b26ff295348e964b2f119d7cbd5d2d41b4c044bdb770fd264df742fea792bd73

Resubmissions

28/05/2026, 16:28

260528-ty4ctaf1218

28/05/2026, 16:28

260528-tym1tsez7p6

Analysis

user interaction
yes
max time kernel
28s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
easy.lol temp.exe
Size 53KB
Sample260528-ty4ctaf121
SHA256 b26ff295348e964b2f119d7cbd5d2d41b4c044bdb770fd264df742fea792bd73
MD5 c4b784aac82b0058b5d1a53a2b84be6a
SHA1 06602abe3e3fe59986dabc6b1520a1a27ee09d37
SHA512 55d51fb1e0e08a0c22290c4066561da584c3505fe2b4b412294ed7e1a424e3b0fdafb42b8b7587c0a4914a11e4bb7e7874055c41445205642f6251482b1e98cd
SSDEEP 768:jjq1sUROCz8mhoiTb0oPXLSKg3kq7XNPalVFrdCriXg/fJ8jHLl:Hq1sU4+8WXP7SKg3D7k9Yrj/kl
TLSH
T156330A27DD6640AFC3698D78C5634905DE32FC878B91B6CF93811DE60D26AD49F3EA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
91	1504	easy.lol temp.exe

Executes dropped EXE 1 IoCs

pid	Process
5864	crazyalso.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	discord.com
58	discord.com
27	discord.com
28	discord.com
33	discord.com
38	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244593469760389"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BD867D3F-0541-4EEF-A7B2-3A6EDFD58FD1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BE4C64BA-E589-4A1A-8F5B-6C8506D668D1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2376	1504	easy.lol temp.exe	89
PID 2376 wrote to memory of 3328	2376	cmd.exe	90
PID 3328 wrote to memory of 1276	3328	msedge.exe	92
PID 1276 wrote to memory of 3372	1276	msedge.exe	93
PID 1276 wrote to memory of 1536	1276	msedge.exe	94
PID 1276 wrote to memory of 1372	1276	msedge.exe	95
PID 1276 wrote to memory of 1372	1276	msedge.exe	95
PID 1276 wrote to memory of 1372	1276	msedge.exe	95
PID 1276 wrote to memory of 3668	1276	msedge.exe	96
PID 1276 wrote to memory of 3668	1276	msedge.exe	96
PID 1276 wrote to memory of 4208	1276	msedge.exe	97
PID 1276 wrote to memory of 3512	1276	msedge.exe	98
PID 1276 wrote to memory of 4208	1276	msedge.exe	97
PID 1276 wrote to memory of 4208	1276	msedge.exe	97
PID 1276 wrote to memory of 3512	1276	msedge.exe	98
PID 1276 wrote to memory of 3512	1276	msedge.exe	98
PID 1276 wrote to memory of 400	1276	msedge.exe	99
PID 1276 wrote to memory of 400	1276	msedge.exe	99
PID 1276 wrote to memory of 400	1276	msedge.exe	99
PID 1276 wrote to memory of 4976	1276	msedge.exe	100
PID 1276 wrote to memory of 4976	1276	msedge.exe	100
PID 1276 wrote to memory of 4976	1276	msedge.exe	100
PID 1276 wrote to memory of 1532	1276	msedge.exe	104
PID 1276 wrote to memory of 1532	1276	msedge.exe	104
PID 1276 wrote to memory of 3332	1276	msedge.exe	112
PID 1276 wrote to memory of 3332	1276	msedge.exe	112
PID 1276 wrote to memory of 2944	1276	msedge.exe	107
PID 1276 wrote to memory of 2944	1276	msedge.exe	107
PID 1276 wrote to memory of 2944	1276	msedge.exe	107
PID 1276 wrote to memory of 4188	1276	msedge.exe	109
PID 1276 wrote to memory of 4188	1276	msedge.exe	109
PID 1276 wrote to memory of 3112	1276	msedge.exe	110
PID 1276 wrote to memory of 3112	1276	msedge.exe	110
PID 1276 wrote to memory of 3332	1276	msedge.exe	112
PID 1276 wrote to memory of 448	1276	msedge.exe	113
PID 1276 wrote to memory of 3792	1276	msedge.exe	114
PID 1276 wrote to memory of 3792	1276	msedge.exe	114
PID 1276 wrote to memory of 1788	1276	msedge.exe	117
PID 1276 wrote to memory of 1788	1276	msedge.exe	117
PID 1276 wrote to memory of 3564	1276	msedge.exe	118
PID 1276 wrote to memory of 3564	1276	msedge.exe	118
PID 1276 wrote to memory of 3804	1276	msedge.exe	119
PID 1276 wrote to memory of 3804	1276	msedge.exe	119
PID 1276 wrote to memory of 4220	1276	msedge.exe	120
PID 1276 wrote to memory of 4220	1276	msedge.exe	120
PID 1276 wrote to memory of 4512	1276	msedge.exe	121
PID 1276 wrote to memory of 4512	1276	msedge.exe	121
PID 1504 wrote to memory of 5872	1504	easy.lol temp.exe	132
PID 1504 wrote to memory of 5088	1504	easy.lol temp.exe	134
PID 5088 wrote to memory of 5864	5088	cmd.exe	135
PID 1504 wrote to memory of 5220	1504	easy.lol temp.exe	136
PID 1504 wrote to memory of 5640	1504	easy.lol temp.exe	137

C:\Users\Admin\AppData\Local\Temp\easy.lol temp.exe
"C:\Users\Admin\AppData\Local\Temp\easy.lol temp.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/easylol
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/easylol
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/easylol
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x288,0x7ffa40e2c188,0x7ffa40e2c194,0x7ffa40e2c1a0
        5⤵
        
        PID:3372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2941921057070222652,14318158655842301780,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,10077025751409249008,5022517411152256550,262144 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
        5⤵
        
        PID:1372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,7847403873953501069,13327615514134947363,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
        5⤵
        
        PID:3668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14468637160429777852,3620590783289826388,2097152 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9593156206480334214,17206590116563647271,2097152 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,16447799663538096842,4006593713488393885,2097152 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
        5⤵
        
        PID:400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,2990394501428214870,11272031700661729730,2097152 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,13713638596817576141,171594635719649716,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,20160610909028509,6418275719249135504,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
        5⤵
        
        PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5452,i,14204831681548627188,15024953386083403376,2097152 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
        5⤵
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,1116959417850422291,13211033726295666837,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:4188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,8809558436394567426,3472100297702938545,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,12751024668660156747,4427527220074114890,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,12751024668660156747,4427527220074114890,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
        5⤵
        
        PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,12361417607871595165,9527719892338931192,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14407038373178357310,6902430295065908729,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
        5⤵
        
        PID:3792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,12713031093550734311,8811610033286158807,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,11197893256531074060,9579736388726886291,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
        5⤵
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,10517595354076084020,10269040215288404911,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
        5⤵
        
        PID:3804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,2669632042415707555,12263889217548522716,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11128349433367313827,4964881887975549751,524288 --field-trial-handle=2296,i,15500916368743425226,189628003592511055,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
        5⤵
        
        PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c crazyalso.exe crazy.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\crazyalso.exe
    crazyalso.exe crazy.sys
    3⤵
    - Executes dropped EXE
    PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d1cd9ceba1f08aba34cbefd466332fd331f1d2972be8cc615ec57cd524ccf216
MD5 30b4b3f4d05b43013e7dab373b841077
SHA1 97ffd4e8f88813d230f598d47285db769072e88d
SHA512 1981b3a322df4a4a70eed09f457d3952c1bdf9ab4c51b2e79a95c515926210414b3b85b99996e925a507bbb511ae783ea4ca15af7290bd991a9b24a4b7f7de0d
SSDEEP 192:sxZORiyM/jK1Ml8My8/fostJ+qSuRyFsIdpEXHW6+WNzt7/Y41aHIg4J:sxZOQa8/fosL+qS8y/OHbt/Sc
TLSH
T16A52FA16AA345977CCDBD209FA55BF53D6F80572E6901D44AAFCCA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 caf4e76990d3792e017507beba2461128f4db0cc78af3844c394fdf1f42f1aa8
MD5 56fc9b4e8446b52d47008b105348a1c4
SHA1 2902a6c003cda7dc6dfcb9ff806ab9783fae3bf1
SHA512 1fe34fef1dd0799b2fdd4914833d250bc882e1ac74a3ee4966b0b196810587e6d5a9b3f4ddb7701e11f1d3a3eeae924166073336628565de02a09c80549aeb50
TLSH
T1ABD0A72BFC6609A0DB6E474366A2509956643CC868848C49D416782E1C74F97D326FE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 3b029bd552e5443ac01fec7a02d4b085fe18c55674b494e53b9d0c8fbd5dce5e
MD5 0d6c30fa0d69e5a68a028b024d24e00f
SHA1 44cda51f5d327b30616f8961e3c418fbf67eced5
SHA512 0ca11d1c33cbaf9240f0e16aec7920e471cc966f82f04a3278f93ad7a6baa1b830f3eca0aadcd33a756aa6bb2415959f2bd03f095a1f79760a785ddfc873431f
TLSH
T181D0A72BF85549A0DBAE8B422692509996643CC868848C49E416082A4C44F979213FE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5810a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5810a5.TMP
Size 138B
SHA256 34bc4382daf3b650c8467969e6563a976f13df4e6cc0c968da9bf4fbfa709cdf
MD5 fd0337e12a1e0ae26dda80dc6da4f50c
SHA1 28d2c9ae69df04d2b5eb72aa3fa79eab816d35e6
SHA512 d047ce98d5227b512bc89dea270113186fed73ddaed5c183fa8804d9fba5357f3cc4031a7be011f891348473e66e0f8099616dc847d82cab5771f922c5faab71
TLSH
T1D0C02B77B8040495C7140B414232918C63183CCCDCC1CC4DB01334152930F536306FF7
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99f80f97ba8517bd6f9f96970e340a6d62bec06da317b6effa3924cb3cbdd051
MD5 b5fbb40acf857017bdb7fd7b0aedc8c0
SHA1 9a8e5723644d929bb187880e49700808f966f83f
SHA512 b7ac21de98721e61684d7f2f2e0771f8169c7d1f8ca5215be09fc11b7f8c962defdc35de5516a53c250e2a4da90a867710ab34e14a0f2387e4cd7e4990ffe8f4
SSDEEP 96:Kc0wKVSWCOUKnqUUJ2iEyevt27mTavK7+TwvnsUDGuko:qrHnUJ2iEye127iac+Tw/sUDGuko
TLSH
T1BD91820175BB42433CBE28599295A7274B46B5A3B64CE47B7FA850B24F26E300CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9200c9d-1cd3-4db4-9300-ef683e21a93a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9200c9d-1cd3-4db4-9300-ef683e21a93a.tmp
Size 35KB
SHA256 b47a79c03c6cc7df1bbff659ba929ef7d2180ef0a60b1b4b674e65973dc46194
MD5 ac26d83c701d51ed4334e688b41e7f47
SHA1 f632d6bb42bca8d5d44f2d25da4c6c0ccc62cd99
SHA512 961da28f51b58c8a516bde2b75e9d9309af950fb4aed0775359b4234fbb6bb887d67773afe3d0b40684fe622b3b21cd9548969f21d2e3c668150e8183e3432a8
SSDEEP 768:4y8iJPU7pLuLXxNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLihALl6opdfroE:4y8iJPYEXxNWvx78ru1jaKihALocdMNC
TLSH
T1EFF2EB3B6C0CCB7E4F844E9CEC2A6E9A6DE802CF5698895447FA841C03C66EE15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 758255792c737001d1e9b69f37d3f61cf7141731c8831af7d7aa921c104b35b8
MD5 bdbd37f922a3a89e89be450d36505c84
SHA1 0dba051b6dec741b0e00803c510ddefc93385592
SHA512 cad2d386d472fd9602990b80dfbd1601086367ccd447ea92444ec6330467599739e8a0195fc95281d6f30da06d61235dfd70a95ccde517d7a374a11be5bbd715
SSDEEP 384:z7tNnNnb95sNykfAzbk/kmKOhzBULP4Tr1IHmW9n:3jZb3QxhzBULwXgmcn
TLSH
T150927C32987469ABADA3A2D4F01B32175FB8965BDB883F91D9ED6B0D01CB58C1307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb3ca3a6d5729cc1021a3e9c6b8c95a6bea3f6558303fc3d3ca732019ece2c89
MD5 5e996ace9a922ddf757b520ea4fe0ff9
SHA1 818ae3c820217d0549333fcbea49e7468eeccfa5
SHA512 6966f8716abf25bcbb618fa668af72ecaee9320b1b78ca1a05742f3c69c7f1422d35f92d6bb7619df77b1036289c784b97f8eb14ebb9d9de77e1237aa402b88e
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5T5D2BhPwivh50xy0SFYKHAxEYe3O:gONp6kDfQmiUyFmZ903cmxQihlo8U6
TLSH
T11B02093568787CBB9EE3AE8AF54777175FA5212BEA812F84D9E41B1C44C764C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ebee0d40a8dcce5b08fcdfe1410da2299c7a9281c60ad8c59655c4efaa95b63
MD5 5b9aa1c94c0b857c944dd5afac8cecc0
SHA1 0b7cf9e2bb7b4164bf7269f833ea3fdf68915aea
SHA512 31378d1b973ad77a719b31be0dfbe5f45f990e46741630f50b2d67d98b758a09d926120a98d8225d74d0a3c0357b8097b66dc03274f1e6f3bde293100237b3b8
SSDEEP 192:gONr6kpQmiUyumd903cmxmFucRhk/6xU6:gONr6aYd9mK7hzU6
TLSH
T113123932A8686C7B9DE3A591F44736135FA58227DF887F90D9DC2B1C04DF2981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2cfda53-c273-47ad-b189-fefd641497a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d2cfda53-c273-47ad-b189-fefd641497a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7175b394cc164d6b16ffda499b7fe5903800bf95e8c8774c511a88e4de612d92
MD5 3d25e4dd14ee8b1d45b1e2ef0f239a05
SHA1 ac6e00700b9f88dd469e0af09052b3cfa0f8dbb8
SHA512 82283bc24ecc78b1962dfeae5bfd0b060d8dc6ed526b50d7ec03b1f630b747960c3f1c9aa4f031964725f679d576e92e7398782f17afb713239f5aac59bd5621
TLSH
T12C41E669A6F9015CF377AE59ABF6A86D447AB9772B07D45D00110D4F4622A00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

4dd85537-afdb-4b9e-90bc-1702725d5c8c.tmp

Path C:\Users\Admin\AppData\Local\Temp\4dd85537-afdb-4b9e-90bc-1702725d5c8c.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

579f0ece-8e97-4eda-8b35-3389e918ddaa.tmp

Path C:\Users\Admin\AppData\Local\Temp\579f0ece-8e97-4eda-8b35-3389e918ddaa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

crazyalso.exe

Path C:\Users\Admin\AppData\Local\Temp\crazyalso.exe
Size 754KB
SHA256 c24cef5ec1f6f482b4ef059dc7d1dddde1b3c5ef262e7a3ddbf3ffe6abc92e3e
MD5 532db0d85d736b422446d7e710a5124e
SHA1 8ff1179e5644c03713e4e8f0b4ff664c348ae165
SHA512 cd5012ceeca5e164f5da171f0e91c1dbe41b143415e3396a0cb6fa90903d2cde4aab9c000422f3f93e8d0dd48b37751e0d07f170928725c5993e95fc2c9ccc43
SSDEEP 6144:Lyrv4kfGXvLBC8wH//x/Bf/K9DM907jFLZyI4DX:Lyb4kfGXTZsMjDy
TLSH
T168F4B666B3A655A4D076C078D902861AED6034A6433D95FFA2C18DC57F907E8FF3CB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1276_2094148805\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1df7439-2f9b-409e-9373-71f9641ef7a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1276_2094148805\c1df7439-2f9b-409e-9373-71f9641ef7a6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5864-785-0x00007FF7CB4F0000-0x00007FF7CB5F6000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads