hxxps://github[.]com/pizzaboxer/bloxstrap?tab=readme-ov-file

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/pizzaboxer/bloxstrap?tab=readme-ov-file
Sample260730-d2fg6aydpf

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
98	4944	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	camo.githubusercontent.com
42	camo.githubusercontent.com
43	camo.githubusercontent.com
44	camo.githubusercontent.com
47	camo.githubusercontent.com
48	camo.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
109	api.gofile.io
110	api.gofile.io
113	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298558134043948"	msedge.exe

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004fe594f939e3dc01bc5d9dff40e3dc0186edfec3d31fdd0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{ECCD97BD-952E-4D9C-8CA8-B0074042A006}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2732	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 936	4800	msedge.exe	87
PID 4800 wrote to memory of 4944	4800	msedge.exe	88
PID 4800 wrote to memory of 4484	4800	msedge.exe	89
PID 4800 wrote to memory of 4484	4800	msedge.exe	89
PID 4800 wrote to memory of 4484	4800	msedge.exe	89
PID 4800 wrote to memory of 912	4800	msedge.exe	90
PID 4800 wrote to memory of 912	4800	msedge.exe	90
PID 4800 wrote to memory of 3632	4800	msedge.exe	91
PID 4800 wrote to memory of 3632	4800	msedge.exe	91
PID 4800 wrote to memory of 4304	4800	msedge.exe	92
PID 4800 wrote to memory of 3632	4800	msedge.exe	91
PID 4800 wrote to memory of 4304	4800	msedge.exe	92
PID 4800 wrote to memory of 4304	4800	msedge.exe	92
PID 4800 wrote to memory of 3820	4800	msedge.exe	93
PID 4800 wrote to memory of 4980	4800	msedge.exe	94
PID 4800 wrote to memory of 3820	4800	msedge.exe	93
PID 4800 wrote to memory of 3820	4800	msedge.exe	93
PID 4800 wrote to memory of 4980	4800	msedge.exe	94
PID 4800 wrote to memory of 4980	4800	msedge.exe	94
PID 4800 wrote to memory of 2228	4800	msedge.exe	99
PID 4800 wrote to memory of 1964	4800	msedge.exe	100
PID 4800 wrote to memory of 2228	4800	msedge.exe	99
PID 4800 wrote to memory of 1964	4800	msedge.exe	100
PID 4800 wrote to memory of 1540	4800	msedge.exe	102
PID 4800 wrote to memory of 2396	4800	msedge.exe	104
PID 4800 wrote to memory of 2992	4800	msedge.exe	105
PID 4800 wrote to memory of 2396	4800	msedge.exe	104
PID 4800 wrote to memory of 2992	4800	msedge.exe	105
PID 4800 wrote to memory of 2992	4800	msedge.exe	105
PID 4800 wrote to memory of 4312	4800	msedge.exe	106
PID 4800 wrote to memory of 4216	4800	msedge.exe	107
PID 4800 wrote to memory of 4216	4800	msedge.exe	107
PID 4800 wrote to memory of 4216	4800	msedge.exe	107
PID 4800 wrote to memory of 4668	4800	msedge.exe	108
PID 4800 wrote to memory of 4668	4800	msedge.exe	108
PID 4800 wrote to memory of 4668	4800	msedge.exe	108
PID 4800 wrote to memory of 2732	4800	msedge.exe	109
PID 4800 wrote to memory of 1020	4800	msedge.exe	113
PID 4800 wrote to memory of 2184	4800	msedge.exe	114
PID 4800 wrote to memory of 2164	4800	msedge.exe	115
PID 4800 wrote to memory of 1348	4800	msedge.exe	122
PID 4800 wrote to memory of 1348	4800	msedge.exe	122
PID 4800 wrote to memory of 1740	4800	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pizzaboxer/bloxstrap?tab=readme-ov-file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16485571977289853371,5160738583796428979,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1365697712431280554,17551306354776522666,262144 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,17331361708264629281,9741518906520322701,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4885966893017674581,8875802398084225420,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,14993805248297179190,646732536553979154,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,14247098303479523918,12147973079851907793,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2996914598231301754,17122998432762825056,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17587217169652397652,7644989551896965680,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17162966557451523761,18337537468671026226,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17061510682687447306,1192057127915430064,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,17061510682687447306,1192057127915430064,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11778047196743581498,10622755078407250869,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6336,i,4190743045426425758,5384982797693273139,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,13472856123940970519,2141463247048407537,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5988,i,10254053239259066977,6085508881024611900,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4384,i,603833669721247477,9551912572566913095,2097152 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18185493472116800921,8730393958376278575,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,3260596776298610130,3566478612746240820,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,11031322503274028224,609210233739126298,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,16258810633926686005,10011027699608577694,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15955270738912756534,12925196655909896214,524288 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,13586883026536006653,8067904880498710136,262144 --field-trial-handle=2340,i,9733572286174133605,17439826083407026167,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a61f600488f5909ac81cd8b312c047cf865bc7dcb74b210069569bdf0031318e
MD5 fd1def95a61607362a2f573e53a1651c
SHA1 4dbe5452234b943e067d591f15d2f0f0f87a9187
SHA512 15bc3423461c6b5ac215d2e15374647e67079cf502f45307fa567faa089055362b57300ad5d5bab5fc257b10c6bb78279ea0e2d010dfd71eeb07374af3409a3f
SSDEEP 96:4v3GCeKiIEy//Ozu6T0fklpOvHcGSW09oesis84jag8mis4w:4f55iIT/kT0gAHcN4eu5ja/i4w
TLSH
T157D12D8D3251A3B3CF921E38F3DA4583B5F25153064FAEE3E2CA057D181979E0567A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59621b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59621b.TMP
Size 3KB
SHA256 c01335fc2c4ce6a5f1a482a990ad813cb9d33fda703842172056a0a35f618544
MD5 1eaed1badcd2387c81084b011232a2b7
SHA1 7782f0f7c5c7711309a5df262e82ebdd602dd3c3
SHA512 633d40cfa1a59194c50f958e3860ec5d5ab176e641ff776676af04db2be231d8b3691074a007e063d3190026c3d7ea54cd410dc21508c7ae36ce30f57c692c2e
TLSH
T1CF711BDD3322D452D3600E30F7DF0693B9F141980A8F6D56F118597D690976F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5a1171c82560d7fdf5bdaf3ddbf8583aec57400adcefef20fa5cd2ce78edb85a
MD5 b1f1aeb887dbf6a739415a0aebb1a785
SHA1 93f6d920c7c16b6ccb7e14a9428dd34b6f37ac49
SHA512 0a363740b3bb6b41aebbb237bf019b0e1687fbbcec1dbbf6e627c1e877a9321b3783114998f60508922f10f4e15d7d1486bfd95e0fea09d9944615c2e57fa48c
TLSH
T10F718BF787F5956D8A2256F0AA04EE1BCE2C0115831C797985E0AE07E3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ac970efb-2808-4008-8fba-766bebf459cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac970efb-2808-4008-8fba-766bebf459cc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3bbb76aee80b60d1d6e9d4804c86133e4af2ebee494a4084aadccd5b4169dd38
MD5 3c6102987b57dcf7de356849f33a5a43
SHA1 e87197cb977bf1ba21ceab6e180520bc1861c299
SHA512 c2e95a3c90b17811929f8cffd071f46f623d87cddfdb3024c6f98a7d93fc0ffa48b102d004bcd80a3ffd655c4ba98a2edb7fec70a9ca3ece6a33938985c2aefd
SSDEEP 192:sxZGRJyM/jK1Ml8Mkn/feswoQbfIdp9pTHW6+WNYUY/Yw0W2nIgrJ:sxZG7Mn/fesNQbQ7Hbs/09
TLSH
T10352E8166B349977CCCBD209FA45BB63D6F90462D2945E44AAFCDA0C04E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f0d279cd14cb8ddee67db0cb6956b62d4a7b76d5373296082493506db4a6e83
MD5 610981fb215c601fec9cda446881be8a
SHA1 a93d38a5014d3d6c2e66886548b1d74f50cba7cd
SHA512 ed89f695824976bf7511aa9663b1eeea49af380341acc51ccaecff64c13c637c8fa9a99722fe2c0b0cf954cf0be7acc0d37f7dfbe1893a70dae698a29450937d
SSDEEP 192:sxZGRJyM/jK1Ml8UQs9n/fes2oXbVIdpvpLlGHW6+WNqcMC8pNzXYwaFEnIg54J:sxZG7qqn/fes7XbmiHbJSPXfW
TLSH
T16862C756AB345A77CCDBD219F945BB63E6F50462D2905E44AAFCCA0C04E6BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c48f8ec8bb499e34c2b8d9798f2b38dfdef60248919130e10850a5816c33938f
MD5 8f032be6daa74ba2193c78f1bd302655
SHA1 782d827e1ff2bcd6c09869296b4248644b170af4
SHA512 c257a141a288f6fb6264bc7fdf2332be36cf0b9cbab1e04d1ed611fd5b6686ab9c3cccaaed6d60fda1ca281fa34ac2e8a8f8a16c6b03e343f5f2d855cbbcf8cc
SSDEEP 192:sxZGRJyM/jK1Ml8M9n/fes2oQbfIdp9pTHW6+WNYC8XYwGW2nIg5SJ:sxZG71n/fes7QbQ7HbOX6c
TLSH
T18352E9166B349977CCCBD209FA45BB63D6F50472D2945E44AAFC9A0C04E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e0f4e648839090f91e25f8ce68b115c24d164e82251a6b4b075475e55af0b248
MD5 5fdbfc9975e59af444fab87faaa91eef
SHA1 8b9c53453c10bd21648865f76b57f4ccd662c0a6
SHA512 1afca8e0bb8bc430361e23c0315a9ce003ebcd2c298a205d5931f7955e123082b88350097a6b327e7d4808d4fb9a7fd2e2a01162a4f5996e9b04aa3216a0232e
SSDEEP 768:2f4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d9roh5cWap:2f4jeXmWvmKLEu1jacPLZQd2ML
TLSH
T159D2093B280CCF7E4F844E5DED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aab0e2f3317ba8beaedd20b77cc467a5b3d54dfa78e58f7bdde449537e85cae6
MD5 7174540fcd0cc179a56bb74008164c87
SHA1 42fc8a7d23fb1c353d7e790a4ef15b8d2ab9c570
SHA512 22681f4d365b64774c970fd08c9b8c3ffb731858c23dbe16714eb62e7d6ef7b00c6f6912ebe4d3d441d8729c493a336ea2002de596d171b7cc33676b37528c31
SSDEEP 24:Kd9f4LiandPrD4bf+4fP8tayd6qm4a2+NIjQmKilhaum1EY2SmsM18w3yXYlfQDy:K0CFI9K+IgXyp6IfKP6AvnI5KY4su
TLSH
T11E912612707B52413C7F680996648A1A4B82B2733514B96B7FA840771F37F688CFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5963c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5963c1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7b7cd54ea5809ac87f7f49780927670405ba99105eb37a16c664c7bba9770933
MD5 b0b635836dce3ba819467945b981587d
SHA1 1ef5104c8e5b2feec66675ebd21bf9873ce95bed
SHA512 70d65dd99e1c597a3fddc7139b8c2b387d369ecfba9f36b509ac0ab27de82d6849984dadc979213f307a3daca73d85ada7aebd6a340d05b599d4da34f79fddb2
SSDEEP 384:EZcIhsN87OXEQxqf+G8WYWXbjFjvOObjI9G6w7VE:ihedyx9729MVE
TLSH
T144929F369C385D7799E3E552F4CB36234FF89127E7D46F84E2ED6B0C049A9AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 707c73fa31e9ebeb3efaded3fca31007f5c9bfeee6b71bd08df8f707bdd9d68f
MD5 6878ea32e6bc306253feb60e1ff69b21
SHA1 7a9a4f0d5fea4d0949a0fd29b9172f8010604d76
SHA512 76a318fa53e8c0b87dd19618e7f3dbc62da78a38f896c742492e942fb58e5da6e2b55b69d3e1044e92ce6af61e6c3b15dbd418ec2198799c18b9c8f5692cb21c
SSDEEP 384:yiFPZcIddsN08TUNTUlIlYOXELMqf+G8WYWX/FjvOObjI9G6w7VE:5FHrVwgb1yx9729MVE
TLSH
T1FDD2F6F248E78976D9AE9B43A77D2D224EFCD067F694AA40B3D85A0CCC465BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b294d069fd84efbec5454bbfda3492c9e4ce7001ba364138046be5944170db6
MD5 8b03a9eae1f58d23a646dbeefd1189f7
SHA1 37064c8f500e7adfc36588c474d509500bcc0703
SHA512 e3f690d5595fb340628f6b2f34b90d571a7d98918de9d654673c8f3d16535edeecba983bb493a3b8f0c71a3bda253b6bb58a5dc9c22ac21d93ba298da85e6018
SSDEEP 192:EONC6hZ0QmiUyBBpc/+jV0jzorWYt5wOZHiU6:EONC6ospu+G8WYc2CU6
TLSH
T14202DA35A8686C778EE2AE46F48737235FE5112BE9A56F84DAEC1B1C00C775C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a8eb18bae4895ac8379bc69a06d0e9da586b8d064492351ecaccc2634228384f
MD5 86a8a212dc615b5856807a5c46786cf9
SHA1 1cbf355b62f87e2fe75842c022444d2eaf0bba14
SHA512 c65104c10688ddf36011818b05ef0953487aa99b81a8e9e549b0c35bbd55fa0c04eebf5d228d0b6cef2cc4dc7d64ed4005f04877e9239bf5b182dec6d42c220c
SSDEEP 384:EZcIPsN87OXEQEqf+G8WYWXbjFjvOObjI9G6w7VE:iPeQyx9729MVE
TLSH
T111929F369C385D7799E3E552F48B36234FF89127D7D47F84E2ED6B0C049A9AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d9b6118693d14dbafd0e34c313d6c27c2cb18230356b46742aeaab7392324dd5
MD5 92b3be561adcd39e2b757e29f14d6a46
SHA1 d6c063f1edf577fc1e90a297e4666e8b0fae48b6
SHA512 dadd07a9f4b028890082d106aa5eeebffa56b950e8fdbb3e589c6c1153bedc06b8e315a4363636e0fb26cb0707a637d97de020bd3e878fc2b36487658e7ac2b3
SSDEEP 384:kZcIPsN8YOXELEqf+G8WYWX1FjvOObjI9G6w7VE:CPddyxv729MVE
TLSH
T1D1928F369C385D7799E3E552F48B36234FF89127D7D87F84E2ED6B0C049A9AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f511bf8274126f76d17de4dd2f1424bb79cbb961ea908f652d3cc136b798bbd0
MD5 c7f93e1ed7957555c16f9422c3596128
SHA1 d3a880af32c27d03597a752eb8ae44ac809bd803
SHA512 07591e12109486b0c9cfbc5f8bacda377853204c009d97db39f7ad46d260d05c4fde3c5a80a3679b257e0edc696d0e64d4cf464d554a8e626c0b892e1b6e9818
SSDEEP 192:bONF6hZ+QmiUydB2c/+jV0jzorWYWXT5cOqoq5vU6:bONF6+u2u+G8WYWXu9jvU6
TLSH
T1B112FA36A868AC6B5DD2A546F48732234FE95117EF95BF84D6EC2B1C00DF66C134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 33add96a550040a194525041f0b47615552e08b687638be47c6b72421479cb20
MD5 a28d101f6dc5d9917e96d145748d0db2
SHA1 e4822a3f693cab044e8683b7c42e72d0ab9e3ffd
SHA512 e982d3effaf5993bc80ab8e8eb9d7e13d0c9291c20be8b9023eabe7259c8d34825bb790de42ca06cf4e55de6a54fbaaaf2a1554336521f2020853176d46b9819
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dfb3a902ecac66ce4cbb7d01b41123014b6747819a5bb9a900080b6239d36fbb
MD5 f642edb227e5d8598a41c357697da4ca
SHA1 325c9851da645a0eb6cb24712d5a8ec1b828572e
SHA512 1a6bd39034dd692b4017b057ff49c747f72118434f9f9c6349c30f4b08ca063d85bcc888f6a65401425aec13de89671743574283d774f79b9a9f7979f58c484c
TLSH
T144E00103934001AEC024037101835F305AE3802406A202168B2001A92C727402E20A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58dc32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58dc32.TMP
Size 392B
SHA256 ed67677354976955f56e24774df1cdfd861dcd49bc036a14c4d4fb658bb12d0d
MD5 0ad3dcf77a871fb07b3b896bacf59ea4
SHA1 e76fae9159ff5be03536e96c884f65b77796a965
SHA512 2d965161ee89613d1a9b958741224f6684626bf6c5ae9f33ade0b079b02fc65518638ca536f931bff81a953950575959e9bb9610dfc54d0235330817692388c8
MD5 SHA1 SHA512

Submit Download

3d1c4e42-17f7-4000-9dd7-a240f132ef5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d1c4e42-17f7-4000-9dd7-a240f132ef5b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e3957b3c5489148d844a2507e26d750e69b23310179f356681a867fdc1d3cd5
MD5 e36822b4fe225d9a91df3c5eceeb8c1a
SHA1 c81ab6ebcf512c30d2ec392b024ef8d0c1e73af0
SHA512 1cc9d555ad21a7b91d7409333847839baf19a8eee69f7b887ef01feb00293f238ddb8f426b21f1fcb9b6c7cb490a832bc1480c2a3da7fb32b72a888734b3b597
TLSH
T15241D759B6FA1148B3B7AF66ABF6A86D547FBC772E06D45E00010D4F0666A40C862733
MD5 SHA1 SHA512 TLSH

Submit Download

Bloxstrap-v2.11.3.exe.crdownload

Path C:\Users\Admin\Downloads\Bloxstrap-v2.11.3.exe.crdownload
Size 12.0MB
SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
MD5 3240bc150c493952fc0c727f47b96f5b
SHA1 bf3d5f6baca61e27b61d7365bc58df4e8f2f967c
SHA512 61c378817dc3bcdcc5f4c95414f91ec4621e4ec7841de7f6cbaae13b1d653b3fb69b503773c3cd703e886bfd20f4f1369cf9ecef0d405e3894ec513784d147a2
SSDEEP 98304:UYJOvTscod5DkasbMZszos0D3FuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl:UYJQscgsbMZfs/ObAbN0
TLSH
T11AC67C9533FC2A35E3B74B35A970721A05767C2EA901D78F5B85BA1D2972280CDE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download