9800e4f8d8f578fe177c3f059fe898e284c2e2ec625c132cad0a429f279f590b

Analysis

user interaction
yes
max time kernel
18s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client_14883.exe
Size 1.3MB
Sample260809-tt8fzavscv
SHA256 9800e4f8d8f578fe177c3f059fe898e284c2e2ec625c132cad0a429f279f590b
MD5 0d7ddf89b8f05c262f4684acf4f8526d
SHA1 b6af595dd2bd7dfa99d8c40469411a4abf4ebdcf
SHA512 224969f48268f2c04c77f73daccda865eb50106abff5442990e1b16d83dfc27d9e1c0ac1202e6c055c958e5d976ccfd4fd0ff7f6cdd4e421c72fdbc08111cb0c
SSDEEP 24576:mCrzcUv6wZ8KyV2h9LlOGZP9wyAsuaZj8ONF5ixn6FP:ZzB6wZ8HV2DQGlWyn5ZQlxn2
TLSH
T18C558DD079B827B8C17F903A8686D646E5F7B844033099FF13ACA5493B662D30BBB715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
40	discord.com
52	discord.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com
36	discord.com
37	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307661408690149"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E2B98FDB-4883-4EBD-AD58-14A7FA636465}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{D44555C2-63B7-4690-8B88-12A5FD074439}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1760	2512	client_14883.exe	85
PID 2512 wrote to memory of 2856	2512	client_14883.exe	86
PID 2856 wrote to memory of 3632	2856	msedge.exe	87
PID 2856 wrote to memory of 4356	2856	msedge.exe	88
PID 2856 wrote to memory of 368	2856	msedge.exe	89
PID 2856 wrote to memory of 368	2856	msedge.exe	89
PID 2856 wrote to memory of 368	2856	msedge.exe	89
PID 2856 wrote to memory of 4992	2856	msedge.exe	90
PID 2856 wrote to memory of 4992	2856	msedge.exe	90
PID 2856 wrote to memory of 2240	2856	msedge.exe	91
PID 2856 wrote to memory of 2240	2856	msedge.exe	91
PID 2856 wrote to memory of 2240	2856	msedge.exe	91
PID 2856 wrote to memory of 3928	2856	msedge.exe	92
PID 2856 wrote to memory of 3928	2856	msedge.exe	92
PID 2856 wrote to memory of 3928	2856	msedge.exe	92
PID 2856 wrote to memory of 908	2856	msedge.exe	94
PID 2856 wrote to memory of 3024	2856	msedge.exe	95
PID 2856 wrote to memory of 908	2856	msedge.exe	94
PID 2856 wrote to memory of 908	2856	msedge.exe	94
PID 2856 wrote to memory of 3024	2856	msedge.exe	95
PID 2856 wrote to memory of 3024	2856	msedge.exe	95
PID 2856 wrote to memory of 4180	2856	msedge.exe	96
PID 2856 wrote to memory of 4180	2856	msedge.exe	96
PID 2856 wrote to memory of 4180	2856	msedge.exe	96
PID 2856 wrote to memory of 2252	2856	msedge.exe	98
PID 2856 wrote to memory of 2252	2856	msedge.exe	98
PID 2856 wrote to memory of 4124	2856	msedge.exe	100
PID 2856 wrote to memory of 4124	2856	msedge.exe	100
PID 2856 wrote to memory of 4124	2856	msedge.exe	100
PID 2856 wrote to memory of 2984	2856	msedge.exe	101
PID 2856 wrote to memory of 2984	2856	msedge.exe	101
PID 2856 wrote to memory of 4400	2856	msedge.exe	104
PID 2856 wrote to memory of 2348	2856	msedge.exe	103
PID 2856 wrote to memory of 4400	2856	msedge.exe	104
PID 2856 wrote to memory of 2348	2856	msedge.exe	103
PID 2856 wrote to memory of 3852	2856	msedge.exe	107
PID 2856 wrote to memory of 2664	2856	msedge.exe	108
PID 2856 wrote to memory of 3852	2856	msedge.exe	107
PID 2856 wrote to memory of 5968	2856	msedge.exe	110
PID 2856 wrote to memory of 5032	2856	msedge.exe	111
PID 2856 wrote to memory of 5032	2856	msedge.exe	111
PID 2856 wrote to memory of 2156	2856	msedge.exe	112
PID 2856 wrote to memory of 2156	2856	msedge.exe	112
PID 2856 wrote to memory of 4500	2856	msedge.exe	113
PID 2856 wrote to memory of 4500	2856	msedge.exe	113
PID 2856 wrote to memory of 4696	2856	msedge.exe	114
PID 2856 wrote to memory of 4696	2856	msedge.exe	114
PID 2856 wrote to memory of 3856	2856	msedge.exe	115
PID 2856 wrote to memory of 3856	2856	msedge.exe	115
PID 2856 wrote to memory of 5324	2856	msedge.exe	117
PID 2856 wrote to memory of 5324	2856	msedge.exe	117
PID 2856 wrote to memory of 5324	2856	msedge.exe	117
PID 2856 wrote to memory of 5412	2856	msedge.exe	118
PID 2856 wrote to memory of 5412	2856	msedge.exe	118
PID 2856 wrote to memory of 5412	2856	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\client_14883.exe
"C:\Users\Admin\AppData\Local\Temp\client_14883.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Qsrf86hzR9
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/glockolex
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff93a7bc188,0x7ff93a7bc194,0x7ff93a7bc1a0
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,3413855052468273827,3565745310894615630,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,10410472716725824322,2748171544659207820,262144 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,10282129640361980564,7074447249079717274,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5109113691133044456,4507791928691998086,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1636307720992862365,3242049837783896651,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4380590433696735822,9901875082387844728,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2404405414222250490,12204133026330498652,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4504,i,12610450356091806945,50119474889557458,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8827532012876777313,513939501846429672,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5416,i,15350420321983716135,16668915859625561198,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,12801977368171336026,9074155678029943738,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5597047999111911126,7016729819759690738,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,2783131274998568676,18214240505009994793,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,5126809639565191164,12530631316434801381,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2812216610875540085,77744851438965011,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    - Modifies registry class
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15889978719146832786,5064043786787864191,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15889978719146832786,5064043786787864191,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7139563223295029915,18303128452729539876,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9060620445029486058,3297219356514111026,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,8206717118483562089,13291052777622054336,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,5547430845165591937,14056665622466014268,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9495259748684285251,13595420171820490068,524288 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4448,i,18154693521539051890,7817384571265639136,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5384,i,4479493407284234106,5443735508925575534,2097152 --field-trial-handle=2256,i,2751278938881139821,6558019040096136849,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
    3⤵
    PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 07b7a9541d9506ea07523db70498275fa92f21cc70e6108e68ededf311754891
MD5 4375482139b3a8405420feca7588ba9f
SHA1 efcbd7fb9743b97e09af163657dc340df86125f9
SHA512 3f0537533103985a658e6ec1d32145d87bf1daaf8b555c1982da0d1c358d125c5ee39c025c9ce84566e4c104a43000829f2dcbf8a8071821ce7389f9cf5667eb
SSDEEP 192:sxZuR0yM/jK1Ml8Mym/fls/jQiVvIdpEbHW6+WNz5tjsc/eBOAv94jK6Ig4J:sxZuWam/flsbQNaHbHr/eAHc
TLSH
T16352F952AA349D77CCDBD209F951BB53D6F51472A2940E44AAFCEA1C04E7AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 77b1ee1c9ce33f6849f0dbe48951148806f9f1f0125806c128e4b63e7063097d
MD5 c24166cb5e717493236ecf63a40221a9
SHA1 3ed0b8fba1f909e8f2b6709b53ef6895018fd2a1
SHA512 f41dc64fdbdd5a5159587600494e09edb053c4e21d44bb167b1fe7146c67501b2a17d19538ae2d98d698fa069927e9498b7a00d7fc9c765e19cebd42745b5591
SSDEEP 768:GIseJQxWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/OVcLly0ppProIt:GIseJQxWvhfwnu1ja2OVcL88pci
TLSH
T124E20B3B280CCB7E4F844E5CEC2A6F9A6EE801CBA6984D5447F9984C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 44f564c0b67db7d63f31b0eeaadf08c84c3a41f7b9f9e2bb80654160bd6dcc7e
MD5 a1cbb615cc65fc68c8428d92efa0acfa
SHA1 d0adda72a39ca3622fc150c5181837564dfedf19
SHA512 79c49bcfb9c1caf57f64fa5116027efb858a949b83ff14060132ec9a5950f8cd774dc2c0f5a061fe5dcd221c34b5a82b44d4535538533d1537a335cd3a144afa
TLSH
T1C8D0972FE2A80140CB6A8B83262249AA82642E8810CDA08DC8032A2D48397428203FE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583812.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe583812.TMP
Size 138B
SHA256 19c947a547f832810393f1e261e1aa1b5bf313ef153be52b4828f4eb2ded6a29
MD5 70708dde5cf2cba5d9fc9dc0cc283bc0
SHA1 d59f3ed0f09d67f789482b4a2ab161cd5e833dcb
SHA512 980271ac3e48f21e8a529905b5e4ed6103fd6fc83d991cce470c4746b166cf24591d306a563bdac4acdcf57cf4f95b68271ead445abc0a6c3cb945fd48fac369
TLSH
T16BC02BBFE20400008F25478243338E6CC7443CCD48CAA0CEE41338281135E132203FD3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7809d671161c894ec39d080dbad636d203990d9f1e7faaff1548a306f493c2ad
MD5 fdbb09fb2c56b9221a998342991a5851
SHA1 eb8caa3551ff368e5aca87cd6a8b03e83a128850
SHA512 455689c3e08cf4e54c5276ffeeeec50c803eee3bc71abed239f511c58678e75c378ec369040b7c4ba25ea3daa9956799c174926258e55b43f835f3ec91d9b2b8
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm01n2K44ug:49SRkVBnTfuTq9ZdB1/+hBKnh5hfNg
TLSH
T116B11042753F02413CBE694CA2A9A9768F413162351868BEBF7814A30F66E110DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eebee7c21012535554f110418e271225a13c80d5fadadd72454d680d311a6124
MD5 55b669cd524838318c66f789ff6183c1
SHA1 901a150af8837bc0f65ce4227006586ce0092452
SHA512 8e870571cfdc908adbb1e8adc5602fdd3f2f5f06acb80e094fd9daa4453968d322c61fa02ae12cbca5b3b8ed4bf6a8896beafced4b94aa45db16888acb438e83
SSDEEP 192:lON7Zh6vMtPQmiUynKThTq4+FdLkxw847g64U/u:lON7D6UtRZTSd4xKGU/u
TLSH
T16F020935AC786C7BAAB3AE46F48A37171FE4217FA5D01B54EAE82F1C00D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5696c086d4669d22a2cfd515249a711f1da63ecc8212522e43049f6d011211a0
MD5 751046a8f93d1d4e03ea6e63cbd72583
SHA1 af902ac2172d168d9024c9bed28b2b4447ab3423
SHA512 29c00b911c2efd8cc799cccaef11bef38b071ce97d7d2c9a392ec0af24b8c9b5afee3d1c607e2b3379dd47ce03b8ec8edc6c1bb18226e789d4c6e181734e1c83
SSDEEP 192:uuaXsNe3QcZtEM7e8HLQmiU1e3m8BMTq4+FdLkxdtSJrH8z1Lqi8s4j:n0sNe3Zt97TH9Om2Jd4xGJrMSFj
TLSH
T1CF422A70A8749C37A9A7B245F14A37139FF460BB99C45F58E6E9BF1C04C679C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fe94e2bf77e64c766e786800ff0623593e2ddd705b6bc5cc26d8850efa6a999f
MD5 1f2b025b1b9d4f0df89fd557fb2f9108
SHA1 000d5183c00ed69bd56131c1e0119011f241d669
SHA512 050606d6d65ee78e5c4064f9dee5c614f765abd6757c5651aa5304cd3d9bee9ec0fb3c46ad91dd34fb5bcfbd0e684a7d5cec471d442186f2f56ecbdb06d3e3d1
SSDEEP 192:nON36vMWPQmiUyDKfhTq4+FdLkxdtSJrh80ILqi8U/u:nON36UWRzfSd4xGJrWSU/u
TLSH
T124121A31A874DC2769A7B105F0CB33575EE461BBADC49F54FAE86F1C00D679C270A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a1bcefd6663d2cd04311f749218c7f9417ec359d489876e6989d46cbfefb12c4
MD5 7572aaa862de37c30f7f179920b2d57a
SHA1 112c889df5f322a603e0c67fc6b181da8d04af37
SHA512 4a737208712505935fce219680078f28c973a9dadc36640c88be1e54f4a4bbb659b07c78fd8ac2ee359260feaf9d7a2daf03a6afa9aab2f45ef4a5b5eacdffe9
SSDEEP 192:z4ONe6vM7e8rLQmiU1qRyZMTq4+FdLkxdtSJrh801Lqi8U/Z:z4ONe6U7Tr9GQJd4xGJr3SU/Z
TLSH
T137220931A8749C27A8A7B245F08B33575EE460BB9CC45F94FAE96F1C00D7398270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

58c4db2e-db16-44a2-927d-d83fb26c2da8.tmp

Path C:\Users\Admin\AppData\Local\Temp\58c4db2e-db16-44a2-927d-d83fb26c2da8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d00af8d7-c1d4-49c7-93e3-222c733670d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\d00af8d7-c1d4-49c7-93e3-222c733670d1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2856_1375656811\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4bc0cf0-5c16-4254-a4f8-342f0fc9158a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2856_63741860\d4bc0cf0-5c16-4254-a4f8-342f0fc9158a.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads