floxif | hxxp://discord[.]com

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 03:17

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://discord.com

Score

10^/10

floxif backdoor defense_evasion discovery evasion phishing trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000d00000001d88b-783.dat	floxif

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: 6633dd5dcff475e6fb744426_&@2x.png
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000d00000001d88b-783.dat	acprotect

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DB.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Ana.exe

Executes dropped EXE 14 IoCs

pid	Process
5072	Floxif.exe
4996	Floxif.exe
1992	Floxif.exe
1072	Floxif.exe
5044	Floxif.exe
916	WinNuke.98.exe
3924	WinNuke.98.exe
3408	WinNuke.98.exe
4284	Ana.exe
4532	AV.EXE
1364	AV2.EXE
4888	DB.EXE
3264	EN.EXE
2448	SB.EXE

Loads dropped DLL 5 IoCs

pid	Process
5072	Floxif.exe
4996	Floxif.exe
1992	Floxif.exe
1072	Floxif.exe
5044	Floxif.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DB.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
15	discord.com
19	discord.com
141	raw.githubusercontent.com
142	raw.githubusercontent.com

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d00000001d88b-783.dat	upx
behavioral1/memory/4996-785-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5072-784-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5072-797-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4996-799-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1992-841-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1072-844-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5044-847-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1072-850-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1992-853-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/5044-856-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000c00000001da0a-1022.dat	upx
behavioral1/files/0x000c00000001da10-1033.dat	upx
behavioral1/memory/4888-1041-0x00000000005C0000-0x0000000000653000-memory.dmp	upx
behavioral1/memory/3264-1049-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/4888-1043-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/4888-1040-0x00000000005C0000-0x0000000000653000-memory.dmp	upx
behavioral1/memory/4888-1037-0x00000000005C0000-0x0000000000653000-memory.dmp	upx
behavioral1/memory/3264-1073-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	Floxif.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3464	4996	WerFault.exe	139
1888	5072	WerFault.exe	141
3236	1992	WerFault.exe	150
1688	1072	WerFault.exe	151
1576	5044	WerFault.exe	155

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ana.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Floxif.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 615108.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 248337.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 448494.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
4068	msedge.exe
4068	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
2432	msedge.exe
2432	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
1028	msedge.exe
1028	msedge.exe
4888	DB.EXE
4888	DB.EXE
4888	DB.EXE
4888	DB.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	456	AUDIODG.EXE
Token: SeDebugPrivilege	5072	Floxif.exe
Token: SeDebugPrivilege	4996	Floxif.exe
Token: SeDebugPrivilege	1992	Floxif.exe
Token: SeDebugPrivilege	1072	Floxif.exe
Token: SeDebugPrivilege	5044	Floxif.exe
Token: SeDebugPrivilege	4888	DB.EXE

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3912	4068	msedge.exe	84
PID 4068 wrote to memory of 3912	4068	msedge.exe	84
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 1692	4068	msedge.exe	85
PID 4068 wrote to memory of 3084	4068	msedge.exe	86
PID 4068 wrote to memory of 3084	4068	msedge.exe	86
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87
PID 4068 wrote to memory of 2060	4068	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://discord.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8736146f8,0x7ff873614708,0x7ff873614718
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 432
    3⤵
    - Program crash
    PID:3464
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 432
    3⤵
    - Program crash
    PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:1888
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 400
    3⤵
    - Program crash
    PID:3236
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 396
    3⤵
    - Program crash
    PID:1688
- C:\Users\Admin\Downloads\Floxif.exe
  "C:\Users\Admin\Downloads\Floxif.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 400
    3⤵
    - Program crash
    PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:916
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1392,7176747761966403446,2481617547381718405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Users\Admin\Downloads\Ana.exe
  "C:\Users\Admin\Downloads\Ana.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\AV.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\AV2.EXE
    "C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\DB.EXE
    "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      /c C:\Users\Admin\AppData\Local\Temp\~unins5937.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
      4⤵
      PID:4312
- - C:\Users\Admin\AppData\Local\Temp\EN.EXE
    "C:\Users\Admin\AppData\Local\Temp\EN.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
      4⤵
      PID:2388
- - C:\Users\Admin\AppData\Local\Temp\SB.EXE
    "C:\Users\Admin\AppData\Local\Temp\SB.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2448
- C:\Users\Admin\Downloads\Ana.exe
  "C:\Users\Admin\Downloads\Ana.exe"
  2⤵
  PID:5040
- C:\Users\Admin\Downloads\Ana.exe
  "C:\Users\Admin\Downloads\Ana.exe"
  2⤵
  PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4996 -ip 4996
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5072 -ip 5072
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1992 -ip 1992
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1072 -ip 1072
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5044 -ip 5044
1⤵
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\symsrv.dll

Filesize
72KB

MD5
ccf7e487353602c57e2e743d047aca36

SHA1
99f66919152d67a882685a41b7130af5f7703888

SHA256
eaf76e5f1a438478ecf7b678744da34e9d9e5038b128f0c595672ee1dbbfd914

SHA512
dde0366658082b142faa6487245bfc8b8942605f0ede65d12f8c368ff3673ca18e416a4bf132c4bee5be43e94aef0531be2008746c24f1e6b2f294a63ab1486c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4af90fd5-c803-412b-b4d7-40d5a1dcaa6f.tmp

Filesize
1KB

MD5
ce939c3493c91b426a4b89f619935ac8

SHA1
4a9f73418ac7ba274ce40fe14aa66495d16b2321

SHA256
feb5dc94ef1812a0e66a4ba861b61e083f552e2b9d869d37eec9fc48afc359f1

SHA512
b93a90ef74cafb36f366e2a5f3c61e684277296d467ca2c64375c8b27e52d67b7358249eb2c064ed964f9ee49976e537f8b86b994e80457f4d0862384bf56060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58ffe6d3-8c06-4fd2-9079-566dc20c1b7e.tmp

Filesize
2KB

MD5
667d5aecd9322470aaedd1c3b5d8e30b

SHA1
1f92c16a262159397da0449aef8c138685c91093

SHA256
5e88bcc4e168cbbd746c77fd289c46a12651bea68dee5c9a7384bf06160909dd

SHA512
8ed573088353a1fc37a6997f0704c0fa4d8ce8e0192b047ecf7b3aecf1d193f7acb9bf226fe3341c46d28ecfd188e64e3db2fb816f2ce9b814888759e75beab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
18KB

MD5
7d54dd3fa3c51a1609e97e814ed449a0

SHA1
860bdd97dcd771d4ce96662a85c9328f95b17639

SHA256
7a258cd27f674e03eafc4f11af7076fb327d0202ce7a0a0e95a01fb33c989247

SHA512
17791e03584e77f2a6a03a7e3951bdc3220cd4c723a1f3be5d9b8196c5746a342a85226fcd0dd60031d3c3001c6bdfee0dcc21d7921ea2912225054d7f75c896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2e645b4df1d501eb0011d1cad9d6d0e8

SHA1
ca0aa19982b6c1d7c5b7c72a9be977a1b639bcdd

SHA256
d605ea22e6011e7750fda08d32bb9ef2b082855da5e69944206844aa328412fd

SHA512
e4b74c26875d121534d8ffb22f5c2d6e180b2e065865249b6e7eac8f723e1e191e2d59925ce1dc22d0f05f4b893371335a51487862db3275183414aacd6cb475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
6649b0eef2c77ac0883fb9e8e817eed4

SHA1
0b51dcdb9ccd2a3dfba5687d9b0f50c7117c1d2c

SHA256
ee2c1f4ca9f9a22a23b4e384d3896fecf22862b4ee0fafc949165bd3c7978395

SHA512
bc4929013372d99743f68310e1671e750dfc5e2b56871999055a31c168065981220867f55b82716b44960e7c8017331ba022c994006a4694d53156b86e3fde13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e7a0f9430c33c60b0b4222fcf06700f0

SHA1
316d40616a6a85361e8ac919469ce2301da15c4b

SHA256
8a4702e71a08e7931d4eb595fd16dfca59d2ee3160b43add35e1771ac0978af0

SHA512
6fdb831365771d28179d061b49b74e79682e824f58b05d9f5326fb080969eedbfe31519d3553d943f9b3e6d3d66c82dfe8ce05c407d77db931a187383472bb2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
eaba562317758cbeb17843f7b73e24dc

SHA1
b6aa6668c95a509faf6a9c3d4328c229f1d36374

SHA256
d958b51bd183382ea1dd1838b52dcd44c85a26d5c18fae3ece2305d1db95e50b

SHA512
27e70ea5234e961bad6b00b34ba872b744bdf75f60fcfbac4eb1411f28493258f5004fb7878308d234a9e8ee4764e81333ccff77e71cb051f95761561b2de2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6015dcc0ced10ab4de613356e61c1d80

SHA1
cdb3302a1ef04675b41df92324530b4914d72521

SHA256
50f59c922237d3977082ccc5307ae0a55e588a82ab43a997c8f115fa84e52628

SHA512
414a9144d5a017fa4612ef7b90ba2f359bf1559e44b9793db5576ba26517637866ba762669d46572fa51eb78de3357cdb257be3f0a5e98db2722602fe96f47cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
733c57ef96e00dad74b1765ee96bd0b4

SHA1
7178d79da5ee2fca9869b187f3a169b29d3bd77d

SHA256
ca8019f0f6e6932ee5195f1f0675fe9ac5a28437eeb79af1d20c5e3929a8a74c

SHA512
c939980369574cbef766401418754466a8531768b02905feca3371581792c072c2e1f37934c16a786d5dc05d078ff751263240343e7f9f8a8ea507220deb5589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e88242034ba6271e06a2d1c0ce5431d

SHA1
41af2f6ff72fafeeebe50beefff87eb2c487244e

SHA256
b251d2045e9a228d2df1e0407f9f3dad76dd699b6129f6a08d2c35b3de298be1

SHA512
54170c7e3989832fe170e913d6605234aa8acfb171d5dd3502cd72c5e796790507129753f664e53ae35a9d8846af2d756924efecd7b8bdab4b30e4a0ad2af877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3cba7b6efb61c1ec44d4a4f393777e66

SHA1
6cf24ad9ec24ed115bf6684886890738b4400571

SHA256
68f4e65e09f6152d125d3914d2ae93aaa94f5dbc8a9ed9f6c897197f5efbf7c2

SHA512
040459e293cec6aad78542d6a527a890c8d97ac4f30f31a0130b25c80bbc5c771c27dae37bf14ac65b3eb7fc7c195e9312cb2be3639e1c10aec372faf01fe68f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed09452a2ba3d088b43017120a09e7ed

SHA1
3002bb6d4a7de94d768cbd85d58b8991ab7bc126

SHA256
0d4c8ac73d5fa7bac11af43cd1c817b691eff8465f96e61af4b6fba6805eac21

SHA512
d350921e32271cbcba914741f0a78f7018fa549700981c30ff15618f0f0acdde71802e22ae8b071189d2eab6234a4bd83f700dc2b5dcc72a1d0b8e06d6ed4dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3e794d5d64e9ef183c66c974dfca8e89

SHA1
12ea1193cc62d9d66013e757f0b6d7d29712cad8

SHA256
a686c8877043f0e97c147bbad09c315e9cafb91cbd11e25cbadbdf84e5185bee

SHA512
edbf623b800212ee5044d32c76efdb0716509d06a9d7ff158daf6ac681e3f5c32033ea1f95d407027ecaa93465b6fdd11b4d7c0be7af8f5e031ab81020be7d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
804f2725a4db0c909af0948d6649f7f0

SHA1
6ed05862d8268c315cc19fd65ac3cf49eaaf3266

SHA256
a21cc33b5e1bf852f57e8c6c60efbf5a0d11b03fa93c4732db01af9693c78b4c

SHA512
330ee0331de4b66fe7cce6b760a126a67afdfa6c47a4fdafc4d05bd77429638051f4c2d533cc3528c86de0d02950c4399f159350106dec3840353960d0656f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9cb550ec31217440051233f61829210b

SHA1
f83e2f08298f995ab0855c350826456269537065

SHA256
8b36989dfa3b2faad58dc844df2bddeb9d6974d28b2c9f46e25fd1a0ed2c8a96

SHA512
40a6a4355111ea042fa80dcb238654c05facaa6ce4abc8457ef3923378a6df951f0ddb0b70e79418bd33ace7164b49a1e832e809d8abdea511584760dbbf141a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
898e20a4037855e28409bd15be02cef9

SHA1
16732f59906305c575764184a64fb8ba34835d76

SHA256
162098a07fba02925525c22cb9710f5f93abbc82fdd6652ae296ae34eb0486cd

SHA512
cafac47e1fa90f78505809ccd27c454a102f797ed7f080530a6625f77543bf93fccf89d900b68139c727f5cbbccb9b8eb62d9da932a1f72d0ee4b10e89b77416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e3bb9eee17406d7a85a016b99ca6267

SHA1
0d930438b08a8a5d8d2aefee7b955815c33caae8

SHA256
51c7a715f5745be7d335039c41ece6d59e070ce0a52842d8697d2848f65142b2

SHA512
983dd93f16aa4ce652daeeadfe27e9d7a533179b0fdce4a3a0d9537573b0e9b1d27835e3e101e25cab2804e313812d39f6543d564a786349396fbf761b4310d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
63178973c0434c83fb6646b503345a09

SHA1
da3452c4647b73a0b56c56eef2ae375409263e5f

SHA256
97a7b1aec3691266c20ac2b7ebc26a082ac4896946553a175dd38e8414991a7c

SHA512
c860cc29ce9cecdbb8e0ab9b4bd0816b6eb9ab24fa82ca9f1293315d9802efc80454b1d6f3c4a6a799d9a4c34f094b670ff000cb3c7f5d8f7bd9e252f4e0a5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9c13716e9090c924091665680edf03a6

SHA1
01d54c223d4a043da1eda73b2d604cd6e3b6d24e

SHA256
32e0df5625c321e34310e2ae697596817bd30aa2d4df92e8b56ff11ab7ec5e1a

SHA512
3692b1b022fd4bf910a003fe2d8f8d6b92a36fa4cd4673417b5cd11bca0c763c90c2c61aecf4b62d49a78362bc57b3c70f3135927da67a232a2e3fa139409123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581db4.TMP

Filesize
872B

MD5
b0c72e40c99f2c10d4e0358f7b64072e

SHA1
9a43c2d3e91f5de3c4a90f4fe478de2fa5540b76

SHA256
d4e0e6d8c0a8ea4fc93ca3dc60e08470fb7d9f9bef6a49bed074eb96dc6cdecb

SHA512
c38c78eb97f117b15145ec0e21632b1bfe12ce9e5f6f7d52d808fbb9429fa141b21ee7d747da730c9e4e1fc796273ad6763bb87c9cffe6b31307764efb381ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
05e8d77af651a3fdc727c024aeb15d18

SHA1
3ad8ba9e191af19e48eff4d6d83f44be828b6854

SHA256
e9eaf6d4c7da2660cc5c623f96bcb671501ed47651f393c4b84d8d497e45808a

SHA512
17f0038165ce6a6bf288d52aba7c16ba09f9235b2043abeb344c2115a031f2a10d0647a981c45c6a82d5a7a30bf5c1c98214d072a8277f41697a313063f10223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e6d9efffd889b0d9749fce63eaf6804

SHA1
73a5ae53639900e91e94ba021a882c508364b41a

SHA256
8ece7ba78b83c382fe7c3ea3b9ffa6f593a8ae1947625dd181fbbf6eb7690308

SHA512
775f4e8ed8a62af9ec7a7a36fd447d9c9d1b8fe3d676eb86c4de96873945e8eef43865625dfb6248f0552ecf92f5473f6088e1fe1356fd9c4b6c7b8d6562fc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV.EXE

Filesize
1.1MB

MD5
f284568010505119f479617a2e7dc189

SHA1
e23707625cce0035e3c1d2255af1ed326583a1ea

SHA256
26c8f13ea8dc17443a9fa005610537cb6700aebaf748e747e9278d504e416eb1

SHA512
ebe96e667dfde547c5a450b97cd7534b977f4073c7f4cbc123a0e00baaefeb3be725c1cafbfb5bb040b3359267954cd1b4e2094ef71fc273732016ee822064bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE

Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE

Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE

Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB.EXE

Filesize
149KB

MD5
fe731b4c6684d643eb5b55613ef9ed31

SHA1
cfafe2a14f5413278304920154eb467f7c103c80

SHA256
e7953daad7a68f8634ded31a21a31f0c2aa394ca9232e2f980321f7b69176496

SHA512
f7756d69138df6d3b0ffa47bdf274e5fd8aab4fff9d68abe403728c8497ac58e0f3d28d41710de715f57b7a2b5daa2dd7e04450f19c6d013a08f543bd6fc9c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE

Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 248337.crdownload

Filesize
2.1MB

MD5
f571faca510bffe809c76c1828d44523

SHA1
7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

SHA256
117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

SHA512
a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 448494.crdownload

Filesize
532KB

MD5
00add4a97311b2b8b6264674335caab6

SHA1
3688de985909cc9f9fa6e0a4f2e43d986fe6d0ec

SHA256
812af0ec9e1dfd8f48b47fd148bafe6eecb42d0a304bc0e4539750dd23820a7f

SHA512
aaf5dae929e6b5809b77b6a79ab833e548b66fb628afeb20b554d678947494a6804cb3d59bf6bbcb2b14cede1a0609aa41f8e7fe8a7999d578e8b7af7144cb70

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 615108.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\tsa.crt

Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
memory/1072-850-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1072-848-0x0000000000DF0000-0x0000000000E65000-memory.dmp

Filesize
468KB

Download
memory/1072-844-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1992-841-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1992-853-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3264-1073-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3264-1049-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4888-1041-0x00000000005C0000-0x0000000000653000-memory.dmp

Filesize
588KB

Download
memory/4888-1037-0x00000000005C0000-0x0000000000653000-memory.dmp

Filesize
588KB

Download
memory/4888-1040-0x00000000005C0000-0x0000000000653000-memory.dmp

Filesize
588KB

Download
memory/4888-1043-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4996-785-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4996-798-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/4996-799-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5044-856-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5044-847-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5072-795-0x0000000000520000-0x0000000000595000-memory.dmp

Filesize
468KB

Download
memory/5072-784-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/5072-797-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads