darksiderat | a046759229d37102369ea8de2ed9370c07b4af2cc2ea9cac66816cfb5ecd1b83

Analysis

max time kernel
50s
max time network
61s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Froststrap.exe
Size 21.5MB
Sample260808-yc91pafc35
SHA256 a046759229d37102369ea8de2ed9370c07b4af2cc2ea9cac66816cfb5ecd1b83
MD5 65504770dbe4b002b6b490346c954caa
SHA1 ad33504c3d4fa8dc1b5702d0a3a1661e997a7d0b
SHA512 11c4371ac49ea394efccecb2504d26aec595995f2224d06d6d652f7059e36a6cf55454a69576bda7a27e669683ac6bc2d97b01124bee38e2d0371826072d0239
SSDEEP 393216:1JssJJk4NssjJ/3sQJ+xuJoWlYLfwMjvMsM4IAO:Hxh/5kuJoWiMsbt
TLSH
T1EF379D41A7FC0A35D3BB5734A97021091536BD5AE751E74F2A8CBA6D2F723808CA0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral2/memory/524-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/524-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/524-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/524-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
92	4188	msedge.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 524	4724	Froststrap.exe	82

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4908_49193631\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1755911846\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306916187727502"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{43952B95-0919-4A52-BCD0-2C43C98D36AE}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 524	4724	Froststrap.exe	82
PID 4724 wrote to memory of 4908	4724	Froststrap.exe	86
PID 4908 wrote to memory of 4904	4908	msedge.exe	87
PID 4908 wrote to memory of 4188	4908	msedge.exe	88
PID 4908 wrote to memory of 6056	4908	msedge.exe	89
PID 4908 wrote to memory of 5184	4908	msedge.exe	90
PID 4908 wrote to memory of 6056	4908	msedge.exe	89
PID 4908 wrote to memory of 6056	4908	msedge.exe	89
PID 4908 wrote to memory of 5184	4908	msedge.exe	90
PID 4908 wrote to memory of 3564	4908	msedge.exe	91
PID 4908 wrote to memory of 3564	4908	msedge.exe	91
PID 4908 wrote to memory of 6004	4908	msedge.exe	92
PID 4908 wrote to memory of 3564	4908	msedge.exe	91
PID 4908 wrote to memory of 6004	4908	msedge.exe	92
PID 4908 wrote to memory of 6004	4908	msedge.exe	92
PID 4908 wrote to memory of 3544	4908	msedge.exe	98
PID 4908 wrote to memory of 3516	4908	msedge.exe	99
PID 4908 wrote to memory of 3544	4908	msedge.exe	98
PID 4908 wrote to memory of 3516	4908	msedge.exe	99
PID 4908 wrote to memory of 2212	4908	msedge.exe	101
PID 4908 wrote to memory of 2008	4908	msedge.exe	102
PID 4908 wrote to memory of 2008	4908	msedge.exe	102
PID 4908 wrote to memory of 2008	4908	msedge.exe	102
PID 4908 wrote to memory of 4936	4908	msedge.exe	113
PID 4908 wrote to memory of 4936	4908	msedge.exe	113
PID 4908 wrote to memory of 3804	4908	msedge.exe	114
PID 4908 wrote to memory of 3804	4908	msedge.exe	114
PID 4908 wrote to memory of 3804	4908	msedge.exe	114
PID 4908 wrote to memory of 2368	4908	msedge.exe	115
PID 4908 wrote to memory of 5608	4908	msedge.exe	116
PID 4908 wrote to memory of 732	4908	msedge.exe	117
PID 4908 wrote to memory of 1160	4908	msedge.exe	118
PID 4908 wrote to memory of 1160	4908	msedge.exe	118
PID 4908 wrote to memory of 5332	4908	msedge.exe	119
PID 4908 wrote to memory of 5332	4908	msedge.exe	119
PID 4908 wrote to memory of 4484	4908	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Froststrap.exe
"C:\Users\Admin\AppData\Local\Temp\Froststrap.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\Froststrap.exe
  "C:\Users\Admin\AppData\Local\Temp\Froststrap.exe"
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win143&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffc91c1c188,0x7ffc91c1c194,0x7ffc91c1c1a0
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,13100932562575081127,355364914630168572,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1856187253584471344,10782439983636771973,262144 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,2018651995780441893,17834366792840264173,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,12902518637943596343,5347152801996003540,2097152 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,14564486960678518982,17649402756441775581,2097152 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,1871870560122964500,5350492391800864320,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,4859175818258680295,8521822662777172908,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2304410069805302181,15864786066900651936,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2304410069805302181,15864786066900651936,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5828,i,7223347407183271251,13364796101053625186,2097152 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8574387064874702243,16792082117210138621,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,18171719240124813584,9235317627157302858,2097152 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,7077134276564775929,4969196048288709327,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,986572106338773494,15368652185051169761,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,1011041506362161571,13369247472964628042,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,789323872317635871,243056064531653222,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,13802106913694135591,4547559006118858410,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,8586210613075828688,4280291201510682595,524288 --field-trial-handle=2528,i,13192309686944717158,2814983873830336462,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ca59d32fe433b98c6520714c83ab0a4b9f71c38bfde02f80b19864591d0157f1
MD5 c71b2d7936e0c5074647d6d181d0cc9c
SHA1 363cc5d018700b994c1e3f7947acade73cb0fd49
SHA512 80837d2943190e75979a782d09f9ef7f4768f08216c2fef0c194f119de0c1a28422e5ca2bb0b85923ce37db456ae11ca7bf9bc30cd77d8f86f9953360025cd6b
TLSH
T1B9E092EACC75AC3708FD0B5C54624746E7A6236B2B815D5F3A3CD11D8FB163B818686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4cabe17e61f7cc7af42a60138983e59edd4b315d38e2739caf0235444f2e0ad2
MD5 edbd62f8d1150f67ef4236c8fa6baafa
SHA1 f09f67b6925925b317af29074bd4ce68d4605f5b
SHA512 8a353712d203ca8b03972960b22f6ee9fdf9afc5af067b7f85babd9f847dbb8f77cb963bd12b6ab92622e65491700bfbbc6a5ef7a3e9dc04320b9d2e88ae7b2b
SSDEEP 192:sxZqRMyMqZjK1Ml8Mz5/fXs1OxyYZZyb5qzodp6wHW6+WNrA9/YBZAW1AZIg5s/B:sxZqzL5/fXs1OwmZo5RDHbE/46stum
TLSH
T1F772F816AA34997BDCDBD20DFA457F53D6F8552392814E449AFC9E0C04E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 23ab715e1acc1e1248153171efdc486671f8a1e62e2be3d5131480abe74c7b67
MD5 64e4c85174c55fb3c13e7b56702fde5a
SHA1 54affd2c23ff5b9c1e7b99f50b0def6b76d4377e
SHA512 0f2d6772879d88bfd99fb2d05e23baea09d117d08fecb51a859107a1d8aa1076e0e8b2f2a0b2783a62e7a22449965bc50ed2ea403796eefb46a9e230cea2ab8a
SSDEEP 192:sxZqRMyMqZjK1Ml8Mi5/fXsrOTYZZyb59zodp6wHW6+WNrA9/YBZAW1AZIgjthJ:sxZqzq5/fXsrOTmZo5WDHbE/86jtr
TLSH
T1EC62E716AA249977CCDBD219FA457B53D3F9556392814E449AFCDA0C04E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6a066cefa0c31e298475b338f409dfb68aaab18a2ac2b1b306bc1d196d2899d9
MD5 d96934117fd86bbfc9d5c0b6196949de
SHA1 1fed85c0b4a21b2f41e9e97d15004f05e7e45869
SHA512 e99eecf391c6d90262a6a7628ef135c44e409fc21e36534dd7efce43e3c982d94bc61199ef9fe81142ecc8052b5067798b5bb6c40fca084b99c54264af2ca355
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV26yVLlFX6Baro6:P4E/aezEnC6WvCuFOu1ja76yVLfqBRVw
TLSH
T179F20B3B6C0CCB7E4F844E9CEC2A7E9A6DE801CB9698899447F9841C03C67EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 0bf58316060b5fa82c99047dc8e5f50731c989f43548a302e1b99398a2d27caf
MD5 026fd9ac7bdb427689cf0b8f3dd827aa
SHA1 0a67b078a2d9f370ec1541aed9cbdefe689e9edf
SHA512 74bdf46953e69bef9b35efc539bcbedf76c80b9b9ac6d44866b267432ae9ced69d99b011b01dcc4428d9538cc9c8028c861febbfa79b7c3b04f2a0f146688dd6
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LA9:8ptDYDcfvNR1ANAJTXnC
TLSH
T153B27B16713B065138BF3508A6979A379E4231A33418E4BF7BB914A21F67E225CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6a40dfe50b7dc81d55ba78fcada78b4fb42c9b2e3bd2fd59107cd4a4fe4036e6
MD5 2034b938a1af6516f9bfaf26f21bfab4
SHA1 eea7768215d6a58514926319ff5f8221e3c3c1a2
SHA512 a279d58460eac62ef71dba302384100bf65b0120c69fcf12f1efdde3e497ee8a2367d2ccf7b2623e838263e93d40264c557d0c22b45b93af568b235371250275
SSDEEP 768:YFQ63UwgdshGF/pHrLPPcHnewBKZOk30W:B63AR/pHrwnevZ5F
TLSH
T1AFD27C71EC58CDBBEDEA9B89B78A3643DEE401A3E9CC5AD4D6D85E4C008719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5b758f13828b8bb54ff3b120b7fb79f8eb6a4b67926e367191c19f6675012bd2
MD5 9d90f4620d6d1cedf99274d592090a70
SHA1 ab56d2de669850e464e13b616faadf7366bb66d7
SHA512 f752425d3167c4f1c5470931200b3371cccc476dabb7d310ea12c5818b27f91cc9b2e6a74404dbcba5084c18dbfa825d6e5d8af56212b1dd1400f206bd773c9e
SSDEEP 768:GFQ63UwgdshGF/pHrLPPcHnewBKZOk30W:T63AR/pHrwnevZ5F
TLSH
T174D27C71EC58CDBBEDEA9B89B78A3643DEE401A3E9CC5AD4D6D85E4C008719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e0f86ebfb81e0289476ee4d04a3dd2c23c42354c9218e7883dee6a12ab8b81b0
MD5 ee02836b4a40d365da28a7ca9fb9efec
SHA1 84f3f3e785481365922a9d3a2ed6be3b012f44cd
SHA512 685adf07f49a3e109ca972b6059d13c37d84b77104294924f1bddfbcf2f6075145f57a8029047e67959a13b701a2488ece0810ba26989238941f90161141bc62
SSDEEP 384:nEiF9CcmyWCs3sN28TUNTUlImkrDcYhQ9fifFGK2/pQMrLPM6wLaJCra5eTTQIXg:fFccps39wgx88GF/pHrLPM6wLaArXi
TLSH
T14DB25B35DC98CABBEDD68FD9A35E3A17EEE40163968C5AD0DAD91E0D008B1DC1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e8abf82b7b2ac534a4c32fbf866cb485ca0d4c253678d8d6dee935ab185939a0
MD5 3d72f24c9ba2d403906616ee0330c7aa
SHA1 5c7dfb302849ce3fc14b2f6cfca731189dd08beb
SHA512 7f1ba58cdb3194aabfa98ab5e53699927e51bebe787ed68f6622e065a2673da18be9a3848aca245ea43adfc921872dd79ee6fe8223b2ae8ca0e928f25379eeee
SSDEEP 384:nniF9CcmyWCs3sNb8TUNTUlImkrDcYc53fifFGK2/pQMrLPvXKIlZvHwLaJCra5n:iFccps3kwgx6uGF/pHrLPPPHwLaArXi
TLSH
T1A7C26C31E898CDABECD69F95B39A3653DEE401B3998C9ED0DAD91E0C008B1DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 04afd389853731544646bee76ce9788fb6c10f58a771f123b017db9950a6c31a
MD5 8ce8c8cd558a7acf07eb20b322c6d565
SHA1 ef82660a010ae76d285cbf5faa89fbc5ef168360
SHA512 24768f218ea4fae4d486c6249e255658daedfaece21582b981991b04d864fa8fab0d1c88c23ed8f18bb62fd0618a895b42d2f7a9534e4dc8a006740785166834
TLSH
T16A41D958B6EA1148B3777E566BF6A86D887ABC372E4AD45D10110D4F0722F40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/524-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/524-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/524-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/524-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4724-3-0x0000000140000000-0x0000000141593000-memory.dmp

Download

memory/4724-7-0x0000000140000000-0x0000000141593000-memory.dmp

Download

memory/4724-6-0x0000000140000000-0x0000000141593000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads