hxxps://github[.]com/RawAccelOfficial/rawaccel/releases/tag/v1[.]7[.]1

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/RawAccelOfficial/rawaccel/releases/tag/v1.7.1
Sample261107-nxeeeaxt8n

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\rawaccel.sys	installer.exe
File opened for modification	C:\Windows\system32\drivers\rawaccel.sys	installer.exe
File created	C:\Windows\system32\drivers\rawaccel.sys	installer.exe
File opened for modification	C:\Windows\system32\drivers\rawaccel.sys	installer.exe

Executes dropped EXE 1 IoCs

pid	Process
4164	rawaccel.sys

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{EE1A3894-BA4D-4AD8-84FB-80C53DDDE0A2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4188	4736	msedge.exe	84
PID 4736 wrote to memory of 512	4736	msedge.exe	85
PID 4736 wrote to memory of 1384	4736	msedge.exe	86
PID 4736 wrote to memory of 1384	4736	msedge.exe	86
PID 4736 wrote to memory of 1384	4736	msedge.exe	86
PID 4736 wrote to memory of 456	4736	msedge.exe	87
PID 4736 wrote to memory of 456	4736	msedge.exe	87
PID 4736 wrote to memory of 1104	4736	msedge.exe	89
PID 4736 wrote to memory of 1104	4736	msedge.exe	89
PID 4736 wrote to memory of 1104	4736	msedge.exe	89
PID 4736 wrote to memory of 5056	4736	msedge.exe	90
PID 4736 wrote to memory of 5056	4736	msedge.exe	90
PID 4736 wrote to memory of 5056	4736	msedge.exe	90
PID 4736 wrote to memory of 3728	4736	msedge.exe	91
PID 4736 wrote to memory of 1824	4736	msedge.exe	92
PID 4736 wrote to memory of 3728	4736	msedge.exe	91
PID 4736 wrote to memory of 3728	4736	msedge.exe	91
PID 4736 wrote to memory of 1824	4736	msedge.exe	92
PID 4736 wrote to memory of 1824	4736	msedge.exe	92
PID 4736 wrote to memory of 5084	4736	msedge.exe	96
PID 4736 wrote to memory of 5084	4736	msedge.exe	96
PID 4736 wrote to memory of 2952	4736	msedge.exe	97
PID 4736 wrote to memory of 2952	4736	msedge.exe	97
PID 4736 wrote to memory of 204	4736	msedge.exe	101
PID 4736 wrote to memory of 636	4736	msedge.exe	104
PID 4736 wrote to memory of 4788	4736	msedge.exe	105
PID 4736 wrote to memory of 636	4736	msedge.exe	104
PID 4736 wrote to memory of 4788	4736	msedge.exe	105
PID 4736 wrote to memory of 4788	4736	msedge.exe	105
PID 4736 wrote to memory of 4132	4736	msedge.exe	106
PID 4736 wrote to memory of 4020	4736	msedge.exe	115
PID 4736 wrote to memory of 3252	4736	msedge.exe	116
PID 4736 wrote to memory of 4936	4736	msedge.exe	117
PID 4736 wrote to memory of 1744	4736	msedge.exe	133
PID 4736 wrote to memory of 1744	4736	msedge.exe	133
PID 4736 wrote to memory of 4956	4736	msedge.exe	134
PID 4736 wrote to memory of 4956	4736	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/RawAccelOfficial/rawaccel/releases/tag/v1.7.1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffad3ec188,0x7fffad3ec194,0x7fffad3ec1a0
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17145343010078279120,13237731164505917921,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16644567621850627255,6206648032651905549,262144 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14684258035051010481,17336948635755899757,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4336458996029685814,16779351963883326360,2097152 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9000576061745807497,2071952957103100314,2097152 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,1531010025114046718,8609640881168194521,2097152 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,6793800778786067636,374919092650735912,2097152 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,13987256550767647367,16481682942802691942,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,15247625572629954376,13957375914641558885,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10388202955612404063,14944247341064758304,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,10388202955612404063,14944247341064758304,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,14264028552873108155,11470443374505369896,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6352,i,12112315008947928030,10299351397414381756,2097152 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17887108876398254930,3810999605722825556,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,12264780383056001058,13432324697900372436,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,8083449293303061607,16258848552898096210,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,7468076757705691732,17708854174721916291,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,16641093769743833565,17851313286096838347,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,8940975692911785570,17325868746707704954,524288 --field-trial-handle=2156,i,14502346319203853638,746839424739064815,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4168

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe"
1⤵
PID:4372

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\installer.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\installer.exe"
1⤵
- Drops file in Drivers directory
PID:4240

C:\Windows\system32\drivers\rawaccel.sys
C:\Windows\system32\drivers\rawaccel.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe"
1⤵
PID:1624

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\installer.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\installer.exe"
1⤵
- Drops file in Drivers directory
PID:4816

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe"
1⤵
PID:3392

C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe
"C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\rawaccel.exe"
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69428964-f8fe-4b51-90dd-01441bcd9016.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69428964-f8fe-4b51-90dd-01441bcd9016.tmp
Size 18KB
SHA256 b8fd1f2053be01f938d1a6049fa26e5d5255426c807243709517437c47a13258
MD5 c028ee7c7b7687a0c764917c8f1c3b0b
SHA1 b52621c8e953e102860128916507e089ff4a0431
SHA512 be07a259608f00b68128789688b4a5f62e16de6572bc01d9c9a1857656a1176dafb8d8a80d8430e5c023c37050ecf6b98273aa5e8512cc06c1746b91aa3a3d04
SSDEEP 384:HQkUSvZsNdOSCuQp8up5u8iNLSaH7vBEnI3IIl/:ZZphhkkaH75ESLl
TLSH
T1CC827C36B86CAC3B5DE3A514F54A3613AEB4856BD7D81F80D5DE672C01DE1D8230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72d73c75-72ef-4524-abad-dcfe839e62c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72d73c75-72ef-4524-abad-dcfe839e62c1.tmp
Size 18KB
SHA256 3c4de7211def1a3b33677ed7ead3877486514d6bb684cd12803bb08d0255e835
MD5 2f7777f49761607250fb2fdc67d5c8e5
SHA1 6237afead57d16081b960364b857443c769ea82c
SHA512 3630f2ffa8995019aee1d48681ba0d4302f2f80d38c660faf2be4b214cd358b15808f5708b160e5acefc95827f8f2f5d40d485e34f76c952736d4cf790a583af
SSDEEP 384:WQkUSvZsNdHSCuQp8up5u8iNLSaH7vBEnI3IIl/:2ZehhkkaH75ESLl
TLSH
T100827C36B86C6C3B5DE3A514F14A3613EEB4816BD7D81F80D5DE672C01DE1D8230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

780ce2e3-97b2-4371-9bce-e517edebbd62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\780ce2e3-97b2-4371-9bce-e517edebbd62.tmp
Size 30KB
SHA256 82b617ac03387a7539fca7a8dfaf078d53ea1fe2441320f52befd241c295b36c
MD5 22688e7ecd98c5561db9e9b7d5658821
SHA1 2cce20ab327241aa89fbad2b78f31933f7d45ede
SHA512 3fce85675a89fbc5783f5cf802dc9476b57adc345859443f078f7a19a93e746ac69719548ec237e56c2c3db4ed7028245af100f94fdad48d7655fdb5d8a9e2fc
SSDEEP 384:eiFHQkUSvfOsNt8TUNTUlIlHSCu2t8up5u8iNLGnZ0vKASBjwdszkLEH7vBEnI3x:1FZGwwgTHhkAn8tSNzkLEH75ESLl
TLSH
T181E25CF198D75CB6C4AD9BC3A73DAD02AABCC167B1945948B7E4652CEC4B0BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6c603c48bad8cf6fc5bfa1901589a53022a5c1315888da77b07a5c7516687a5
MD5 4fabfb1f7d070458e2895ffec233ff43
SHA1 98393503bad4d9db97f3ddfbb3e45d91868d9978
SHA512 8d103d2ec672aaef277a945b102deb58448c812a35ac148aeabfd0c6f3a0f02507510d1c81989a1842eaf658c9190a9493eb0148dbc239fa99fadbb1108ebe40
TLSH
T13ED0805474663DFCD16E71355415CD405744DF53E1021755160B4C15D5501C61CF1EDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

1aab9e9f-ee7a-4cc0-b8d6-caba0a750649.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1aab9e9f-ee7a-4cc0-b8d6-caba0a750649.tmp
Size 10KB
SHA256 d33ad8580f0c364dcde75e71521df4b2f144c92e8de4bbc2f8dd0885d3147341
MD5 fa60765aa0d26b372bcce7fa46729c3a
SHA1 98519a8306600218355fad8014c92dc49eb02a6d
SHA512 d0c9dc8568c761da54cea41d2895a5a0040ad85668510cfd7a302b2bd06b3457b7a5a19d40e4ccf80113f7cc4b3ba5a2bc3110586c0db64a7637fea1caf75351
SSDEEP 192:sxZ4RDnE/fAsoNrVIdp91XHW6+WNYw48/YahDhgIg5IJ:sxZ4RE/fAsWrmPHbd/gK
TLSH
T1E532B6527E28657BCCC7D21DBA59BF53E6F9503195D01E48EAFC862C00EA6DE234740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27d657c8-a882-4662-afab-f8f5001844f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27d657c8-a882-4662-afab-f8f5001844f0.tmp
Size 11KB
SHA256 2ccb9fbeccc03a080a4c3e572837eb7f6cd3160cfaa78cb0effe5d81b8047128
MD5 899b6928212a56320dec0e0d5d1d4fa1
SHA1 8745708e4b94d22137191f7b64cc3ac3e2162d4d
SHA512 aaaf41367890ed2e63990d53fd865e5e9a1c452fd667683f950e8d0fc72cf47469a356f7c5f9d7833fe5d893e809f47c028ed0a22b0ffd319a363aa5d2f5b87a
SSDEEP 192:sxZ4RDnE/fAsoNrVIdp91XHW6+WNYw48/YaYRhgIg5KJ:sxZ4RE/fAsermPHbd/RI
TLSH
T1F432B6517D28697BDCC7E20DBA59BF53E6F9503295901E48EAFC862C00EA6DE234740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52ec55d3-63f9-46af-9bcc-f8c209557019.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52ec55d3-63f9-46af-9bcc-f8c209557019.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91175879-b1ff-464a-8b4a-ea13a7401360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91175879-b1ff-464a-8b4a-ea13a7401360.tmp
Size 10KB
SHA256 b989d9bd1ea6a6462c753c84d3d500e9308671eb0cae22b34fc42998d4e8173f
MD5 b32d1caa3c1512cc89afb316b8dffaa3
SHA1 97ddbb708ef5a94398ad2e6a72c64102ff2d8fb1
SHA512 775d6cd9336db222226df414e9d9faf37ea793176ae755603efc368ee9f5659366c3662f0b6c7d0296c5efaddf06a20483e40cc5121a11becaea3be811dc31d5
SSDEEP 192:sxZ4RDnE/fAs4NrVIdp91XHW6+WNYw48/YahqhgIgqJ:sxZ4RE/fAsGrmPHbd/Bm
TLSH
T14122C7526E28A57BCCC7D20DBB59BF53D6F9503195D01E48EAFC852C04EA6DE234740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 437f219fc06dce803ee644124eb4447516da9b340c820a19e34a4efdbcfee1df
MD5 be6d12c674511a34d97a5ac87bbfd0f8
SHA1 4d8b674b33ded22a09f8360c858b86940a4b089d
SHA512 213ff1d12001fc09d9ffcbe99338ad839e1480c7a5c28eefcc4366627a32d4c90975b51f96ac95468e2501f9435a79e5e489e714adb4b96d945de0c7f4021b32
TLSH
T18AE0208C25CCD63F511C648742B4530D81E5361A93C0AB1D2F14CC5C71464416689E70
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 9c3bb63a86d8d89d9b9bdf94e3acb4276a6b1e4580cd2550ea8a1ca3d7cc66cc
MD5 2e2d5c8fdff8d75634548668502ea31a
SHA1 62eb7d4348c7fd838027bf2b7545e2fd0d880c17
SHA512 1e10a182b84e9325a7b43537ee67913c681fdec61405cfe9ef6eb712ede2bceb61b5eff6d72f65684f4ce4ea1b71cd022e1e417abf04ab067bd10985a6b4a814
SSDEEP 48:2id37TVyfmZltXdfagrTtJp/mYT7FDtSCZFxqiCkyaDU6BxI1BFPJYmSDroj/i:Ld3Xtlrygr1/mYfZYsHZDLA1bJYmi
TLSH
T11C914F45515CAB57FB99803882E17EBF3570A4C244A38F5E3059FC392CF6B487A9C808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ca818a4a03020204b2fa0201023a32116f96ce04ae252c576f35c1de8550cc3
MD5 c2e54eb448ef41a61b33be07ec092066
SHA1 c7b5a136d1cab735453625f8096f474d90b58291
SHA512 f3e783f601dda02dd9ba87af80500d76f30cf05fd84f4aaa03e2db8dbf68af92936a71cafa46c3ddff8c65853cfd63d347fbf882b01e57d0dd6e7738e3158c79
TLSH
T1EA61E84591A00F5BFF98403992F672BF3674A88288C3DD6E30A9F8795D5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 c1a10c871f95a567f495ea2b223fd19d8861a6ef5d923b7e01cdd21203ac834e
MD5 2ff538475435504f6c3283daac255b2d
SHA1 e463a6e05d1625b696f58aebe9bb4606279c6589
SHA512 ae658ff87b55046cd03ae18a746d6aacbf9e3f80fd09312b67700b868bc5a930db9e108a87b13c6053788f4a5cdf6bab5f8ae4c10a3164b9790e4907ce05a2b1
SSDEEP 3:MsEllllkEthXllkl2zE/l/IY1:/M/xT02zm1
TLSH
T1DE4404047FC41C07C503113054F5C3711371D470471357C3345104777CC5F400C04041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85883210-f22b-4707-8129-f39337e12d4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\85883210-f22b-4707-8129-f39337e12d4c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

12fe9472-641c-4f8f-8468-cc41d3e1c682.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\12fe9472-641c-4f8f-8468-cc41d3e1c682.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

288f740e-9f8b-4a9a-9068-07237297cc81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\288f740e-9f8b-4a9a-9068-07237297cc81.tmp
Size 2KB
SHA256 d16039deafa9045688397875d83f05b7334bae623515d149371318ef70a6c728
MD5 039cf0956ad05d5bd0321ba6de317e08
SHA1 70ceebfa90006c4f713d7bc4366b503e5df58506
SHA512 bad78d38dbb1c41d54cd6545b5df2fde673d7e6e613e8d3e4ae9ae2c1515cbfaec53e46883a5f274bb24675730a7f83001c9fd9e82279cd0280f46416b608a55
TLSH
T18641ACF787E2956D9A025AF0AA08EE1BCE2C0111831C786989E0BE57D3E3871E04275F
MD5 SHA1 SHA512 TLSH

Submit Download

7a6e7e04-c3eb-4215-b5bc-462646a1adf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7a6e7e04-c3eb-4215-b5bc-462646a1adf9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 62a9bc69011bd810f4ac33dad9543f3287d403f52e1c4ebb86e76241ce0aae1e
MD5 10784fdf33d63ca056c0ffd8e65c530f
SHA1 64e2091fe336e24ae5e7e0d04c0716696cc873a6
SHA512 ac924ddc7279242f981ba27554659675354c8865855f499dfa8f81d4cfcaac9d5d6f9915aa33eebe2a37b96269d1569db147d1381f1bb39624fdd8f8b48594f0
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyL6lI064I5bkjUISY3I5KkgU7yVLINKX:KkyAKvqe2dO3qKkgaWLiKcUl
TLSH
T134917314706B02A03A7E296862B8862B464535B33119F57F7FBD84A64E6FE110CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e19e1024-e75a-4aaf-ac37-71862a471c21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e19e1024-e75a-4aaf-ac37-71862a471c21.tmp
Size 27KB
SHA256 c5556567a5144477854362faa146bd080b573a9b1d51e9c79d583145f3729b08
MD5 e72d0024a787f0d63f4507b4089e1916
SHA1 416692f36b7061d5b89a58cd7293eab0700790d8
SHA512 b08bbfc2ac00c9dbca1d9c267c963756bd3368779549523ddf11354380d4c0d655fb2a77803a0ee067159d2b0f40c070f3d73ea823e3ba60e75fb577cbe00e8c
SSDEEP 768:CvyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3Bro9ZwO:CvyQRbrWvvlpZu1jaXKLf3369ZwO
TLSH
T119C2EA2B640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4ce7084-0206-483e-9cc0-5a9b633404bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4ce7084-0206-483e-9cc0-5a9b633404bd.tmp
Size 12KB
SHA256 66e3286ef8b48ce2898877905f3b6d6471791cd5684ca2266476ddfddff291e5
MD5 438fca0add9c27fb21e1026fef6a0a53
SHA1 9606070d30d06d286e1dd40ebcd407e0a535d6c9
SHA512 2f1bedf9d592ad349ea4f5f4e888cf1e6f22cc9ca0c8af0da52845145c654680b85ff83ae93d56927a1890dc7ca7bdf397664fd7b866d9462a42d0123e2b619c
SSDEEP 192:sxZ4RRnE/fAsLWpVlNkVIdpv1XHW6+WN09w48/Yee+3yIgbKJ:sxZ4DE/fAsLWvHkmVHbp/Mq
TLSH
T10E42B6526D28687BDCC7D61DBA59BF13E6F9502295D01E48EAFC892C00EB7DE234740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b2a3b64e-494d-4830-8cd2-562c8ed5d481.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b2a3b64e-494d-4830-8cd2-562c8ed5d481.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1015ed4aa6b7b5eed02e1204c1843d20873ade9e9e2b512a9bd547ba8e9cc171
MD5 c55c7967f26e2fe57c0620ae6c5c18ae
SHA1 b5598c1761cbb4ab93281b064a4ed9b45b26adce
SHA512 3b60b44d2294eab782d1acf26f79c9a2ddf50b7d2c6a2ee1057c14d3a412e8af2c58563725f9763646085baaa1da6862b3b20c172582208956baabceced0fbcf
SSDEEP 384:rQkUSvZsNdSSCuQp8up5u8iNLSaH7vBEnI3IIl/:lZ5hhkkaH75ESLl
TLSH
T182827C35B87C6C3B5DE3A614F54A3613AEB4816BD7D85F80D9DE672C01DE1D8230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad3d30dc-0b46-45c3-9320-dd7ea18906b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad3d30dc-0b46-45c3-9320-dd7ea18906b6.tmp
Size 8KB
SHA256 35ead08988f7968b62786c38471b911db309d5f098fda2103a90cca6083084a1
MD5 7cf0a208196c071458ff106eb598a215
SHA1 d7d93f0ea0c96ea08bdc83cb6843b0a128c7002e
SHA512 29aa9a246b03b0d75f01b530af2cf1705313062e2e7ee61626fedb80062588a8802cdc621ea08b4a294030ee942e0e2232f1871b07a976a0074cee0160407794
SSDEEP 96:PqONkwQsjpfwDISp5ih/cIPURHl8h4otop5ymDkBfPGxvw45RxmJm78lFOxVeYuc:SONU6iDCQmiUyVIHq5u88PN0SqCBxsU6
TLSH
T17C02F838BC687CBB9DE3AD09B44737179FA4113BE7942F84DAE81A2C01D769C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

223e2bfc-a471-40ea-97fa-4594873ecd64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\223e2bfc-a471-40ea-97fa-4594873ecd64.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f322c908-f15d-4721-9094-56aa213ed6db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f322c908-f15d-4721-9094-56aa213ed6db.tmp
Size 8KB
SHA256 4cda09ee82e2b15134e4cd733b35930e7da3f73ebb360c421c90c0fcc1218ad2
MD5 5862516b8df47287b5643905bff8105a
SHA1 2bd18140844827ca9540422e4c674329650718f7
SHA512 1e60df28dd37f20fed07fa8be81639b9771ab9aa0732c03c916c20c86c9e6bb05ef0c1c00784f304e71f9576c256fadb758a0557c785b53da95a612ac945dbe3
SSDEEP 192:OONw6iDjQmiUybIHq5u88PNLbetUuZaqiU6:OONw6cHHq5u8iNLcaU6
TLSH
T135121A35B86CBC3BADD2A955F48736139E64417BD7886F84D5EC2B2C01EF59C230B512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f13af4a7d970bba3787285b3a7f6c4fa897b781d76ea754ca6f1b6d017194f20
MD5 8cc44deedf90687e4cfae53849cf2da2
SHA1 45dcc322c3fd2c1c41c122a486d0c8d215a7c4cf
SHA512 7d4361ca6d75e6ce1f26d7be09410cca63656f2dc2ba42658d5d9400c4755b684737200d81ddd12f16d78c2e9d7fc27edfbbb82a4e65653b120877067d1c8552
TLSH
T1E741F65CA6E90148B3B77F1A9BF694AD487EB8332F47906D10110D4E4A62A40DD61B37
MD5 SHA1 SHA512 TLSH

