c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

user interaction
yes
max time kernel
65s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260803-s13cvsbf43
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
94	1720	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302451054055034"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{FC42FCE0-5ED6-42E0-8D71-13583048340B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4620	4492	VelocityLite.exe	90
PID 4620 wrote to memory of 4980	4620	msedge.exe	91
PID 4620 wrote to memory of 1720	4620	msedge.exe	92
PID 4620 wrote to memory of 4924	4620	msedge.exe	93
PID 4620 wrote to memory of 4924	4620	msedge.exe	93
PID 4620 wrote to memory of 4924	4620	msedge.exe	93
PID 4620 wrote to memory of 8	4620	msedge.exe	95
PID 4620 wrote to memory of 8	4620	msedge.exe	95
PID 4620 wrote to memory of 204	4620	msedge.exe	96
PID 4620 wrote to memory of 204	4620	msedge.exe	96
PID 4620 wrote to memory of 204	4620	msedge.exe	96
PID 4620 wrote to memory of 208	4620	msedge.exe	97
PID 4620 wrote to memory of 208	4620	msedge.exe	97
PID 4620 wrote to memory of 208	4620	msedge.exe	97
PID 4620 wrote to memory of 1272	4620	msedge.exe	98
PID 4620 wrote to memory of 1708	4620	msedge.exe	99
PID 4620 wrote to memory of 1272	4620	msedge.exe	98
PID 4620 wrote to memory of 1272	4620	msedge.exe	98
PID 4620 wrote to memory of 1708	4620	msedge.exe	99
PID 4620 wrote to memory of 1708	4620	msedge.exe	99
PID 4620 wrote to memory of 4176	4620	msedge.exe	104
PID 4620 wrote to memory of 4176	4620	msedge.exe	104
PID 4620 wrote to memory of 3812	4620	msedge.exe	106
PID 4620 wrote to memory of 3812	4620	msedge.exe	106
PID 4620 wrote to memory of 3664	4620	msedge.exe	108
PID 4620 wrote to memory of 4152	4620	msedge.exe	109
PID 4620 wrote to memory of 3664	4620	msedge.exe	108
PID 4620 wrote to memory of 4152	4620	msedge.exe	109
PID 4620 wrote to memory of 4948	4620	msedge.exe	111
PID 4620 wrote to memory of 4728	4620	msedge.exe	112
PID 4620 wrote to memory of 4728	4620	msedge.exe	112
PID 4620 wrote to memory of 4972	4620	msedge.exe	113
PID 4620 wrote to memory of 4972	4620	msedge.exe	113
PID 4620 wrote to memory of 4836	4620	msedge.exe	114
PID 4620 wrote to memory of 4836	4620	msedge.exe	114
PID 4620 wrote to memory of 4656	4620	msedge.exe	115
PID 4620 wrote to memory of 4656	4620	msedge.exe	115
PID 4620 wrote to memory of 2888	4620	msedge.exe	116
PID 4620 wrote to memory of 2888	4620	msedge.exe	116
PID 4620 wrote to memory of 2888	4620	msedge.exe	116
PID 4620 wrote to memory of 3752	4620	msedge.exe	117
PID 4620 wrote to memory of 3752	4620	msedge.exe	117
PID 4620 wrote to memory of 2440	4620	msedge.exe	118
PID 4620 wrote to memory of 604	4620	msedge.exe	119
PID 4620 wrote to memory of 2440	4620	msedge.exe	118
PID 4620 wrote to memory of 604	4620	msedge.exe	119
PID 4620 wrote to memory of 604	4620	msedge.exe	119
PID 4620 wrote to memory of 4728	4620	msedge.exe	120
PID 4620 wrote to memory of 204	4620	msedge.exe	126
PID 4620 wrote to memory of 2420	4620	msedge.exe	127
PID 4620 wrote to memory of 3060	4620	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffa37fec188,0x7ffa37fec194,0x7ffa37fec1a0
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,7996661581950335148,16900088194740732822,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,17049310806134407820,4603641461229131792,262144 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8563676124369530463,13593706929983271020,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11059619231783468234,1927523581344409634,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,8036293760011516559,436109024337201159,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4473441547814423838,5897754191535272624,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,9394153292483891730,16222389726077767037,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13498766636176735645,12513211198104014256,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14377160107549281724,9354318435550858378,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,8365016526785770555,11142176380398437499,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,4758131694825616001,17843914088868689652,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9684783838787951585,17210162971544260316,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9684783838787951585,17210162971544260316,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,7843840878336066062,7993571631629193214,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1518841479001732260,2376153428817826251,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14159785481337436195,454306278084890998,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10785939634723405492,14379804532488246932,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6112,i,5901501283373246420,8894046793080091508,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,14392845220911831302,6691724039815243147,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13782261953287687375,9380579540350317569,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6532,i,12636017262798224113,4121989635535358737,2097152 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,12576563743461943777,6213009671336615047,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,15041108330356076769,11039506976239562525,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,11378641624798245601,5191108200620792005,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,10602293971738068952,5845625897424789054,524288 --field-trial-handle=2300,i,15168821414049750347,14671186651013494442,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
    3⤵
    PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c517378e62687111ee41d72005b18d1f9b82e5dac8fd390bc880f8e9a1f2ccf6
MD5 266aa19afaff16e85409720e4a46fc50
SHA1 9ea169611e4476cf33f5f38412f090eaf5e9a378
SHA512 c6a55b6db02915975acb488ff885a567d9408e11f221734248aa1073020efae8c83e5eae49ec6fb28201c053926a8c6784906041bc5a2f99f808ad9e34965e71
TLSH
T10371843701C990C2D782013A9AF12240F4BD82DAF53FEF6194F7AABE4B87711816907B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5912b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5912b3.TMP
Size 3KB
SHA256 c68276156f8550606f48e9f60b12c40833406d6a2d6c4142c1ad88f37c9b7643
MD5 f909dd504f334d15087f13724bff7137
SHA1 c2fbceba3e45e0ba7f5651090fe799df2ba41139
SHA512 db93e681257caec6f25829d24b7439331c1feb4bf76deb34af72ff757ba979770aece0d81d84b661457f064e70efe8fa6776bc5320132a2032d0f43428a3a72a
TLSH
T16B715F3701C940C2D796013A94F16284F8BE82EAF53FDF5110F7AA7E4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 be2be515fa8c56aba7760c74059ff83092eeabdff443c3efebefd00a02200646
MD5 e0193a5a607e6ceea4487185c7ce7a52
SHA1 8dc2704fa4089abbe2b6dded83e6ef5d41196939
SHA512 45542fbbb6664b7fbce10f9abc6e05f5afd85133be606933abbf7385a7e76ad746d304b218704c433edf6b9a832820eb57c17286dabb81f938f8fe68e878a8c3
SSDEEP 3:MsEllllkEthXllkl2zEklRl:/M/xT02znR
TLSH
T1E54404047FC14505D5001030C331C3500370D4150513774334715453DCC75C00C40110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c423cc1d4f514f1294289b4794fd995002c208b274222eabbcb35ea1383ddeb
MD5 b6f9a8f28c0df1a21aa6eae6edb04344
SHA1 c454c153fa3e517c63d9c2f6b9f58f632fc42f1a
SHA512 1eb8e19bdf64865896ce759abb2c114595aaa390ecd0cb61b4074aadb1e770a714e450cc4b19a397eddb5f5dfc49685a3a4f2820e56fbec39a70c0d14a189fad
TLSH
T19551A0F787A4856E8A0196F09A14EE2FDF2D0615431C3C6A89D4EE27D7F3471E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e5dae893e6ebf3783ed1d22acc897976dd77ae97859f388da0a6bf6a009dd144
MD5 09eac92231c271cbfba9359720aa3241
SHA1 2a28df2caa6fdb049915ac908aad9066de19fc1a
SHA512 6370ec6630236e6b67bd4093972ada5958d8c69dc93acf85e8dc9691d95796da25db68cbab5f73024209dcf0ecab0230d711b227de0ff2066feb4836c589f06b
SSDEEP 192:sxZ2RpyM/jK1Ml8MzM/f0sJX70bA1JIdpwkHW6+WNr42/APzQFi+V3Ig4J:sxZ2VLM/f0sJXQbvVHbX/q8Xc
TLSH
T11852F915AA34A97BCCCBD209BA44BF53D6F55422D2800D54AAFCDA1C01E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 52e0b68107f8822178ed4591d8f4cf76917b6c116e7de9c837c697ce45966596
MD5 afe4bee1419d4ca41572d5164b174173
SHA1 64571f39cd225d2400f5b9d18bf338e6ef46362c
SHA512 c073e23b98112ef068349931700e17cb017097cfefcbe6eabc87502a61f1513e103364ac51645d31196230bcc162a0ef4f3d080f6ca08e4024a29c32b638c6fc
SSDEEP 192:sxZ2RpyM/jK1Ml8NmM/f0sPWpV8m70bAOJIdpwkHW6+WNSiifXAPT9kiAT3IgbiJ:sxZ2VFM/f0sPWv8mQbOVHbmXmIXK
TLSH
T16262F916A934697BCCDBD209FA45BF53D6F9042292910E54AAFCDA1C01E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1889b9fc1dc53d6e5bc4a80c07cd42afabafbc98d2d421ea91a6189c40c68e0d
MD5 27711a4c643bc84c4867713317e96e64
SHA1 705f58cd29ef08961a719b316bae2bf22d2682b7
SHA512 d417a89aaac94eec881e576fd1edd977ce171fb4bf20d766b613a64a14f71a0fe12c4fd56966985a6a1b1b081140de09bb472eef7baa2fe7930d0dd736efb195
SSDEEP 768:EPW7k6S7pLuLf80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMga5LlWYSjsror:EPW7k6qEf80Wvqidau1jaFga5LA3j3em
TLSH
T10CF2FA3B780CCB7E4F804E9CEC2A7E9A6DE8018B56D8C95447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f57f57554e4c055ad87a2ce69b50342175c8889f45e92e34948bd7120dbfe372
MD5 0297eb2c526b2f31e92c317c26509af0
SHA1 52c334522439241fce3167bc053d9eb2210e4e46
SHA512 d4c95ade2a87a5b8d6a0357584b937d02d5117f7f0e16ce306b4dcb26c37c0d45cc6b80689661cc3bd9234841f6d0368b29e986906376a9b5e7bc40b30096af1
SSDEEP 384:nyZcIhsNIUQlZ2bcu2bM2bZIvKASBN9/sBv5V4MkcH6HlytEDq1+KDwU:Ah9ulIzbotSWBv5V4MkIoy6DqEtU
TLSH
T166C26BB0D8E52DEB4565E9C5A586FA032EB81037929C4A5CF2F8B73C305F9F81316925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd365db70d3303acdcdabeab78b1800a91f3760260a56ab005e5348c6cba008e
MD5 4139b43161be60cb11b10028cdd44eb6
SHA1 693e4b830c291853b6f8596adc32781f350f3c8c
SHA512 67f67322a1225802c12db0e27082237c1a69797968b0f996fdb9a49ab47cb52689bbd93e4903d27f412f0785b139c00db66207e4c17dfb600f78419595b472b3
SSDEEP 192:MONo64BAQmiUyU1bW5GBPK7hCI9waDNoXU6:MONo6eAXRWQM5MU6
TLSH
T1AA0219356CB96C7F9EB2AE44F48637176FE8107BE5945B40E6E86B1C00E724C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7d25f59cb39a94b41f201f55b40f4607d3ed412a9e4adc78724b3261a6ae7eb8
MD5 6c41a833d4f7fdc3041a541fd4d11232
SHA1 53544b1907e2eac6efabf2e38d81d861367440d1
SHA512 8964a22c1bad8686389658a79c92b70476812b029f1fc744f582013d9bc018cfe658471da9493e48223cacb6e63e87968ce0427b10f6f46f5a36f61817d972b3
SSDEEP 384:nkZcIhsNaUQlZ2bcC2bM2bq6HlytEDq1+KDwU:ChLuXIzbqoy6DqEtU
TLSH
T1D492AE7058B5AD3659AAF111F48A3B036FF81077AAC45F54F2EDEB2C04DB399230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ef290ec0a0878baec036eb9c248dfb50d8e6e8fc7dc0f248d5b14b143362b584
MD5 ae7baaca1a84e900d1340248a2f1de77
SHA1 1d0c81b881320c6b3cb72080f8fc828153733473
SHA512 2eecda4eba93aa2ff9321b6bcc6ca8e2c62182b4690a0bc9cbde950fd0ab1cfdc955fe1d6a7b3382c8a61093e2dc056dc75e2b6a48cbf019894ad213d194b3d4
SSDEEP 384:ngZcIhsNaUNlZ2bcC2bM2bq6HlytEDq1+KDwU:ehQuXIzbqoy6DqEtU
TLSH
T1AA92AE7058B4AD3659AAF111F48A3B035FF81077AAC45F94F2EDEB2C04DB399230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36323dad5f0936cb358dd7c4d7bec4f1a10e3c3a12cc3fdd7b4d29d404fb0825
MD5 5824355a9b65de3847d2aacdea46790e
SHA1 aba2ee780f903a8c04e654d5635fd4d0bada4219
SHA512 34b53bd41e1e3f12dfc0e06eb7e258f6658c126df00b93bb80d156c539dfd46fb1b4abdf6c2d024b9a5563dcee7307efecf887e0e97cecc53b45b987cb8ca901
SSDEEP 192:qON464B5QmiUytbi5GBPK7hCI9jlEpWwNcqxsU6:qON46eXUiQM2NqU6
TLSH
T1751219716CB9AC2B5DA2B141F4C633436EA4107BE9855F50F2E86B1C05E734C3B0B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bb7e792-8901-48c7-90a6-2626c1621683.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6bb7e792-8901-48c7-90a6-2626c1621683.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff28e5efcb6d46bf02c5cf4d054e8fb54f1f76e8ff1198e92cfb0054b31dae70
MD5 665528a256ffe577afa097e588cda8cd
SHA1 9e6baebd9a67737f7c073f4034e22139364f5442
SHA512 e60f0730f9e5c4f74310969c2c518b9280ec867f58fb45e51ea0eba0a428d938408b0bbe40599874a93d0a16d6d63a90fb9f9ca428254492a0349e5eb5f8bc69
TLSH
T171412768A6FA1148B3772F5AAFF6A96D547B7A732E0AD09E10010D4E0632B00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

65416667-c46e-47fc-aba1-3a0811f5de28.tmp

Path C:\Users\Admin\AppData\Local\Temp\65416667-c46e-47fc-aba1-3a0811f5de28.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

93b43c9f-4038-47cb-a5e4-1a9a6ac38657.tmp

Path C:\Users\Admin\AppData\Local\Temp\93b43c9f-4038-47cb-a5e4-1a9a6ac38657.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4620_1538425479\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cd2e963-eee8-482d-bff2-f8f9042ee310.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4620_1613024603\7cd2e963-eee8-482d-bff2-f8f9042ee310.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads