe	112
PID 2504 wrote to memory of 3192	2504	msedge.exe	113
PID 2504 wrote to memory of 2432	2504	msedge.exe	114
PID 2504 wrote to memory of 2432	2504	msedge.exe	114
PID 2504 wrote to memory of 2432	2504	msedge.exe	114
PID 2504 wrote to memory of 4752	2504	msedge.exe	115
PID 2504 wrote to memory of 4752	2504	msedge.exe	115
PID 2504 wrote to memory of 316	2504	msedge.exe	116
PID 2504 wrote to memory of 316	2504	msedge.exe	116
PID 2504 wrote to memory of 316	2504	msedge.exe	116
PID 2504 wrote to memory of 3324	2504	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://raqr.frizzhairforecast.com@SSL
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbd31ac188,0x7ffbd31ac194,0x7ffbd31ac1a0
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6481775270709595271,12010742902175040447,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,2538773807964426626,3250395391139397244,262144 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,15983848881114618958,508137791149256856,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11373718751996684904,6803145087561892236,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2939181768676617456,16004739992656396800,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,8472103861235602752,4727219859398380968,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,7550277226767663908,395553745133765808,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,14331073395056793144,9581243100500468595,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4827516297642153738,7023516000128198570,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,4634036813375907704,9146447129377997714,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,170576893268638313,15171776272958615152,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,170576893268638313,15171776272958615152,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5108,i,7315992342208285049,4707991230704664536,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5168,i,14255439480067002478,15170243026909736179,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3324804800077339411,2261922321975950032,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,18424784565247775094,4254183760694516089,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,12363293544751715688,18208168558543467998,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3036,i,15672049720190554765,17248437635191901403,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,3474847559101097408,7728629337947851937,524288 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6208,i,3075646330797324227,8194087641893626776,2097152 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3500,i,4927878074862258346,12492160328494206048,262144 --field-trial-handle=2332,i,4767387667799592351,3889784356469407073,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b5304d698ccc76f2002b0ca4414fbbadb10439a95bfb0724601ae46b10c1da82
MD5 b6bd186f51cedd64e0b19e3fdab51bd4
SHA1 5ef529ec82038e2ae656508a1eafaaaa5aad9ebd
SHA512 d8ade33e144fe94a1afd17f5ee5d74bd6f527d6cac86c8f6e68d1a706210d2039b04d7a691751edbd76ca8ccfea249534b9f81aaa584a770e229ac8d200b0aa2
TLSH
T1E1718324221584F7FB52CDF04CC2E558767A49715BB25E818C5029F67E0176ACBF02F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b13a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b13a.TMP
Size 3KB
SHA256 1813f5cebd343bffebe4aa125a031f95ab8d059f132fafcbc3803a335530c5f9
MD5 201c53bc51014e1ce91cc2691a2216b7
SHA1 dad28f821abb756415d6640e8388360f1f2e3aca
SHA512 d862e6fb3c37969ddfd26b1734c23b3f0937fdeaddf4a986e023e044cbfcf5fdd7a56844f7fab250777b34de4407fd504c5452b2c0cf83d3d8428dad74531cd6
TLSH
T1A571A424221588F3FB52CCF04CD2E558767A49715BB25E828C5029F67E0176BCBF02F4
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2eb7abda83d7e6d73700327c00dfaaab915012cdb54687a35777ce7b14f7dbb5
MD5 5eb4e56205d350163ece6d92423d0848
SHA1 664ce7771671368f1a4663a343b079cc3f4b6b09
SHA512 8cdddba4eca108203cfee1cb813ba04ce1b61a77e0602b35bf005e96d7905217a6c7480dc7b5750d9c2b176818f68d86176a00e07f2d00980ed1ae0655b9b4e7
TLSH
T148117DB7C3D5856E8D0116F06A24AE2BCE2D0505831C7C1585D4FF6B93E3475E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 165f9d07d3932bdbee00ffffbe016bcdba84b1d65bfb5ff4d068b72b6500e4dd
MD5 d423b4bca33749d7fe0620b0acea98da
SHA1 8f6563d9ce92ea3bde755ce8fde027d4f75ec1a6
SHA512 c0b8f60d77155ef29dfefeb6db63a652011c11a02723578ea44122dca4b7c25ace6d9ae0c6aeb3f2ae9125b90ea6feeca118c4ff4d9e6311110aa354592280f6
SSDEEP 192:sxZIweRLWyM/jK1Ml8UQbVkbV/f7VsbeKERTIzpnIdpUIwHW6+WNGYnaIoqLZvDO:sxZGwqCB/fRsyKE1iGYHbGARUT
TLSH
T11252E8166A349977CCDBD20DF941BF53D6F55472E2900E44AAFCCA0C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e6137d8c732cea78c7499218f78c2d5b4a183f3eb26d0aefe11fd07255f0ce0
MD5 8920b7d1744130fa2ceafd5012ebf43b
SHA1 3905f5dc9265dbc3c75ad80ba86803f36da82ea4
SHA512 b866536b578df72253046b7cf547e26cbea19471f84098c2479b60ca743dd0f36dc2da8c3f3c7a3f572f4e10217af504e47c812fbb6db0062a587fbb79bd7827
SSDEEP 192:sxZIweRLWyM/jK1Ml8MkbV/f7VsvKE5IzpnIdpSIwHW6+WNGYnyI1qLZvDh2IgrJ:sxZGwMB/fRsvKE5iGGHbG1RU9
TLSH
T16B42D8166A349977CCCBD20DB9557F53D6F91472E2900E44AAFCCA0C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bdf557f634cfdfef5ee7eb4d76e3f5d19a1e58289bdefd1c1c6a655eac888cc1
MD5 462576ef59421b7f67b2a55568df0ee4
SHA1 672b27add2799fc29729648a07bd646eb866f4b7
SHA512 bc95d4aa14734f8a3222f0a21420748d8458c5d2516b3d3742178ea4b2e8054064d5e0cedf70b30ca0465a90b808213ab2774351d48cd5b822ae315066024561
SSDEEP 768:yFQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshNro/uxD/:yFQRMvUWv0sTgu1jakTLROhm/uxL
TLSH
T158D21C3B284CCB7E4F841E6CEC26AF976DD801CB67988D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594de7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594de7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 11a3c429d9443a155a53a16ad823c20974f5246ff8a44571fe75d32501d76964
MD5 9d771bc208dd55723c52cc756465b527
SHA1 8b4240d149d28dfe44b68a809fdb59c13b047dcc
SHA512 382cff534201a1fef5d14398d989f3a9090f7cf4eed74afe0f3d2e68444d55a52172a98533737e281a69a556cde5c7521c03e261cc1fbb261eedc6d4ea5e8444
SSDEEP 384:qtNn/s3n9SfsNBkiguEeG/yX54at2eYxqxXrROObjI9G6w7cVj:qj+9UP7Xwxwi5rR29Mcp
TLSH
T117927C3768345C7B8EA39955B44B3A17AFF4526B93C42F44E1EC7F0C02DB29C431A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 9855ca796f549bea2d714ca6556482c69c9c0f3be927d7802c2fb8f6d8a70089
MD5 f2eafef8200c2a3a79488c0b13d4fc7e
SHA1 472679b3265ddf1d57971273f5091da7e7bc112f
SHA512 e729bb2a16f486147c9aa119009b78bc80a751a464b674c5fe090d329e76aa1c86477e5e3df9d453784aa3a22dfaca6b45488a17e351abc11749bb7e5fae24fb
SSDEEP 384:xiF1tNn/s3n9SpzsNT8TUNTUlIlk/guEeG/yX54at2eYxqxXoROObjI9G6w7cVj:YF1j+9mOwg37Xwxwi5oR29Mcp
TLSH
T106A26B3758249D7B9EA28A95F54B36179FF542ABC6C5AF50E2DCAF0C02DB1DC030B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ca76f9edc9c9a3f91e42c65592ce956a78e71aa4755aa8836f39ebe93332300
MD5 d8df9a4387736f8a58277abbbb0c6fdb
SHA1 191bdc03feae046e9afdd17d88793829f1f177d7
SHA512 015c445b499061e93e24a4ab90520ec0f79d7548d74549b1659f42b06d15e8a43fb2487f6139674050a10c5fd2bef2880eae4e1e8bcf817bf91b16c1485a015f
SSDEEP 192:CONP6G+bgQmiUyINIEDE54aP12yjzo5pl9I8OyJBOU6:CONP6HgnDE54at2eYx7qU6
TLSH
T1B102D939A8382C7B9FF3AE85B5872B135FD5112BE6956B44DAEC1B1C01DB24C130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ae41afa866675b1770c93c1214b4fcf3aa42e67d4eb7aabddc9f0fe8748f3ef9
MD5 979599434638ffc4e80d08ed68c1120c
SHA1 7e9e2cd88087995dd350a0128a0d2f48f147b70d
SHA512 22bfbe3e9649a4c2b5b7b0d030e477140336556d5e0425606fe0cb86abebe5459c1ed7a0948d17d17051d8bdbdcdfaa2838038f6904ea772d840ee44fbff03a6
SSDEEP 384:otNn/s3n9SfsNBk/guEeG/yX54at2eYxqxXrROObjI9G6w7cVj:oj+9Uu7Xwxwi5rR29Mcp
TLSH
T1B9927C3768345C7B8EA39955B54B3A17AFF4526B93C42F40E1EC6F0C02CB29C431A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 09ec4489ac2adbd2512f861329b58d40e36a2bdaa9b8b6ae5296704c0b58cba1
MD5 1b67faa38846ff4d382b7f624a6a35f8
SHA1 a2c1c738b7705021fa5dfda9b4cd4edd90ea63f3
SHA512 898a0299459e8756a642952d6f22ce6eae0a059b9185a5ea7942820575820801ab2f332d4ecf2fd1ba8efdca2cfb9e3797ae054b94dacf0349c797fce6a9d6e8
SSDEEP 192:eVONS96G+bg4QmiUyIwIEeZE54aP12yjzo5pl9qxXweJ28ShJTqtmU6:SONM6Hb6uE54at2eYxqxXoRU6
TLSH
T1AF120A37A8346C6B5EE2E595B48736136FE5421BD685BF50E6EC2B1C02DF19C130F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f7d0332be9b5d2e716817c2871d41364b81afb9731b913c94202078b18feb121
MD5 a54ccb9904c575a427dd7f4f42976a65
SHA1 8e16a8d200172047e43c4024a4950b4512a6dafd
SHA512 f23e4487bcd4082e20a3cab60ecf692c54039a2286c73bbaf028ab8bf3be42b224df6ed82eafdabd4bcf1351b3433b665c75f4367850fa6e7b0da6ad5dd89f56
TLSH
T15C413858B6F91158B3736F1A9FF7A86E487E7C732E0AD4AE00110D4F4A26E00C961737
MD5 SHA1 SHA512 TLSH

Submit Download