Submit Download

6eabde6a-b1e5-400d-873d-5850e871b6ec.tmp

Path C:\Users\Admin\Downloads\6eabde6a-b1e5-400d-873d-5850e871b6ec.tmp
Size 15KB
SHA256 fcbf548e1ef035db683ffc3273687a06c99e549f2abddf90d4fc63ba7757ca4c
MD5 eff016f29a8917b29971071d13b3548c
SHA1 689452a1113ad032d913aa894b56d7ec09bfcf62
SHA512 9c098eed1de124975e8b2829c4d84afb3f46832017b42e01435094b551e0d4c07485509fdccde620d5100993ad203400ade505d16b9d1a3a812a6f3270199a2b
SSDEEP 384:CuDpjlOlI1eNZkV+zNA0FO5TQtfFxcpifMDSiGhi24:RjlKI1oO6FOhQPxyiUil4
TLSH
T16F62D0B6C9DCF440C49F80F97A07D8CD90A0B8BE07AD5D911D49CAE0385E1A2BDFD894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RawAccel_v1.7.1.zip.crdownload

Path C:\Users\Admin\Downloads\RawAccel_v1.7.1.zip.crdownload
Size 1.5MB
SHA256 770fe3ae0919ca3c4d412f58c985eb27f5434decad809f7e8206de4e8852eec4
MD5 7570c4c1509aee407944768ac0dd4e1f
SHA1 31ed019e6b0ad60aee633418222819add1ab8f9d
SHA512 804606a77223cf49b70d9cdd2815e08f3df4e83442d276193ce1dc993b73d023b7a52292952d614d8afd3b211a60609b52dfb611638c6bd6284285dbfd2c844a
SSDEEP 24576:hD5/zT2VD0CoxaHxNoC8y6t7T+iowffZVsa3vU028C2TZU4EWktUctDB:dRT2V/owxOCl6t+U3ZVsa3J2r+49FtDB
TLSH
T19965333A87E6A001F48217BADA5F16336367FABFB90B5518404C25D3BCB5A42D1FEB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error.log

Path C:\Users\Admin\Downloads\RawAccel_v1.7.1\RawAccel\error.log
Size 168B
SHA256 385c656d1e99fe782859129ce8aa3e225d7f9ae50a019a51cc58742b9307b75d
MD5 27bedd4125fccf41dff9eacf3816840b
SHA1 e48d1452d80eda90404023856510cdf3168aae80
SHA512 81481b51e50d5fbb70888c234e62885d62d5957e2483b8481a01fae470d0561f2db7745f418acb4220cc8e92cd98f53bf699b94bcc009222a40ec08b06be1e35
TLSH
T1FFC08C8CC98E042064A302FF59A32E2CD2E5CB463127A72BA079110FBE7604443E7BC2
MD5 SHA1 SHA512 TLSH

Submit Download

rawaccel.sys

Path C:\Windows\System32\drivers\rawaccel.sys
Size 55KB
SHA256 8a62c4deef2774b43a7363b352eda79897533a1080c9c26ffeff0559e43358d7
MD5 3b322b9a39f3938154e0391207b51de9
SHA1 68e400e0a24d43260fc476af910af945a239d8cd
SHA512 5b39818f84e25e3e0e31ff08eb5b02d8850bace83711fe0e51d49c073ea04635e1f186ece37dd5da02d3e12aef08914900ada3c0c0aa07c43a3a77d24eabd8f3
SSDEEP 768:s9hrkpOcCNgCfikstkNlGHHcnCHp4e4ExHtq6Cbf2Q+IRNJ4zbln/23xds9zgrE:urkspWFHwCHPHoUqNJ4zbp/2Bdkz8E
TLSH
T118439E56619922D6C432583096FAF963BA723501137488FF07E0CE290E7BBC1AE73667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-361-0x00000223044D0000-0x000002230454E000-memory.dmp

Download

memory/4372-328-0x00000273CB390000-0x00000273CB400000-memory.dmp

Download

memory/4372-329-0x00000273CB810000-0x00000273CB88E000-memory.dmp

Download

memory/4372-330-0x00000273E5C60000-0x00000273E5E06000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads