blankgrabber | hxxps://download2333[.]mediafire[.]com/y46fj2kxo6ug0EFvlMEa6SM87Rp_cCmFCZcb89vo2dqYP8fj0iLWLAudzYXbADpMOXFy07id8xzgpuqb1uKdbszZ2toYm4AeLwt8qMmlfc6DEAobvh90rSG8bx4Jm26iF6w8DmJVbDptBT0zq1nIFOX1TQjKkzlcew4tu-_3/jztwgxcrsfk6mxi/bloxdclient-new[.]exe

Resubmissions

03/06/2026, 14:46

260603-r5myasay2l

02/06/2026, 17:20

01/06/2026, 17:48

01/06/2026, 17:09

01/06/2026, 16:51

01/06/2026, 16:50

01/06/2026, 16:47

01/06/2026, 16:40

Analysis

user interaction
yes
max time kernel
164s
max time network
169s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://download2333.mediafire.com/y46fj2kxo6ug0EFvlMEa6SM87Rp_cCmFCZcb89vo2dqYP8fj0iLWLAudzYXbADpMOXFy07id8xzgpuqb1uKdbszZ2toYm4AeLwt8qMmlfc6DEAobvh90rSG8bx4Jm26iF6w8DmJVbDptBT0zq1nIFOX1TQjKkzlcew4tu-_3/jztwgxcrsfk6mxi/bloxdclient-new.exe
Sample260601-vc1v8sax71

Score

10^/10

defense_evasion discovery blankgrabber persistence stealer

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 4 IoCs

resource	yara_rule
behavioral1/memory/2868-2350-0x00007FFC2D1F0000-0x00007FFC335B7000-memory.dmp	blankgrabber_exe
behavioral1/memory/1788-2353-0x00007FFC26E20000-0x00007FFC2D1E7000-memory.dmp	blankgrabber_exe
behavioral1/memory/2868-2356-0x00007FFC2D1F0000-0x00007FFC335B7000-memory.dmp	blankgrabber_exe
behavioral1/memory/1788-2363-0x00007FFC26E20000-0x00007FFC2D1E7000-memory.dmp	blankgrabber_exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
301	4324	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
5432	bloxdclient-new.exe
2868	bloxdclient-new.exe
5744	winupdate.exe
1788	winupdate.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
2868	bloxdclient-new.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe
1788	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\winupdate.exe\""	bloxdclient-new.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
561	discord.com
605	discord.com
608	discord.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2236_1734374253\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2236_48513961\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2236_48513961\protocols.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\bloxdclient-new.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "142"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248063319358461"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

Modifies registry class 59 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{5AF03E7E-A915-48E4-B224-55ACEE0DA75D}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000040066c3d36e3dc0127201bd440e3dc01f1268931e7f1dc0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\bloxdclient-new.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\bloxdclient-new.exe_Decompiler.com.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\WindowsUpdate\winupdate.exe\:Zone.Identifier:$DATA	bloxdclient-new.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	bloxdclient-new.exe
Token: SeDebugPrivilege	1788	winupdate.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2456	msedge.exe
3780	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3276	2236	msedge.exe	82
PID 2236 wrote to memory of 4324	2236	msedge.exe	83
PID 2236 wrote to memory of 3144	2236	msedge.exe	84
PID 2236 wrote to memory of 3144	2236	msedge.exe	84
PID 2236 wrote to memory of 3144	2236	msedge.exe	84
PID 2236 wrote to memory of 2388	2236	msedge.exe	86
PID 2236 wrote to memory of 2388	2236	msedge.exe	86
PID 2236 wrote to memory of 696	2236	msedge.exe	87
PID 2236 wrote to memory of 696	2236	msedge.exe	87
PID 2236 wrote to memory of 696	2236	msedge.exe	87
PID 2236 wrote to memory of 1712	2236	msedge.exe	88
PID 2236 wrote to memory of 1712	2236	msedge.exe	88
PID 2236 wrote to memory of 1712	2236	msedge.exe	88
PID 2236 wrote to memory of 3796	2236	msedge.exe	90
PID 2236 wrote to memory of 3404	2236	msedge.exe	91
PID 2236 wrote to memory of 3796	2236	msedge.exe	90
PID 2236 wrote to memory of 3796	2236	msedge.exe	90
PID 2236 wrote to memory of 3404	2236	msedge.exe	91
PID 2236 wrote to memory of 3404	2236	msedge.exe	91
PID 2236 wrote to memory of 4756	2236	msedge.exe	92
PID 2236 wrote to memory of 4756	2236	msedge.exe	92
PID 2236 wrote to memory of 4756	2236	msedge.exe	92
PID 2236 wrote to memory of 4372	2236	msedge.exe	93
PID 2236 wrote to memory of 4372	2236	msedge.exe	93
PID 2236 wrote to memory of 4372	2236	msedge.exe	93
PID 2236 wrote to memory of 4020	2236	msedge.exe	94
PID 2236 wrote to memory of 4020	2236	msedge.exe	94
PID 2236 wrote to memory of 732	2236	msedge.exe	96
PID 2236 wrote to memory of 732	2236	msedge.exe	96
PID 2236 wrote to memory of 4544	2236	msedge.exe	98
PID 2236 wrote to memory of 4532	2236	msedge.exe	99
PID 2236 wrote to memory of 4544	2236	msedge.exe	98
PID 2236 wrote to memory of 4532	2236	msedge.exe	99
PID 2236 wrote to memory of 3564	2236	msedge.exe	101
PID 2236 wrote to memory of 4892	2236	msedge.exe	102
PID 4892 wrote to memory of 3428	4892	msedge.exe	103
PID 2236 wrote to memory of 1180	2236	msedge.exe	109
PID 2236 wrote to memory of 1180	2236	msedge.exe	109
PID 2236 wrote to memory of 776	2236	msedge.exe	108
PID 2236 wrote to memory of 776	2236	msedge.exe	108
PID 2236 wrote to memory of 3664	2236	msedge.exe	106
PID 2236 wrote to memory of 3664	2236	msedge.exe	106
PID 2236 wrote to memory of 700	2236	msedge.exe	107
PID 2236 wrote to memory of 700	2236	msedge.exe	107
PID 2236 wrote to memory of 776	2236	msedge.exe	108
PID 2236 wrote to memory of 776	2236	msedge.exe	108
PID 2236 wrote to memory of 776	2236	msedge.exe	108
PID 2236 wrote to memory of 1180	2236	msedge.exe	109
PID 2236 wrote to memory of 1180	2236	msedge.exe	109
PID 2236 wrote to memory of 4376	2236	msedge.exe	110
PID 2236 wrote to memory of 4376	2236	msedge.exe	110
PID 2236 wrote to memory of 4376	2236	msedge.exe	110
PID 2236 wrote to memory of 4976	2236	msedge.exe	111
PID 2236 wrote to memory of 4976	2236	msedge.exe	111
PID 2236 wrote to memory of 4976	2236	msedge.exe	111
PID 2236 wrote to memory of 3508	2236	msedge.exe	112
PID 2236 wrote to memory of 3508	2236	msedge.exe	112
PID 2236 wrote to memory of 3508	2236	msedge.exe	112
PID 2236 wrote to memory of 4360	2236	msedge.exe	113
PID 2236 wrote to memory of 4360	2236	msedge.exe	113
PID 2236 wrote to memory of 4360	2236	msedge.exe	113
PID 2236 wrote to memory of 2060	2236	msedge.exe	114
PID 2236 wrote to memory of 2060	2236	msedge.exe	114
PID 2236 wrote to memory of 2060	2236	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download2333.mediafire.com/y46fj2kxo6ug0EFvlMEa6SM87Rp_cCmFCZcb89vo2dqYP8fj0iLWLAudzYXbADpMOXFy07id8xzgpuqb1uKdbszZ2toYm4AeLwt8qMmlfc6DEAobvh90rSG8bx4Jm26iF6w8DmJVbDptBT0zq1nIFOX1TQjKkzlcew4tu-_3/jztwgxcrsfk6mxi/bloxdclient-new.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ffc49f8c188,0x7ffc49f8c194,0x7ffc49f8c1a0
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12760821761424723254,10075678765317285196,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,17678280709324363754,14794413962085968039,262144 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,18272964904830985958,5169296735643280,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,112307708525624856,2985632168706551376,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,11727695800403295394,13535002365994832909,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,16863928588388059326,15204000277202920011,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,13396629696767137130,8682119170195269152,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,13409559176993272157,8035311369182285264,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,6621532808046343761,16663533871310970164,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,5680532843227812240,9574890671845216498,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16641612004254217652,1109870892203381586,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,1189538130709017572,1086462352580292311,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1727954618806700863,2978568028476075902,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8710013612384859360,17746376929712206750,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8710013612384859360,17746376929712206750,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5547477683083007961,7000403447404948445,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3748685046141903420,7208299999606413326,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,961608760405401510,6795934164692996116,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,17272754240774660772,9227070666223808540,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,12740061883749353954,5217047505615844978,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6540,i,13863256679903370885,5172531703508089382,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,2892150350394835433,16447774126550641998,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5036,i,14689229360161763202,9362977303099527843,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6432,i,3584995480997280227,3945607478392904902,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5112,i,4074828432819952819,9567738202648511935,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6784,i,11570239557520904818,11891657316256312211,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5116,i,12640912051187742531,11987845928962379436,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5100,i,7270167026232847472,3141641323705259461,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7060,i,15978771131153944357,17974847323982545690,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,15444766518696130416,1660854301469968565,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7700,i,8926510238721681668,1352318814042723610,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8032,i,14961779770748489680,17011466090533998976,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8040,i,17957468776126182074,15144570264950430245,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7140,i,14426957772613611494,16753977765208231613,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7196,i,4193026272701704687,3683546634133290851,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8504,i,2176380282611726073,81427179993658,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8696,i,3879132630685290645,595811539526862115,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7520,i,13805803757553689899,16621503348204841867,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8416,i,3423411601146280700,343060278787875278,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5176,i,1323175498332742889,9139606302566488105,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8156,i,8129112130004378468,16848175709482927392,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8060,i,5013750574555701267,13582213911639200911,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8076,i,7541413764136293392,8817356244758517923,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7172,i,16547858280070105527,6621195200226604602,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5496,i,15504793700029890187,10503233562508402033,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8916,i,11242253960061056313,11923363634105858572,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9132,i,7757706045695484315,17491328569590729948,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8964,i,8653727616897171698,16560750188062237855,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8968,i,9711129669466098833,4787899969276436643,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,15169099461629379871,9704925653857643835,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8844,i,6757981658935265903,9255376700740050516,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4704,i,9327564996230884573,10219855574070708412,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7208,i,9481410169550265721,6091430099756177152,2097152 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8932,i,12643851077482331344,717725723614051871,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6630848779266812705,11585307144308301551,524288 --field-trial-handle=2416,i,748144875929613018,9147387378455390245,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5220

C:\Users\Admin\Downloads\bloxdclient-new.exe
"C:\Users\Admin\Downloads\bloxdclient-new.exe"
1⤵
- Executes dropped EXE
PID:5432
- C:\Users\Admin\Downloads\bloxdclient-new.exe
  C:\Users\Admin\Downloads\bloxdclient-new.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:2868

C:\Users\Admin\AppData\Roaming\WindowsUpdate\winupdate.exe
"C:\Users\Admin\AppData\Roaming\WindowsUpdate\winupdate.exe"
1⤵
- Executes dropped EXE
PID:5744
- C:\Users\Admin\AppData\Roaming\WindowsUpdate\winupdate.exe
  C:\Users\Admin\AppData\Roaming\WindowsUpdate\winupdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1788

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6e4952a8635e9008efa62a136cdf3d2853ed345e8c86a35f1df16beced9f18f5
MD5 2a651783ef3f8f741afac0776bdd037a
SHA1 ff8e09d6e8eb6fa3ea231d3c3c7d99b1b710e624
SHA512 7ee212bd884498e09580fa551902566167f2e10add29702ec91550c56451dcc2e84cbf0026397df434b8cc4388677009abc275e66be85e768f045bff90e19c01
TLSH
T1D6D0233177EDE8D1D1B610378514870167DC05D561275545F3548C2E8C77055F9CC9CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 33KB
SHA256 bcd9f8d1ec62670309f0a0f4f65ef09917f006d8fe3e1552b2088e92dc052e9a
MD5 ae212a9ead4ad33ce324d9a0cf02ba0b
SHA1 e0e823c9785359ac283fcd21deb4637ce4fec5b9
SHA512 172884edd7caed133dfe09db71e0831f85b43faaddade1731e2ec7dc6bde8b68d5120c22bab5ac46e6f43a84e3a2280d8d584dc5c5b2b2112576bad63b0d3169
SSDEEP 768:NxPDDlDtMz7ZYRPPSi+BUjSNdN6AxSkfyIO6U0oJRtSQnEhfU:nPbCUPiS8woSkfPOZ0oXMQj
TLSH
T15BF2F1EF93F8B73648368C04ADE345B5A9E432E9C1E7B0F93741709A4044A185C6DFD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 67KB
SHA256 bce093af108230ea2db61bd0952a141e30e7f4ba00a67027203f833e187c1250
MD5 2a51769195f13a7a88e41761b38d8b87
SHA1 78cd7508f8baaffb055d0ca102a2396b24a486a7
SHA512 8a0b557c41c1aaaa4809139bd5975867f260011e7207d878200abe200ea56946869e2283a67adb8ed5a9aa19fd0fe2dbcf2262f9874ce761304ae818be39108d
SSDEEP 1536:LngSJee4UBGHuUeYXtwCKyLdGopqyV6JW7+ISbwIMD5P:LngSj4MS8AwCKUMYqy4O+IScN
TLSH
T1956302820BDD2547FB7BCD52ED38AD812FE88CD5F912D30AD4C58781464B829C563E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 400KB
SHA256 775287ab4d357763868196d4c7eaed405acfe675b4b0a8a4bfeae537e431150b
MD5 34958edd299d652c61951aae884e8af5
SHA1 75c2beea11aca1ff6c1fd6227dd17121813d4980
SHA512 d6b54025a3867982fcc38c4346f90e318a611de68e6895bd8b888d7e4b4e019e222c2e57de31c454a60023b75dcc2c9eb0d05b3ffacd8e638cba78b1eec50f27
SSDEEP 6144:Zuz4tBYPnOfAOgER3ajuZsmbpg6gv4dDNvUjHLxlbJWORSSX0RrLAYMT2qR+mw1f:Zo4tjfOHjuZPpZnKjrxSRLAE/PPX9p
TLSH
T1F8942325362E3BCF798B34089FFB9E3196AB51818AC2942DE722673510C7C85D3F9725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 6009cf2acca19f15989c5c85176910b363f4d064e7c138b72917ef03fbef528c
MD5 4f1f628e71633798686cce3c9e2e2c4b
SHA1 e34dfa7165cba48661727f042c33b44bfa49b127
SHA512 2007f9a1c9b2539bfb9a78c9265b6795de93db91dbe0590cf7e194ccd399f81bd570aae487d4301d22569e12e19efa2111b73a71562a30b0fbb9246135e865a0
SSDEEP 192:/017vrmcrkY1pHWToDaW+bCTNCkfQ37Dg8ZbY/S7RE6:/01vi0kY1pHeo3+WpCkYXg8ZbY/S7V
TLSH
T16322F969F0853E22EB104731F0E629E07DBDB2A9289F9E4E134C0E7D25A37E5BC50C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 756ae3832aa91e932e41295d34a4f0a520ac87dcbeb522a456b9b742e14c9e8d
MD5 c336371a2d219bffcff70ea97cc37d63
SHA1 116e956a11cd9de032e81df4566c79db07ce6bef
SHA512 0d360c4278e84f784dbbbd3e17fee738a2516bfef076410b6d3c4c830280c456aaecfafba2f1d8ad2ae995e278ff66cd643ed86bc522f51fc9cece4f61d11bfe
SSDEEP 192:W017vrmcrkY1pHoToDaWJbCTNCkfQ37Dg8Zbb/S7REq:W01vi0kY1pHco3JWpCkYXg8Zbb/S7x
TLSH
T1C622F869F0853E22EB104731F0E529E07DBDB2A9289F8E4E534C0E7D24A37E5BC50C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593f9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593f9f.TMP
Size 3KB
SHA256 26178c088ca3dd4c2107263394fea7e765c231ff519e649d183308f242c4d26c
MD5 86017ddde9c138c36739f7563e0799ed
SHA1 d6b68d00897d6cca7cd734e76517ed5dd036f868
SHA512 1ed52800d08f8ff7cab30151df5989ee6beedd16939f87a4f38c6c8028fd8813f3c1ccadf8dff1a7bd902dfa70b2f9e48e4463afa44b4554d166c021a02f322d
TLSH
T10F71832EC1627773E3918731D8F305F0BDB5B49E594F0E961C2C58BE6AF6B518C18268
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 e747d49137f450d98cf57f275e75727367c9f59111a5c0dee8fc4bd69a103430
MD5 d6b440238c55b44800c759d7950ca844
SHA1 b23619ba0e1e81f8284ddb78fdbd80a7e50fe5a2
SHA512 69f047ad83fc81b5515d412fe18ff4ffee8e8432c1551f06597f9e1179659dbb64e75580325834984f591bf0ca2ea5a621cb20123a6e1027f83342c7a42d2076
SSDEEP 384:DjMMBiUR3AuuzYnZkZSBce9exNJ1+Wh+BZeODyTaDrJXdvCzqTL4aKD14IYmG0mG:Gg7jnO4GzgLTzvJfIWM
TLSH
T1F5D2AAF783E5C52E891156F4A610AE2BCF1D1615432C3C1AC8D5EE8BE3E3072E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 62e65be9653a49ae2c84a40617b2a2f458a58edeb534a434314e815c1afa6ad1
MD5 ac2e3289a51dc36fbe07d30972fe3c1b
SHA1 0cc22d143d7dbcbf20ce437669240be008a54223
SHA512 13de7d6b84330b993f06c3ec0c5b9fa0e2fbee55680b44382a7b28b63221633f04fd86ad3f3501934c8fc888b10a61ba4d9383b7f87a95dd1264c336eac88320
TLSH
T1BED02373110074B9677D3E8254B9BC4FC33710140483FDD550D0555C063949C4507141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58d155.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58d155.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 797897e67fa0954f31c24cf3c3c9c3336ce1b539bc9e69af5ff37238d46fbf75
MD5 04db5dcccc3665d0c896e623ac6d29dd
SHA1 121427a4b0e4f61c3ed0455ebac956c7c23e0f35
SHA512 907e939596967bfca33110044618e3e9926c68af4841f414d5265bd4918c341b84b572d09b99c60b71060dd381eed721d4a936b166b866de885a6ef3af2b82ce
SSDEEP 192:sxZhRayM/jK1Ml8MFs/fJssAyvuIdp38/W6+WNmXP//MPM/dzVIU6BB1fih0Ysai:sxZhUds/fJssA8/s/bq/0mVa6Nc
TLSH
T18E62E8576B346A778CDBD219F541FB17D6F9042692945E84AAFCCB0C00E6AED2203C6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 b572ae02cdb2abaaa674c00f687b854036e47fc737bbc26076970288ca91ba51
MD5 3f3a8e209342a8a7cce0d1e1195f108b
SHA1 360f44ce2491abec659a818fda90b8b2dae1b992
SHA512 7b155384b13f245d90025afccb2e2565ed4f82c7ff87559a5221c41a69a688831ad8c1a98bb5db8b33f4a1b989779daa08b9a468e8aae469fd8f0effb36959f3
SSDEEP 768:sJ4Tm4s/f2Y6q8C69/b13XRUzalerkUjqJaE:hTm4VY6q8Vp13hI2Uj8Z
TLSH
T198C2C897A3301ABB49DA9529F411FB3ED3A904269AD05F85EBECCB0C00D76FD2511CE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7cd80e33eb66f20171bacae474c91812847cbee762d14ef2bf6a0432e0df72a4
MD5 d17f4a27ccf0faafe5c91fd0f6b191ab
SHA1 11f164c3d384cb418129b399a0306ca1e5d927fa
SHA512 98b76d12c382c86048c4c8d46c9bbbdb273106b0d8f0de3a28b8251b9a58846f10e86ea9ec9be2afd586a75f2230173eba1093a90585d5d4058d4d1fd4050db5
SSDEEP 384:sxZhkjvs/fJs3A8/w/bt/YPlfBh04UV86NN:sJys/fWA8I/bRalfRUy6j
TLSH
T1A482A697A7342A774DDA9229F441F72BD3E5042696905FC1ABFCCB0C00D7AED6112CAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 1bf660808ceea233606881f089808b10f5c6d3ccdb20d0590ac3bda9121f1ae7
MD5 dfc4be2842e7e72c72f27969ebd733ed
SHA1 94bec4a02effe67e5d36cb89e1180fb3885d623f
SHA512 8f617f703528f9351f3f953563231138ba07a1b5f73f576b72048a37d2504bfa3f22dfda01df013f7635f42eec28515327b8af33d06953796ce203bc2f78c842
SSDEEP 384:sxZhn4k7m4s/fJs3q8s9Hy/b475/YPlfBMc4UV9ZNGaE:sJ4km4s/fWq8sM/bKalfSUrZUaE
TLSH
T175B2E797A3305A7B49DA9129F412FF2AD3A904268A905FC5EBFCCB0C00D76FD2111CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
Size 3KB
SHA256 2330957cd34ebadfc93397fa1be2a1d2025983a6dcf821c5079a9ac970473921
MD5 53ea9daebf72d43965a750a88754d684
SHA1 6b7886777b5d6c08377a019330f868f1233c392d
SHA512 54b8d9816fdb62e623ae45063874ca1f2c056724e2e119e8b0862935a91d6bcc6441e22f48cd8e1ba4fc67842d02bbb5b83cbbf652c5837a108cb9ab9ff2c184
TLSH
T1B151C70D4C8223D9EAFC51B285F308013B79A8ED1B818D2B54FD54B8AA877692D6D228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
Size 2KB
SHA256 7e9b1625a4cddcfbcd657b433c6cd673c899570d825bb5ccea71af5f9e6100b8
MD5 398c9a28e61ba3f217523c2c6e6dd6b0
SHA1 c10da19c6a1243577eb62ea8b6f85733e29d4497
SHA512 d0929f6bc9093f47a6beb4e3b65c850fa9954521d7ccc4458e4237e48b0c144c8e3c79eddafc561f7bfd8294cb4e388b5b5020596b2437c327a829110ccb68ce
TLSH
T18351A64D4D429B5EF8AC117315B364A43774ACCC66605A232CBC12366D4775E0E5A2ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587da7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index~RFe587da7.TMP
Size 2KB
SHA256 55458fa9ea74759a2f427c5c3b34a7268aa14e131d99c0656b542aaf09cb8c3a
MD5 db2c97da9908256accb10f2504eaa3c4
SHA1 b26d377c8f61029db4bbe28e0843131ed003f3b3
SHA512 a75f86087174065fe0e82be51319512cb76361f02f0af7fab9bd1af58129b91aa4281565fecdf0b73cb09ed1546019d951f174885c1431c545c3c96b7362432e
TLSH
T17C51A74E8E428629E8C440770EE3A8B43339680086157F1374FC5636ACD27AE3E0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 1be3f26398a404695ae5c39c9011d8bf9289938813f6152adc3de230e5a0d73e
MD5 d79a5837c39a219649a1b319ab796a11
SHA1 3929c0d8eb5976671ab7f5298a8dab05c7f41266
SHA512 ca4837998772395de3c49aedd315931ae5ab608ef6cc21cd7ecaa0146a73493587963aa3b16a8fc9f83769cd0a4078dd714011e978e76a95cfc2a1bb32901a58
TLSH
T1EEA0021402C5054BC05313B035D611B626605D12F601174941900788CC515A5899340C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 85ae739af1bc43348c698f4154532a71d57ab5757356311b29b25ca351e42caf
MD5 304c5c62acfd3f7fad6e4c0a7852d520
SHA1 bc7d4b9f17683e32ce2800388ba0c1235a5fec19
SHA512 f27f71929a1889128b2ff660ce4a05154f497f36578e3745affb711333cc2b97b601f6943813db38ddb1052f17e37ed03b4b5dafa5d429dc12fc9f7513c158a6
TLSH
T180A002115381406BEA5215B9159212421B14EE145511930744914048CC524C04E4140C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 caa2587544fda4455f6ac5d0a990c936411a73197987a06d8f9c6ffc1cb302b8
MD5 79956fe658a0768a17ae903c0fdc42f3
SHA1 c51b063807e5308d2075d788b370d1b5bafe1b64
SHA512 523c66849bffeeff6efe6fd8dd66e87a13bdb479af8d4fe00d86fb56e0eff9aae9aa10d28b1f5308fc717f5e7a30f3271bd149fec211de72f53919d34fbf6998
TLSH
T1A9E020F32DEB9C24ECAF97D614705451454D7914C908BC9F356B97C36171394241ED31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7bc1b5503a67892fc6a7486871cc575f65e77ce942b33eaeb3e38e96957ff2f5
MD5 18a858b482d1a2aabc3e1959c67c5b38
SHA1 b8ea50f64721c42459145c4f106afba14acfc725
SHA512 2ed95a75b6085631961176b2374310a9cb3b9363b58fedb0f509bbcab0778544479bebb6d686e49039026a79e563dd3f1177e7851b3e24ed85cdf7a2f5385336
TLSH
T17EA00253C6553041C2000274E08912C562148CA006062635C0F9A554F8E13504123408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d3b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d3b6.TMP
Size 48B
SHA256 97772a9769967d297346e6f32f27b2f3c5b47d24a627e77516854eca643fca9e
MD5 e0f2502e906243d2b1286b55f010d1e4
SHA1 4a15f625355716597d22a0178979ff237947188b
SHA512 439e88d59f811b522a534dae5613a63cf4858e6b019e2886b71da6d872f0d76a06c90d698cb10be6241de4fc664aa9b8226043fbe1fe5931b9a28af214eda6b6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0c2cbbc2e693298de3024e220ccf79434a17285129348847452c8f73880cae78
MD5 64db07cedf3d9404744f3b951c7491e9
SHA1 1a5ea09b67bcd0c1b03f0b2e0f68a1a592af8ca5
SHA512 7184e7fbdff01780cb958047390196786023775428c4c4555d462691844961d5fe16c07b049fb7d6832aff2af0c20a789f9a9f6e6671ca40966cf1bbcd953765
SSDEEP 96:KkUgKtem27GKEAmuvaKswHioKvaGiqYKXKhwtcgyP:6v1tlXbXw
TLSH
T172E14B1230BF22423C7E6518A255872B1B42B3733114A9AB7FA950B50D27E386DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0254e9d-930d-4c12-8f06-d39bb19aef7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0254e9d-930d-4c12-8f06-d39bb19aef7d.tmp
Size 37KB
SHA256 50e183e5d85942361ebc3eded80c5d033198b5ffe9ff18a3f4e9927bd56c6517
MD5 c8b6492c8d5793391e3dbc20b0dba110
SHA1 cd301d957bcd749386209d01a90b756fc0c0158e
SHA512 cdf0c14e149ea8938256cdc87834957c83a6efa15ffb4fbd3fa841cb9fc0aeac3c65e2ace77a764226f17b1ab3d2cbe64e229cdd62669064c221f927e0306278
SSDEEP 768:34l1j83r2LD7pLuLXemWRmeKQDC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3FTwALlh:34l1j83r2L1EXemWRmeKQDCu1jaKFTwS
TLSH
T124032C3B780CCB7E4F844E9CEC267F9A6DE8018BAA98895447FA444C03C66EF15165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590a47.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9ac9e429ad59ff3f42cc42e866107af8feda6ec3a728205b3f7108699519fbea
MD5 21e32780b8025dcfeaa03ad46a2c42bf
SHA1 a2bf29fe4cf8d3003061ccd0fdf4a75b114d132e
SHA512 8834d5e190af061a69b621155f23258bd558d984faac2652a20475e74ebd7e030e4ab8a087e7c5d252823cbf65eae541c7da5e17a5112aa96fae49556d29153d
SSDEEP 384:yNtNnNnb9w8NHUBTVReZtr/BgX532N8md+SX5deTi/eD7DRi2AI199hf2e:cjZbiHI//+SX5gTi/+N9Lue
TLSH
T1BC926C369A79BD638AA79E59F20636036FB4102B90D43F90EAEC1B1D01C769C135AD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1be61bbb90628a95887a667046cbe40d6a97f8d06687d8236a680e28cb957d56
MD5 d6c2f74439276d815b3cb8810d004c91
SHA1 53d5565a0ffcb42cebc05db471ec962c0ea1272e
SHA512 e11370edec8c63e8f911d82747903462d9ed02a04a3761593ea690d7d94558626923fbe6e0f038f0294f497d2fe6410e36c289654c841bb8ebbf21261ed3a8d2
SSDEEP 384:yYtNnNnb9+8NHUiKRGtvegX532N8md+SX5deTi/eD7DRi2AI199hf2e:xjZbEjCpSX5gTi/+N9Lue
TLSH
T1FB927C329A79AD638AA39E59F14B32036FF4102B94D02F90EAEC1B1D01C76DC135AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7041fe1890b9b6d7fc4c7d8e35c60e39e4aaea8e5fff3517b2f0671f07cb8321
MD5 f648f7276d8ea2997a2f6bb7e1f90ea9
SHA1 8788a8fc2a2b5d6a5da39704fd32a948fc2f7fc4
SHA512 892258e30c8f121127e6eac21cd3e68df64e14c61647329cae0975facb590f8d4807d5f9f1e8b531019ae81b0079c849beea8e76e58bc4f5b317a5cbdc1d968c
SSDEEP 384:yNtNnNnb9t8NHUBTVRwZtMtgX532N8md+SX5deTi/eD7DRi2AI199hf2e:cjZbjH+AySX5gTi/+N9Lue
TLSH
T1B1927D369A79BD638AA79E59F24632036FB4102F94D43F90EAEC1B1D01C768C135AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 248e16e2a17a50d61388c8c6d89cdf6baac1d5c223d2653d8d90aa3cb13a395c
MD5 ebd3cf4041016c36ce823519aba434f2
SHA1 586d6327c363ba78887d08918639729178fe6a5e
SHA512 b7122948a59588fc689ae5a3b21840e610ba48fb39393f3c870489a98495fdc04bc4b88b9dcd11d13e3ee31b32dbb8c46e1b5c8824898d2a516837455c952e09
SSDEEP 384:y9iFKtNnNnb938N88TUNTUlIldTVRcZt5tdDfwQX532N8md+SX5deEi/eD7DRi2D:RFKjZbtRwgBOF0gSX5gEi/+N9Lue
TLSH
T12AD2A4F689E79937D9AE4B87A33E6D465EBCC15774845980FBD81E0CCC821BFC206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3d65abd6fab962bb4e3c48b2c7a4b10ec2dbd70b1bb8e4c86ef03a64def4547d
MD5 fc1720136696c6ae4b64f99429eb1b11
SHA1 567048a64df716a9fa8cb30b0681752d022bda51
SHA512 fddfd5f519108931cc17159d36e316afa0d58b8553adc7cd4b910aaada91349965c0008aad555d21653902a4a7773acff27e3b5d03899d4e1bb2554abdcc9a32
SSDEEP 768:RFTjZb09wgBPtQgSX5gsxtsjq243sw+N9Lue:xwlkJg27f8w+N4e
TLSH
T1EF036DBA8CD7993EC89E6747633E2D165ABCC137B0A85584F7880B0CCD625BFE346815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 202cf4c15d12eee30594a936e3c0b325da67e0b446489bf4a5aa0f4c9a04f0f7
MD5 c44a64f50cfad638fad8ee26bff94bad
SHA1 e7f5d002b2adf36763509b59368817db2edc1857
SHA512 247bae48b42b02688c9702b48f486646f0d65635902eea9eaf504c67c97916da0aca094c8d8d173cf8903f31e0c4cb87354adf3e95f84ce535822fb9f1365efe
SSDEEP 192:6GNV6i5VQmiUygVTa7X5zPr2xjzormDZ+SX5gYregGQPqB/U6:6GNV62zppa7X532N8md+SX5deii/U6
TLSH
T1D9120935E968BC679EE3AE55B18736135FE4112B99C96F90DAFC1B1C0087A8C1359C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c23572a085a7041d1319826dff723e339e9263898bb1a59635a397c34f7dd565
MD5 55840c46605f47a47a3150c58020b9fb
SHA1 12b2d03dc40bfe3fc316b2f6fe5d0f611ba80a58
SHA512 ec1f99f32ea31a34e57a7c9a5f50aa95c0e8f41c0ced23f6786a1e74941b867aad441e882a13617d7cc4bc76929245e442d020bcc9b956613097d14f020b22d4
SSDEEP 192:6GNz6i5fQmiUyZdTO7X5zPr2xjzormDZ+Raj1fXU6:6GNz62hyBO7X532N8md+u1XU6
TLSH
T1BF02D835A9686C779EF3AE45B58737235FE5102B9A946F80D6EC1B1C00C7A8C1316C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 adde2d60d3b4870e11159fd7443f7c5fee41177a2d88138682e67108d6af8335
MD5 4442648376e1a96143644572db253410
SHA1 b1c0c9a1485b04f91f3593852d6d8fb6a26d407d
SHA512 ecf422efce3f9f3d23057d12f235f04fc01c80282a750210a78c322c09b32c38c0f34112afabe532fb78c2b817a7e505387038e77298e16b8b75159213578fd7
SSDEEP 384:yYtNnNnb9w8NHUtKREtS0gX532N8md+SX5deTi/eD7DRi2AI199hf2e:xjZbiAV7SX5gTi/+N9Lue
TLSH
T168926C369A79AD638AA39E59F10A32036FF4102B94D43F90EAEC1B1D01C76DC135AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7488e4e7688707a5922087659b13e26a0f6e4dfa80c5b5ca15fd55fdfca3385c
MD5 832099c0a937de757e1083f40f7084aa
SHA1 ca5eb8533349aae5bdb6c4e528fbafe748ed26e0
SHA512 09d85d938a2c0f6790d92c0fe2125793b8c328ba7908eeedd8adf67dd823472d9273ae25a56ae7bb8382278c4927a055895018905e625cf755d1d05e8443c376
TLSH
T156E002015314417DC07C1330014B1B301BD2C11001F603060AA746542C733013F30FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fd6cbe004a8f432ea3e4e6f20e4c738302719ef3264303ce3ba3f6fb93d86cc0
MD5 00d17936ecc4c7a542e66ec1606977fb
SHA1 e7ddb2c598f447db4da7e3fae637350d2387140d
SHA512 8db7a89dd01a2dea0e1a693a2f726c4c12a78219dc5276aa28da7745fa1f43dd795d7a0aa1fda4a663158d0ae56630b3dc8eac8814b5d186eaf0d6c39baa04b6
TLSH
T183E00141531441FFC06C1330028B5B202BF2C11002F703460AA646686C733052E70F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 729ec671876bc1d654849b974bde8602a1fc32d45c5acfa4c0079397a7eed2c8
MD5 e55ffa056e89dfba83c36213aaf321fa
SHA1 5514ea8079229e82fe9e42c2c822b041acc9a681
SHA512 c12fdf2554b87c1f1541060cf2aafe2882e901d25cf29b4bb0d869dcb7aeae9609df7b8cc25157e55e29e988f97a694d49e4c1e5de9f80bb2f07ac8ce3caa67a
TLSH
T1B4E00942A31441FBC46C1731028B5B202BF2C12012F753460AA646686C733052E70F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 88972b6ddb68186a60304962bfa7186a32a139b03d2cec000b9100c527a13f8f
MD5 952526b56cf702719e44494d7730d6da
SHA1 9b6e475060a7f9ca0ff74e1df6425b12d36d247f
SHA512 797b2115ffcf1a34b8c5c6eb2f8a874221f4a55c11f6430b8a5c27deab68684d8bfccf7599c5178bce6757a2b721c5f3cca2b12f4a6d08919efd458c9a042db3
TLSH
T1FFE00102531441BEC06C1330024B1B201BE2C12002F6034609A646646C633012E30F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589dd1.TMP
Size 392B
SHA256 6ba034c065f60c810b26c6d7f7039d7eefb54fa1c5cf84dab14f402ecfedd2a7
MD5 be9a727ee7a5c5ebe42cba4cb0762904
SHA1 0abd44a78cd002d14f6eb5b2a56ab70c50e83255
SHA512 481fe9e649098c07bab4004f2e9857f609e102ed21e752ea991710af05a33c397f845e67e313f3ef21472b393f7be07338f6702e6d744c432353f809b192d9e7
TLSH
T126E002005214413DC06C1230014B1B201BD1C10001F6030606A646542C723013E30D81
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 de6ea3a29cbea69f4706bafee797b5c32a9a3ec89e6ce9b711e44b56dcbc70e1
MD5 f826449b3fa985b304d55957c2b40b46
SHA1 6080aa75402c5a5e2154c2ace795f4dd96351b3d
SHA512 8e2876f1be915e01b37ec52c23e9df5ac084acb998fae4d1be366300db231b1f8ad9d23f934a4e4752aae9f42c3dab40bc545674d8079c896a177bdf1fcd0fad
SSDEEP 3:MsEllllkEthXllkl2zEf3l:/M/xT02z63l
TLSH
T11244040C7FC00D05CD0C10304011C35007F0D4140511D74335D104135DC77C01C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1a56f66f-0fcc-4411-8c98-12fed619c873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a56f66f-0fcc-4411-8c98-12fed619c873.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1bc83528-fc65-4d67-8f44-b9bdc5ba0ec9.tmp

Path C:\Users\Admin\AppData\Local\Temp\1bc83528-fc65-4d67-8f44-b9bdc5ba0ec9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5b1fb1e5-148c-4801-be55-7a823a1dd2dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\5b1fb1e5-148c-4801-be55-7a823a1dd2dc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6d0e3fb-6ab2-4847-8b57-a13fda0afb13.tmp

Path C:\Users\Admin\AppData\Local\Temp\c6d0e3fb-6ab2-4847-8b57-a13fda0afb13.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5432_134248064528238482\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5432_134248064528238482\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2236_1271036232\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bloxdclient-new.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\bloxdclient-new.exe:Zone.Identifier
Size 321B
SHA256 c40e9401acc1c878c07865657468faa3c15e40ed123d06e65c9d42c182823c56
MD5 ab192a9c99f0b1d18da9ca4cadd23ed9
SHA1 a9d9da765ca6362faa8dd0ec5efbea9c3803a8bf
SHA512 782262161ce0434af6c90d26b95698b6195be58e26f74df811a577bd655ea5eaec3b5271467f62054c59d4c78d14d68b65c952feda00d06ae397160feb4e8c0c
TLSH
T10EE02DAF8082C194072DD68001BBB4ACB0936EB8CAA4C01C380084C7E8115E992C0C07
MD5 SHA1 SHA512 TLSH

Submit Download

bloxdclient-new.exe_Decompiler.com.zip

Path C:\Users\Admin\Downloads\bloxdclient-new.exe_Decompiler.com.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

bloxdclient-new.exe_Decompiler.com.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\bloxdclient-new.exe_Decompiler.com.zip:Zone.Identifier
Size 216B
SHA256 d1dfd08f2b461b82655232b0d210f089634c278d44770b13b20c03d9be9b30cf
MD5 00bae7336089aaa42ea12f3aec2bb394
SHA1 3be39a26a26c5daf41b7bac9ea3f4c394def4b8c
SHA512 8a2596cc4d222742ac4207a15ab51859483ac58a52980ccb5d408350c49a7bd1905e1e8ff1e77d1ebe1ad0a06d42238d21ae192ebd7f5fb8f1398bf1684aafa4
TLSH
T16ED0A7A20BCCC4D8059947817B91D308A04395009C62D294D26240D2EB260A8D379637
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2236_1734374253\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2236_48513961\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-2352-0x00007FF619920000-0x00007FF61DBAF000-memory.dmp

Download

memory/1788-2353-0x00007FFC26E20000-0x00007FFC2D1E7000-memory.dmp

Download

memory/1788-2363-0x00007FFC26E20000-0x00007FFC2D1E7000-memory.dmp

Download

memory/2868-2349-0x00007FF72B010000-0x00007FF72F29F000-memory.dmp

Download

memory/2868-2350-0x00007FFC2D1F0000-0x00007FFC335B7000-memory.dmp

Download

memory/2868-2356-0x00007FFC2D1F0000-0x00007FFC335B7000-memory.dmp

Download

memory/5432-2348-0x00007FF72B010000-0x00007FF72F29F000-memory.dmp

Download

memory/5744-2351-0x00007FF619920000-0x00007FF61DBAF000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads