Analysis
- user interaction
yes - max time kernel
300s - max time network
299s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/07/2026, 03:53
General
- Target https://azahar-emu.org/pages/download/
- Sample260724-ef37rsed39
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 48 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 20 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 62 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://azahar-emu.org/pages/download/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff9435cc188,0x7ff9435cc194,0x7ff9435cc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,86460918329631548,7367068877945193509,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,5228200842115687470,10259442752970594402,262144 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,15917764640722428710,11218808922605129423,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12996611689176038944,989721502088590458,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,1606451644821657273,12773878221207969742,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10105410169197208810,12259062014749034741,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4220,i,766921903749183741,17875456701535650465,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,11483229134997157065,13092342939673764202,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,13754581767302319784,210172658081382351,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9974849817140795900,779373332939550269,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9790777417503845995,12452890390440661756,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,7681972910521115120,10111111968491847942,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7095922497118009102,7285515694125515961,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7095922497118009102,7285515694125515961,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6576,i,7157062032619229094,16891072336800076209,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,5088036687215091613,15697132134385697905,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4556,i,10702537520426809424,12615170418885437200,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,8279031422329565860,11866154567545801037,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\azahar-windows-msys2-2125.1.3-installer.exe"C:\Users\Admin\Downloads\azahar-windows-msys2-2125.1.3-installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Azahar\azahar.exe"C:\Program Files\Azahar\azahar.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,4190026380422342897,10398976545158149636,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,10500439352907042558,13596102141011855736,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,1088914071173996045,4849657330665151413,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5916,i,496748654700485787,14051070267940725562,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,17644121913452852986,2952775968230012208,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4704,i,18276980397442603705,3256924200886702025,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5372,i,8661719920732321521,15368431084412198666,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,2296880511387556793,14383881772028404354,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7544,i,16127072715862163042,4828817603605662047,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7716,i,8295020683797071937,13353030772531478123,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7908,i,6094446059084635072,17732861941816922844,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3480,i,8205484806573971081,3142763078869573956,262144 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5892,i,1943639863575356192,1504683513465816392,2097152 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,14472142444333409359,5883431873023488815,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11421571496846051890,10948055053570185997,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8156,i,18416430876379669222,315558973909292790,524288 --field-trial-handle=2020,i,13762700292092859813,13982747170601156201,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap32502:140:7zEvent37991⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
azahar.exe
uninst.exe
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_0000de
f_0000e0
f_0000e1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5880e3.TMP
SiteList-Enterprise.json
Edge Profile.ico
CURRENT
MANIFEST-000001
1a5ae5ae-bceb-41b5-9997-cafb70b5ab53.tmp
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe591a45.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58c7a0.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b1da6.TMP
the-real-index
index.txt
index.txt
index.txt
67a473248953641b_0
67a473248953641b_1
the-real-index
the-real-index
the-real-index~RFe591d23.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe591b2f.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59328f.TMP
3ad4d85c-105d-4309-aaec-097ca6ea80b5.tmp
LangDLL.dll
System.dll
UserInfo.dll
nsDialogs.dll
qt-config.ini
qt-config.ini.lock
azahar-windows-msys2-2125.1.3-installer.exe
azahar-windows-msys2-2125.1.3-installer.exe:Zone.Identifier
memory/5220-517-0x00007FF931B90000-0x00007FF932179000-memory.dmp
memory/5220-513-0x00007FF930A30000-0x00007FF9310C0000-memory.dmp
memory/5220-516-0x00007FF931610000-0x00007FF9318DE000-memory.dmp
memory/5220-519-0x00007FF930A30000-0x00007FF9310C0000-memory.dmp
memory/5220-514-0x00007FF6BFFB0000-0x00007FF6C0FB0000-memory.dmp
memory/5220-518-0x00007FF93A8A0000-0x00007FF93A8C5000-memory.dmp
memory/5220-515-0x00007FF931440000-0x00007FF93160E000-memory.dmp