hxxps://cdn[.]discordapp[.]com/attachments/1537574367184027682/1545139676338192528/rat[.]exe?ex=6a9b0ef6&is=6a99bd76&hm=52549ab64bd409bb116b897f27711a0393ce3e923a204687721d4a2fdee3b68c&

Resubmissions

03/09/2026, 18:39

260903-xa5shsteme

03/09/2026, 18:35

260903-w8gb5stdre8

Analysis

user interaction
yes
max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/09/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1537574367184027682/1545139676338192528/rat.exe?ex=6a9b0ef6&is=6a99bd76&hm=52549ab64bd409bb116b897f27711a0393ce3e923a204687721d4a2fdee3b68c&
Sample260903-w8gb5stdre

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	1900	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\rat.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329341345684636"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{73531235-AE10-4E35-A56A-196CAF860B7F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\rat.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 5540	3020	msedge.exe	80
PID 3020 wrote to memory of 1900	3020	msedge.exe	81
PID 3020 wrote to memory of 5492	3020	msedge.exe	83
PID 3020 wrote to memory of 5492	3020	msedge.exe	83
PID 3020 wrote to memory of 3432	3020	msedge.exe	86
PID 3020 wrote to memory of 3432	3020	msedge.exe	86
PID 3020 wrote to memory of 3432	3020	msedge.exe	86
PID 3020 wrote to memory of 5596	3020	msedge.exe	82
PID 3020 wrote to memory of 5596	3020	msedge.exe	82
PID 3020 wrote to memory of 5596	3020	msedge.exe	82
PID 3020 wrote to memory of 1668	3020	msedge.exe	85
PID 3020 wrote to memory of 1668	3020	msedge.exe	85
PID 3020 wrote to memory of 1668	3020	msedge.exe	85
PID 3020 wrote to memory of 2680	3020	msedge.exe	88
PID 3020 wrote to memory of 5624	3020	msedge.exe	89
PID 3020 wrote to memory of 2900	3020	msedge.exe	90
PID 3020 wrote to memory of 2680	3020	msedge.exe	88
PID 3020 wrote to memory of 2680	3020	msedge.exe	88
PID 3020 wrote to memory of 5024	3020	msedge.exe	91
PID 3020 wrote to memory of 5624	3020	msedge.exe	89
PID 3020 wrote to memory of 5624	3020	msedge.exe	89
PID 3020 wrote to memory of 2900	3020	msedge.exe	90
PID 3020 wrote to memory of 2900	3020	msedge.exe	90
PID 3020 wrote to memory of 5024	3020	msedge.exe	91
PID 3020 wrote to memory of 5024	3020	msedge.exe	91
PID 3020 wrote to memory of 3084	3020	msedge.exe	93
PID 3020 wrote to memory of 4460	3020	msedge.exe	92
PID 3020 wrote to memory of 3084	3020	msedge.exe	93
PID 3020 wrote to memory of 4460	3020	msedge.exe	92
PID 3020 wrote to memory of 5288	3020	msedge.exe	94
PID 3020 wrote to memory of 5288	3020	msedge.exe	94
PID 3020 wrote to memory of 1104	3020	msedge.exe	95
PID 3020 wrote to memory of 1104	3020	msedge.exe	95
PID 3020 wrote to memory of 1104	3020	msedge.exe	95
PID 3020 wrote to memory of 4036	3020	msedge.exe	96
PID 3020 wrote to memory of 3140	3020	msedge.exe	97
PID 3020 wrote to memory of 3140	3020	msedge.exe	97
PID 3020 wrote to memory of 4652	3020	msedge.exe	99
PID 4652 wrote to memory of 1512	4652	msedge.exe	100
PID 3020 wrote to memory of 4936	3020	msedge.exe	102
PID 3020 wrote to memory of 5072	3020	msedge.exe	103
PID 3020 wrote to memory of 3044	3020	msedge.exe	104
PID 3020 wrote to memory of 1448	3020	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1537574367184027682/1545139676338192528/rat.exe?ex=6a9b0ef6&is=6a99bd76&hm=52549ab64bd409bb116b897f27711a0393ce3e923a204687721d4a2fdee3b68c&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fffbbc8c188,0x7fffbbc8c194,0x7fffbbc8c1a0
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,8526291078474468259,10612774006522184358,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,7095616675850569862,13146163594981084595,262144 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4078392994982738407,12222455294462643893,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,2998424406115793997,11643034850457737894,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,16269665455367136334,11390423601368579380,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8418492465224044157,4257996113558799787,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,15407905076641455732,14255041242499444032,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,16238686160561994099,3793748630586415221,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,6200952417905512406,17117448518847165917,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,2500086293139888213,17668667563343449492,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13059061110307554549,5638040174127029156,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,3974904729892829052,13932667259568222500,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5796,i,15934344849566070872,14030280681039302858,2097152 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,10337518413773275717,14024086897911537170,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3984664072386909496,14981991649434535400,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,3134168901646715286,10512290635053439471,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,10606021108397152933,455885091104046154,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,10606021108397152933,455885091104046154,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,17677989114844210255,9601348362532181512,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,8607152186725769303,15133966127542129128,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8607796114902407016,5359165444658424867,524288 --field-trial-handle=2088,i,17988345717600619647,16746772790040707652,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 530b8b5a2944ab5557917e6886d4ab44738102878c4fb87c6e71948bc2c9baab
MD5 e4f97646e99e6ef6dbff56741bfdbd9e
SHA1 e8e733750bb1cad9b4ffb1f36aacfc55b55a9e3d
SHA512 a45af06dcfba4eace1d0414cb35c8faebd19d2c56b04a00b6852f9ec50d5f4f1d383ac881c117f3d6ac89f08a9f29ad41ff039b527572faff8dfab3952bbb056
TLSH
T1C4D02333091D39D5F53D6334F153C104553B77D3054229467509F83E5D744C44786DD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

0c3b7784-bce0-4695-83e8-4d448de2932a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c3b7784-bce0-4695-83e8-4d448de2932a.tmp
Size 12KB
SHA256 95153f59159ecef557b247e48465fe3002dee16f7f52ab320660ac0d0fcd7fe6
MD5 78edc8e252f7261010954df96cc878a6
SHA1 03f26630bd165cce7a3755b9f52f136d6afd210c
SHA512 6c952b9bfdb8f153aecd53f79001d503b8c5ced00b86eb366e93f4f83aa22604917b0b26b86032767af54e313fbe0d0b7039623a1a23435d34cdced344a34c63
SSDEEP 192:sxZuRYyM/jK1Ml8Moi/fkszDL0bIdpM/W6+WNGY01f8uRhIgrJ:sxZumQi/fks/L0EM/bG5dH9
TLSH
T14542E7126B346977CCDBD209FA45BF93D5F8557292900E44AAFCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

712a0f95-4c99-412b-bd9d-514b264f7e8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\712a0f95-4c99-412b-bd9d-514b264f7e8a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6c069887cbd541d92c529b592697fc68f892c2949a915d492fd5b2667a27686
MD5 00a0b88e9c7b66e8c665d959978a752b
SHA1 958cc37fd7c8ce79665f87f0a1045a8907aec8da
SHA512 568e3e2339add1efa388044486d565398af80202b91ebd7bec8d13379ef743082883e3b1eb0d710e359359d4978fa830ad816e6047b6759a13daef71500acaf2
TLSH
T1E261B2D2DA120E8FE371CB3284E1D60334F1918D8B937EA762800FB7A621F71F26550A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ab5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ab5e.TMP
Size 3KB
SHA256 913d7e53ebeeeabdeb3a14e33d9e5c9c418581334b142e9cb437d7501e9943bc
MD5 e054dadc133035ba8af51cdb59b63829
SHA1 5b55df4862a19d63f1a4c7725aa50660124551a0
SHA512 4520800d08b6fe2e46ae0309157c7a47114f8cd7386787bff222c8c0ed4df1e1833eedd7128c1bc2d9766c0a2ec6eb9d57bd751e6e132ce0b113a4a39b81cbb5
TLSH
T1A061B4D1DA120D8FE371C63284E1D70334F1918D8B937EA752400F77A621F71F125509
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 04cb17478a3f1ed110e1ced3bb0f1d0985a62273d22b0a473c1cd6371dac754c
MD5 52c9ea69a19db49759916c57315c3f36
SHA1 c09c8e992b2814f7ff97c85d2eff7d5d92cfdfa5
SHA512 346998caf0fde222c7e32a8ef89740f874d362a0e519254ba57591a109c1f0dda4ba87a50e590a90cb00bf34b81359e9d3f0b30047ce74db953b2b8f1080fcea
SSDEEP 3:MsEllllkEthXllkl2zEklRX:/M/xT02znR
TLSH
T1FE440404FFC10505C5101D304013C77003F0D510071557C375534473DDF55400D10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4eabb918fb298cfbce544e1817c1be87f9e1a85be97b14c6861cf8a8ab373d9f
MD5 aaa9a6dad1acd751431c25150c4cb9e2
SHA1 ccf5c0f9fd04496976840529b28437a8a630c589
SHA512 f0b4abb43d4cac3f4aff0cf466d1cabb06de4be0447cbd811af83baa4479db82401525f5954e63802cfa066176b1c9c1b6f5505ff3b855df5e6401fb866ed707
TLSH
T18221CBF3C3D5855EC90546F46A24AE2BDE1C090542293D1AC9D4EF6BD7E3062E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5614ccda74c08828d6984df87dd5f4c1eefef017386116af7dac52ed130964b1
MD5 9d0ffc4bbf00a0c441732cc2f3c49426
SHA1 685a15490516e81d4626ab0e567262bbc9235211
SHA512 891e16182dc9420a11af5801854d64479ff4a8cb82ff62086c25e33c601bb7c0ec64f3a6aab7cb9c17cd79eb29f7e04aba3262190d8069a39739d16896321c87
SSDEEP 192:sxZuRYyM/jK1Ml8Joi/fksSWpVxDS0bIdpM/W6+WNGY01fa2gPIgbKJ:sxZumHi/fksSWvtS0EM/bG5dgi
TLSH
T1D352E715AA28697BCCDBD20CFA557F63E6F8457292900E449AFCCA1C00E7ADC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 e39b72848f1c129badcfb81394ae0a1e2f3370f5b07e2f4358a0803e325de7c6
MD5 c5993e90c07c340f688bcf9525a145fd
SHA1 a8c72aca32611335eafa2e863454e5e41bc7effa
SHA512 7aeec533a8ef804b028322b605f3ff1957140e4303ac7ad0566f6031848ca85757155f95db3486aeb44c1e8ecf3cd596db954974d37903d2cdbd1979ccfc02c2
SSDEEP 768:c94bSV4b+8b4bm254bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3c4T:cWu+68si2y1WRmlzQqju1jaKDILpZ8UC
TLSH
T12EE23A3B280CCB7E4F844E6CEC26AF966ED802DB56684D4447FA494C03C77EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b8feec1acaa4a93975545157a5f766fb79f118ab2a4d8ff5a4372633b2f70e1
MD5 cde45c7834eaebbb9f07728bbce41b1a
SHA1 689219192620ec52f2edc52a2d04de05e1a51b3e
SHA512 34aed073139d8ecb0b0fd0b4d03cdc44a3bc485105bbe36a7625ca3d38b7bb64e2c27a2672a755ebf9b2aa6eedadbf6af4f006ee2b0a3adce5cac1d4358ddbc9
SSDEEP 96:KA9uKWoy2lmKmALvCLPRppevZ8FBveKprBNe1nvkdf/2DWXD9N:8x1tj9
TLSH
T17E915952307B13513C7E2A49A661A71B5782B5A3321CEE2B3BEC54B60E27E510DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 ad72ee78979fa9c3abd96f2816e73b44c39e85032e7e59a0b4473c32dfcc38d5
MD5 bcdc9a6a4fcfdd6453f99e656f0d82f0
SHA1 bf7f9f6106480f936e6e3bb922360b107e3afdd0
SHA512 62508bfe300d16258b29f280ff1aa31deb8ae334f64a0844d1bd016a5d0ac98f137ad941a551e264ec7e80f40315aec51c02fd297416a2682db4d558d0e9d9b3
SSDEEP 384:x8N1LfxxXzS4r3b+A08wCXl9xuvzxV+MhdpFfa:xyx9Scrpe6l94184pFfa
TLSH
T15D622A7278786CB75EE6A585F84732139FB851A796883F80D6EC6B1C05DB25C230FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5dcf55032fe4afde19f33c22036e1a28c0a1c747b78158bc3a354e690b3a9e36
MD5 7331e7be822afbc5fa15205f86e11267
SHA1 9d1f63503d87a26b79d71cf03f09869ea271deff
SHA512 8689b6bf69e7e2d6dbe9d38c68ada777cf22ee8c9a7ad33362a14a6a30a959520457d824b2efc2c0e9420ac96bf9842b24af528e053b90637e032156d05baa33
SSDEEP 384:Y8N8kfxxipS4r3b+A08wCXEyDdNjS9XKuXxuvzxV+MhdpFfa:Ycx+Scrpe6EUN+9auX4184pFfa
TLSH
T104923A7CAC689C3E44EEB708BA4E26735DA8027BD8B46E58E3E45B0CC17655CF706C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4689301d77894a7e983b53263ba284967caf2fc8a74b639954fec075d7b1cd7c
MD5 9d7ef8ef10f6cb138105553472330f6b
SHA1 334088e3ee94f7f94f61c08c223ea95277d9d684
SHA512 f98471e08ea07525bb2a8ba0a0dd659ed5f22fcbe716a387d42a1c9dbb5ed3f384729b0a544e7b28120ba2591c9763a9e5efa03664f8d7bfb03e1c56c1e1af7d
SSDEEP 192:nGNGV6yxQmiUyB0rhY3b+jckjzorrLoWpXZ4MRqAU6:nGNY6K1hY3b+A08wCXH9U6
TLSH
T17712F832A878AC771EE26984F48732139FA94167EA897F80D6EC2B1C04DF65C530BD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38c145f9b1dee05c878e9b0677bf8ad798d4f6ed5f436d62bdba6e52d6805ca4
MD5 f040f927e3085fd7ad10e3746e4a4670
SHA1 9d1492a42fe069270b0515426b8b5fe70c7b5891
SHA512 b3bc7cae6e9a81509fc6359832b62e9a529b649c6847234fdca0ec64c66480bc39f225a7f35c0166bafc3e5bd7d15767c0dbceeecda40f28850e28769328e2b2
SSDEEP 192:nRGNK6yMQmiUy3Jmr1Y3b+jckjzorrLoWCMncEdU6:RGNK6xQQ1Y3b+A08wkJdU6
TLSH
T17E02F835BC786CB78EF26D45B48727138FE4117BDA952F80D6E81B1C00D765C230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 a6565a39957fb318a350cb52cd08faa27f8a42a13a1284ff82fece3c1fa4a93a
MD5 6aaa1c0f2a591c1985f33e05fcf5620a
SHA1 1e34d3b171d2d795ce2256f7bb3fd55fb5d62753
SHA512 e99a2eaa16babcad1c56622c2077eb12e175924e6787c6cfe50970f6f3acf6985d2abf72a3afe66bcaabb92d04d746822fcf2f769d46e644210a92f4711a5c4d
SSDEEP 384:O8N1HfxxXzS4r3b+A08wCXl9xuvzxV+MhdpFfa:OSx9Scrpe6l94184pFfa
TLSH
T14A622A72787C6CB75EA6A585F84732139FB451A796883F80D6EC6B1C05DB25C230FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe2d9c00-cdcd-4978-909e-2cb51e0748ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe2d9c00-cdcd-4978-909e-2cb51e0748ca.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

rat.exe

Path C:\Users\Admin\Downloads\rat.exe
Size 3.1MB
SHA256 b8a8db948123c0781afa5f327784b5e0eafdb9b1b154e74acb9e990baead8379
MD5 ecc5060e03d5f16b3e7223ed9585638a
SHA1 b2e311948acc7a1109693580bf041dd9242e7ded
SHA512 8b3f23fc89e3a3bc6e7f7178f8d01a40bf63b7f76d4385b0b8a52373f8ba11ed0fa2ba95a7793541a984ab78cf084aab0b7b9025152cc10d0a11dcac8738f91c
SSDEEP 49152:EbRu3Xx+ltjzB/aIqNmIqcCLgnHQ6m+I65hSsAJ1+7EVc:EfFIN4IHQ67I65hSsAJ1+7EVc
TLSH
T1F4E5E84369DB0DE9CDD667B861D75339A734FD72CA291F2BAA04C2312D536C0AD2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rat.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\rat.exe:Zone.Identifier
Size 215B
SHA256 9629e8a5078be609fe595c444f4c72439ab35427374450efcf92bd432ab11f27
MD5 85b4f0ebbf4f15f6bb320eac034c58fe
SHA1 9d9e7e905d4a839e10912454f11642c9fbd09ac9
SHA512 49dda248cbd179c9f4fc650ca2fe175d1307173610aae92d4633bb1463c82be7f72bc752a2436de35d667682d9954f795940470821e85da8636e45370354e7cc
TLSH
T1B3D023F64502C820950F38DC16CE04E6529DD441DD075640DC759975C7447DD549CD17
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads