4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bloxstrap-v2.11.3.exe
Size 12.0MB
Sample260809-pn4hlseq5x
SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
MD5 3240bc150c493952fc0c727f47b96f5b
SHA1 bf3d5f6baca61e27b61d7365bc58df4e8f2f967c
SHA512 61c378817dc3bcdcc5f4c95414f91ec4621e4ec7841de7f6cbaae13b1d653b3fb69b503773c3cd703e886bfd20f4f1369cf9ecef0d405e3894ec513784d147a2
SSDEEP 98304:UYJOvTscod5DkasbMZszos0D3FuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl:UYJQscgsbMZfs/ObAbN0
TLSH
T11AC67C9533FC2A35E3B74B35A970721A05767C2EA901D78F5B85BA1D2972280CDE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.11.3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3944	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307521986953380"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{44C3A861-99E1-4CA9-83DC-20816D9854A5}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	Bloxstrap-v2.11.3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4276	4216	Bloxstrap-v2.11.3.exe	86
PID 4276 wrote to memory of 3712	4276	msedge.exe	87
PID 4276 wrote to memory of 2988	4276	msedge.exe	88
PID 4276 wrote to memory of 3944	4276	msedge.exe	89
PID 4276 wrote to memory of 2988	4276	msedge.exe	88
PID 4276 wrote to memory of 2988	4276	msedge.exe	88
PID 4276 wrote to memory of 4680	4276	msedge.exe	90
PID 4276 wrote to memory of 4680	4276	msedge.exe	90
PID 4276 wrote to memory of 5016	4276	msedge.exe	92
PID 4276 wrote to memory of 5016	4276	msedge.exe	92
PID 4276 wrote to memory of 5016	4276	msedge.exe	92
PID 4276 wrote to memory of 2544	4276	msedge.exe	93
PID 4276 wrote to memory of 2544	4276	msedge.exe	93
PID 4276 wrote to memory of 2544	4276	msedge.exe	93
PID 4276 wrote to memory of 1716	4276	msedge.exe	94
PID 4276 wrote to memory of 1716	4276	msedge.exe	94
PID 4276 wrote to memory of 1716	4276	msedge.exe	94
PID 4276 wrote to memory of 4728	4276	msedge.exe	95
PID 4276 wrote to memory of 4728	4276	msedge.exe	95
PID 4276 wrote to memory of 4728	4276	msedge.exe	95
PID 4276 wrote to memory of 3264	4276	msedge.exe	98
PID 4276 wrote to memory of 3264	4276	msedge.exe	98
PID 4276 wrote to memory of 3328	4276	msedge.exe	100
PID 4276 wrote to memory of 3328	4276	msedge.exe	100
PID 4276 wrote to memory of 2108	4276	msedge.exe	102
PID 4276 wrote to memory of 3484	4276	msedge.exe	101
PID 4276 wrote to memory of 2108	4276	msedge.exe	102
PID 4276 wrote to memory of 3484	4276	msedge.exe	101
PID 4276 wrote to memory of 3544	4276	msedge.exe	104
PID 4276 wrote to memory of 1796	4276	msedge.exe	105
PID 4276 wrote to memory of 1796	4276	msedge.exe	105
PID 4276 wrote to memory of 2820	4276	msedge.exe	106
PID 4276 wrote to memory of 2820	4276	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.11.3.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.11.3.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/bloxstraplabs/bloxstrap/releases/latest
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbe5e6c188,0x7ffbe5e6c194,0x7ffbe5e6c1a0
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,16297171526438211358,2577354206137262479,262144 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:2
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14134735520712295337,2357856487345419369,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,402941157841709130,2077204442144047349,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,16400110213501044592,15843339521829971596,2097152 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,13304296135041376758,3025835515386131361,2097152 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,3533449415202178820,632502331019227143,2097152 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,5364338567572112397,16047521839177731306,2097152 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,16594840050786948058,10545262040194796273,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,1455145258857206279,6272934857289687204,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,8364614298837862002,22856486240903867,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,13385122716102890903,10397364047586585403,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7600353245497280086,12554615573158409896,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7600353245497280086,12554615573158409896,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,9659695835737984796,10042333099266828463,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,5193581631826837601,996123358845994609,524288 --field-trial-handle=2960,i,14534216757755931178,11388206684554608363,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 413ee5bd7b4f079654cf7aec17fd4281a240b91aa2410d2fe696c3c220d63e36
MD5 a85fe439a0a48f4c69d357e0087d9dde
SHA1 69ed306b339c6c9c9a8de949f5c5b767cf5865ad
SHA512 a8d38f6ce524907a0156e034d1c97925bf0c22cf3500a1301d71d7761be9e01c47c54cd539fe041eceda8bb6549f26ea0d6f648839accf24a2247b107bb05249
TLSH
T10B71A2BB410287AFDB2DA2FD64DE71503C70A4D9F9335D569E5047353917B0142CEA88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5844d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5844d4.TMP
Size 3KB
SHA256 b8011e912abb27d9f7f8760b42a7b8e4e5ba5e4eec9c4bfdad2a539a802cedbc
MD5 2f7969368217922f2a8e275475f1c070
SHA1 5367466c98a4bad2e310010e7089fcddaf49229f
SHA512 397b984d071e6e915066eeeb7c303b12450dd1d75337a87ce519874a7a0d591ef8e97396bdc856281783380b8252022af19dd152a7d043651244edeed50c7b77
TLSH
T1AC71A2BB410287AFDB2DA2FD64DE71503C70B4D9F9336D569E5047353917B0142CE688
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d41ed9b-796d-4694-aed0-1d9f42928663.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d41ed9b-796d-4694-aed0-1d9f42928663.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b912aef3b59682d84ea7d35b9bf8a8e89785d85dcc0e2e26330e7ff8a5ae8aab
MD5 d17181dbe88f63a47a38e03881faa9f9
SHA1 c2a6f20a9ea2743159d1af2594552fecf61febd3
SHA512 d391d226585bbb43a5c9eecfe8d3b6f1d67f7cdd8e119ca62815be2c6be19ffbe48146052d291b867aa8d73a672022f486ae53fe8973ab74293b193035fe263b
TLSH
T1BF319DF7C3E4956D8A0156F4AB14AF1BCE2D0915831C3C6AC9E4BE1B93E78B1E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7befd2232dc62795d34b7b27ccfe02b9056cece90a5127b2f74e2fac498f1979
MD5 9ab3a05998152f003bc1d68bcf60d1be
SHA1 a987e3696010d68273b8e6e68c70db4148741be5
SHA512 074e2074bd8bd3b799256372d3c5935b10d24b49d1b3e69c20b51de84cc60b90b3c472ee4c6a7326da2fd7eca6ee040da22afdfb9c7a789dbef8c7c197d9448c
SSDEEP 192:sxZktRxyM/jK1Ml8jjn/fHskWpV8wqEdpDIvHW6+WNIpIVs+/YAJxeYjIgyJ:sxZgVqn/fHskWv8wNOHbr/TO
TLSH
T16152E711AA38697BCCDBD20DFA557F63D6F8047292911E54A9FC9A1C00E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1b73d0ce06d729df6eca1eccfc1c2daa2a0a6e1e24d66c13b1f400908d3e18d4
MD5 84545c9f82307e5064fb560c598b2c3f
SHA1 caa85382de07d7ca605c0dd446e2d3c48b4ca89b
SHA512 bc156f821f083966ca1c04e83efef158ae269ba2c9a70bf636b388b8253b487f1b0299ec1af918e672aeeaf6f10ff5b131bdca908d2d3b54d163173142ba95a3
SSDEEP 768:m8sqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV74Ll6AR9FroyOc:m8sqxAlWvJD6Tu1jaA4LAs9+yT
TLSH
T17DE21C3B694CC77E4F840E5DEC2AAFD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0eea3bafbdc2c603f3de1ba54e4972649cca1bbdd220a10ac9cafaba1c3834cd
MD5 4d22d37bb90bc8eaf5ef3ce26725988b
SHA1 2069a534dab91676f3d454e8b0b38135d428a1d3
SHA512 09740a2c39302f7da193f836fd34650768dd217eeffb0946fbdc8d71f79d533d803dbfdfb611ef45a9b223092b896d1fe89e5a73c48e464f5892e3cf2137ade3
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmslhUVB/Hp:KYbaKYIK6+EKji2qEAKdmh
TLSH
T1E491144A363E0212383D6958B2A786374F423A637018A46F3FB950E55F6AF125CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ff0374b5ae267d745e5749e851af35cea246b88de6290148a5f830ade59459ee
MD5 8775a08f2b0a8db05b9cfbd08d254705
SHA1 4c1f72e752dea3472a44dcbf6aac76d1f4c38b23
SHA512 dbe750423c6d9d6d4879464cdcd26e6ba82027164f5fee40b33537620c95f8c191a9219e3aa1aa8950b1e7d53ada9c057c50cfa477910a7050c48d5de7df7163
SSDEEP 384:naZcIfgsNPnzbh/9VRN0OKq9UViYA8tkM1o15mkcNnTKwBODNZOCC54:YfgMjH0OB9UVo8U15UNnewBKZOl4
TLSH
T1DDC26BB098685CE745E5F5C9B68AE2172DB81033D98A5E4CE2F8BE3C309F5B81706D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 856a257a78f092370d2563a1f7c7a257d33931025b1e77c8b2624b237983de42
MD5 5f6a0282e4f564cb074eacac43a624d6
SHA1 af85e27ab39e7804b2b04e43032ecd9ee0bcd3f3
SHA512 0f55a74a456f6b1178e0acebd9ed987c1091d11823437333957d4deed3bb2100530970cb62637137ebf1c8e217c4a50fd55008198d8f1bec4862cf6948039f3d
SSDEEP 192:tONr6JkRtQmiUy8gW+RN0OmheR2h3BR5U6:tONr6Ur8W+RN0OKFpU6
TLSH
T1EF02E935BD386C7B9EF2AE09B98727175FA5207BE9856F80DAE41F0C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e24f2061593855a107780c55fa9f6dee52750b73010a682ebd3775a339440e99
MD5 7400f7f342a580ac03ea65b49af69010
SHA1 a093e888c98399d325233568930a756b118530ea
SHA512 1a28cbd2e5d6241c0d0bd26400075b317cf49f126c73fc9630ed5e8a88ce46d140fb22a044329c5af3aaa7328a33b5dacf6c1f3a89379d69cf28a8d3145708e2
SSDEEP 192:tONUV6JkRaQmiUyDgf+RN0OmheRnX9iVc3qiUU6:tONC6UW9f+RN0OKq9FCU6
TLSH
T1BB120835A8299C775EE7A504F58733A35EA92077ED86AF84E2D41F0C01D7A8C370ED26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cd1cdb38-d8ee-43fc-92a2-edf6e9aabab8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd1cdb38-d8ee-43fc-92a2-edf6e9aabab8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 72bc250a06fbd5e51afd23b626fe48131b8510884fd28b1dc1ac9e0f136fae1a
MD5 84b885bc221102786097779b0d6f4ee1
SHA1 9a119a40f35b9a57115274b4de8d0684c9a23d60
SHA512 4f4714ee1d181eec8f3660f4edef350536c27b569dbe3fcd6a0cde4004bf9a46bcc3b4c49e51f3c3d9d55b7258d4772dd62f2fcf0659157a3cb599cc49c389ca
TLSH
T15A411D59B6FD1148B3B36E56ABF7A86D447F78332E07D59E10010E4E0622F41C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

c31e4a43-ccc5-43d7-a3a3-0964ffdad3bb.tmp

Path C:\Users\Admin\AppData\Local\Temp\c31e4a43-ccc5-43d7-a3a3-0964ffdad3bb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d3b40f8e-1c8c-4153-9403-8c7887e4f43b.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3b40f8e-1c8c-4153-9403-8c7887e4f43b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14365336-d387-46ae-b099-18f50cf3f17b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4276_16314129\14365336-d387-46ae-b099-18f50cf3f17b.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads