f362a0356d6a7b558129e69f1a582e7bffbeba3486c7f6681e8c58ee875739c1

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension/images/RAP_Dark.svg
Size 5KB
Sample260523-akxtbsht2j
SHA256 f362a0356d6a7b558129e69f1a582e7bffbeba3486c7f6681e8c58ee875739c1
MD5 fb12d674361e164ce5a65c23e3821f49
SHA1 dbf0a2d741032787122069db56f7f1637fe1534d
SHA512 1f6220be6e53a6b90bea7f6385ef1bf0aa136a240ca3a35263b474d04630a4fb486f84e93112ec5154dcebc688ed206182dd9b3ab3724af23aa804a51731bbd9
SSDEEP 96:QXdcVtTI7r4c1kNzJv8AqCsWl4DZM2GCaCeRmdy8D8RDBS+WSTwdC6/7hEN:QNGTsvwFEAZMFZGCaCeRmdLD8xBRfx6c
TLSH
T104B151A81B78AB2CF590F0FCCB216474BF1958D99A8149F1C3A53F0BE8598590EF50E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_344484189\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_344484189\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1740	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2593082644"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31255134"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239692080204379"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{74EEE8A4-8B76-4105-8FC0-DEE9EBE1CE18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
648	msedge.exe
648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4292	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4292	1360	iexplore.exe	80
PID 4292 wrote to memory of 4924	4292	msedge.exe	81
PID 4292 wrote to memory of 1740	4292	msedge.exe	82
PID 4292 wrote to memory of 1072	4292	msedge.exe	83
PID 4292 wrote to memory of 1072	4292	msedge.exe	83
PID 4292 wrote to memory of 1072	4292	msedge.exe	83
PID 4292 wrote to memory of 1964	4292	msedge.exe	84
PID 4292 wrote to memory of 1964	4292	msedge.exe	84
PID 4292 wrote to memory of 5976	4292	msedge.exe	86
PID 4292 wrote to memory of 5976	4292	msedge.exe	86
PID 4292 wrote to memory of 2924	4292	msedge.exe	87
PID 4292 wrote to memory of 5976	4292	msedge.exe	86
PID 4292 wrote to memory of 2924	4292	msedge.exe	87
PID 4292 wrote to memory of 2924	4292	msedge.exe	87
PID 4292 wrote to memory of 4932	4292	msedge.exe	89
PID 4292 wrote to memory of 4080	4292	msedge.exe	90
PID 4292 wrote to memory of 4932	4292	msedge.exe	89
PID 4292 wrote to memory of 4080	4292	msedge.exe	90
PID 4292 wrote to memory of 5592	4292	msedge.exe	91
PID 4292 wrote to memory of 1888	4292	msedge.exe	93
PID 5592 wrote to memory of 920	5592	msedge.exe	94
PID 4292 wrote to memory of 404	4292	msedge.exe	97
PID 4292 wrote to memory of 228	4292	msedge.exe	98
PID 4292 wrote to memory of 236	4292	msedge.exe	99
PID 4292 wrote to memory of 5400	4292	msedge.exe	100
PID 4292 wrote to memory of 5400	4292	msedge.exe	100
PID 4292 wrote to memory of 1348	4292	msedge.exe	103
PID 4292 wrote to memory of 1348	4292	msedge.exe	103
PID 4292 wrote to memory of 648	4292	msedge.exe	104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\extension\images\RAP_Dark.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/extension/images/RAP_Dark.svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x334,0x7ffcec96c188,0x7ffcec96c194,0x7ffcec96c1a0
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,1653868107527876988,3473349907709091160,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,1111545108768775282,3170096124567684320,262144 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,9269707598779959630,1570246599569738209,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1740622116053185345,6783185525221809846,2097152 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,7072599966802684684,3165628332712453223,2097152 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,6706915569506393384,423232766113610742,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,15045947314324634450,2560814232889513147,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,8989162995271430672,11120035211598914962,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15011519106784255490,8314751534024155453,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15011519106784255490,8314751534024155453,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,3942457139482876449,9958858192013362802,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=732,i,5084362156345793512,16239153728978889786,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8826759192143417388,4606718885175702837,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4960939496480432881,372861508219741376,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,3999139278101738288,14037401927049430022,524288 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5964,i,11245815961851729576,10601465236134597884,262144 --field-trial-handle=2288,i,15208257394708043441,5815592276293619586,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 11aebc5d644047c113d46cd0d10d2638941a9c5457b00deff4278157a549cc93
MD5 c516c10ab12c1f2c2914a0057f41f659
SHA1 587056c422dfdf5af4eb7e614830a55eba637028
SHA512 48d681180e3c9e7d152c511c4b406bebe99432d5ec69a3a4bd52164055e54cde3708d814ab7845ee3d66da54bba69b7cec391ab09af6e286548712d94ab22fdd
TLSH
T18FF0F9AAC930EC2714FD1B1970A9074AE79413672780985B3B3D560C4FF563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3feb49a780529e38cc95d76dce0cd3943d7a4479653ac9891d266c2f1e1ac2cd
MD5 47f7526d49b56d82f30593e71e4624a4
SHA1 0aabb7a256e384ffd97304261d5f0dc1cec2cf2d
SHA512 75e7c0de6711434f5f62ad0bc4b400a2b1b133388eaff5d2d9e0023e87a3a858ccde1db97af84dbde90400a1e02e567d4c9647762bfb46238b6fbc2785aa83d5
TLSH
T15F419FF3C3E8866DC91156F0BA187E2BCE1D0914832C3D5AC5E4AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6f748d5c01e62958c836cfef3a79c838427957e87350194f0d2ad24397d9e19d
MD5 a93fb825e4e103bfbfdb3b759387a62d
SHA1 ce3d21e825cabb4bace6d431129eb7ec9e199c5b
SHA512 c0b3efc4add95b9eb107bb31b53c52c7c0e4a58f10f544778700c9008cd1994e1395897105711051e11cfc9f35b7dc73185a24683e1e3a9d75f5fb6dd9b3c009
SSDEEP 192:sxZJRzyMqZjK1Ml8McK/fOs8LAxE0CXUyynDCzodpEq/W6+WNGY0dgWnf3IgjeJ:sxZJk0K/fOs8LA60Ly85n/bG5j/jq
TLSH
T19962D706AA34597B8CDBD309FA457F53D7F9157292904E44AAFC8B1C04E6AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8da1b5711394d53ba820194e2b123cd8303450dbed1f7e9830c49d69da2be858
MD5 c72f2edb09e7c62f2dc03c4f619db62f
SHA1 3b56d0343be386a0c7bb3da961eea1080027affc
SHA512 e54e53c26ee6955ccb11d3e65e915015b7d2d7c051808538222cabbc7750f50db8089980db74a2e377223efc8450c350d61568cfa3f076525d625d529495ff46
SSDEEP 192:sxZJRzyMqZjK1Ml8UQZcK/fOsrEE0CXUyynDCzodpEq/W6+WNGY0dkWnf3Ig5pHa:sxZJkqOK/fOsrr0Ly85n/bG53/f6
TLSH
T15A62E716AA34497B8CDBD319F6457F53D7F9157292904E44AAFC8B0C04E6ADC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7dfb657c2ea87b7f411bdbb0dbf8c41c814dd7c5a07e705035540ad3f435fd5f
MD5 6f3d5a420130d984300262fd40525d35
SHA1 c60b36beb0a248a0587baeb6b1cd14ad1e566b03
SHA512 a89386747fca4c2951d518a421f7bfa71c4a6fdada3b6d8b8b3033cc88dbf3ee67d4ab8ec010790875b300e37e0921f92f0af7e35e5224204e20b975cf89f91d
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3k3pQLl7:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKk3p8
TLSH
T191030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 54d6b9fc98a173f6d3dcd6187234abcd6156208ca0f67c6061e947be59c2c377
MD5 be6c22c5fb2819ee0aa737ecdc81c34a
SHA1 587ce12e8f0bb49bed452cf0893b7f872ce5aa81
SHA512 9ba0148a2f4e889db80b0f1825e3ea2498f65f919ad36fcda69642b60abcabeb68b09ad5d0e0f8acb3210be7ad093bed43c2d0d3efd59d1eb926ec69de5d3352
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7EL2:AFBHhTofhno2mB21q3Llbfe3sLDdeEpL
TLSH
T1EDB29057717B12423C3E290CA7929B770E8272A33458A56F77B800BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b802ed489a0809a116442f357e6256fa5f9b08dbd3516610fe80f94b264adc86
MD5 7493eb3704d09e72d0eb99a919b7993e
SHA1 1130637a29a85ff61e60a25afda17685d751b46b
SHA512 6e5aba84af149121b24ee43918674e6a8717363af34d847f1a6b4be1d26b1cd06414c75490f49aef38a363948a7a7c772e87ffaabd063746302e3d04f5c77095
SSDEEP 384:nciFKtNnNnb9I38NU8TUNTUlIRhytkfjGfb8o/8mkafBQCdOxnbv2AIx4+UMzRHU:HFKjZba3vwg97oV5fB4xnbv2xx4+Ugiv
TLSH
T126F2B3F198E78977D89E4B87A33D6E425AFCC163B4885A84B7C85D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1869dedcdfe2d89c789395c2eae69c95e4e17da626949bf28c3b1aa18e4b83d2
MD5 0703cd52ba768c404e3ebb975e66efff
SHA1 24b60691ca37697b7c88c5328d951d37f5165749
SHA512 b36e3e6e6825b90e8b6bb1bee586c66d5e14b46a478543005304e491be2c468658ac3e679e389fa48fbb643d783172af802817d7beb8359c68af9feb08799554
SSDEEP 384:npiFKtNnNnb9p38NU8TUNTUlIRhytifjGfb8o/8mkafBQCdsxnbv2AIx4+UMzRHU:AFKjZbb3vwgb7oV5fBixnbv2xx4+Ugiv
TLSH
T18CD25B32D825CEBBEDE79E89B34A7743AFE511A3D8885AD4DAD85E0D00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e42df62297bd0f4db0b609e2d833e1f4d63189ce8b254f3bc3f997f2ec83b0ea
MD5 eb71ea44544f8ac75c017191ea8a23f0
SHA1 6bfdbbda49d7ab4603fa09ef57e91715f1449fcc
SHA512 1d70dde6c631f1334affc1eeeb535fb370925f4e8d112eb044ade0cdd42b6d64068485996e24adf933add0b8838568f277595c871248e3e4078b0cf8038b8d75
SSDEEP 384:n5kiF9CcmyWCs38NR8TUNTUlIxBydvPolajGfb8o/8mkafBQCHVhkP+lFYS/1PHA:xFccps3KwgmEOoV5fBjVhkoFYS/6
TLSH
T17DB25B36EC68CAB7EDE68F89EB4A7603DEE01163C59899D4CAD81D5D008B1DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b65e704ae51fa6669c0eda18898a63a44662e6a5b73fa442dac1757c4c8c07a3
MD5 b9795cd0e8ea0a732882d0ae89fb4409
SHA1 2e3d0b0774c8df3044b3c73330b60167b4b916a2
SHA512 a9b081473405b6eb8c004df5d51b3d563a0df9b57e80f69f9491cd0101b88f4f27011db14169e8b87b753b4df00b38d7532b56fadbee486c617ec1c326e4babb
SSDEEP 384:n55iF1tNnNnb9u38NU8TUNTUlIRNy9ifjGfb8o/8mkafBQCdDxnbv2AIx4+UMzR0:uF1jZbU3vwgT7oV5fBlxnbv2xx4+Ugiv
TLSH
T1DED25B32D824CEBBEDE79E89B34A7743AFE511A3D8985AD4DAD85E0D008719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b1930665a2d16f53e1bc6e0ee5e50ef90b60f6ac99bce5fdd993d38c99427410
MD5 5a453dd0d0946f464a446c83f8cc8cf8
SHA1 045cfccc452761cc44d276d3b873cde1686367a0
SHA512 d31f5fddab9825beea4eb3fb1c0caaa7660b0c7cca1f3e3c90e31016ac3da30f62dbb453b711d77a68f174507e3d9dc45e5a371ef08b3d7a25b07392c2cd4df6
SSDEEP 384:n55iFKtNnNnb9p38NU8TUNTUlIRhytifjGfb8o/8mkafBQCdsxnbv2AIx4+UMzR0:uFKjZbb3vwgb7oV5fBixnbv2xx4+Ugiv
TLSH
T113D24B32D825CEBBEDE79E89B34A7743AFE111A3D9885AD4DAD85E0D00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 15e3741163aa7fcb84f6da33d24384e93efb3d114d5b4e4ab77cc12f1fa3f140
MD5 9891ccbad47817429f2aa9ab6bde45ff
SHA1 11575265302c9d662e162761d2f6a3a5ffa90497
SHA512 4a8dfffbcf679dfad3fdcc194bb16e722bc46a9144d376856e92ba70630b3f6fee720c06ace35dd09d0b3392ba0af1c1943601ee157d3442cd96b45f514c866f
TLSH
T17B413FE15C3D2AC2D0BD0E6F648B38ECC2E8C715F4A035796818EAA8093920D648187F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_344484189\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_344484189\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download