hxxps://raw[.]githubusercontent[.]com/hanniii1/Loader/refs/heads/main/BFLoader[.]lua

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://raw.githubusercontent.com/hanniii1/Loader/refs/heads/main/BFLoader.lua
Sample261003-pnrh2sdb45

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
14	raw.githubusercontent.com
22	raw.githubusercontent.com
5	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{305EAD92-6EC1-40C1-A33D-52EC9408D61A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2648	4088	msedge.exe	87
PID 4088 wrote to memory of 2108	4088	msedge.exe	88
PID 4088 wrote to memory of 4416	4088	msedge.exe	89
PID 4088 wrote to memory of 4416	4088	msedge.exe	89
PID 4088 wrote to memory of 4416	4088	msedge.exe	89
PID 4088 wrote to memory of 3148	4088	msedge.exe	90
PID 4088 wrote to memory of 3148	4088	msedge.exe	90
PID 4088 wrote to memory of 452	4088	msedge.exe	91
PID 4088 wrote to memory of 452	4088	msedge.exe	91
PID 4088 wrote to memory of 452	4088	msedge.exe	91
PID 4088 wrote to memory of 4720	4088	msedge.exe	92
PID 4088 wrote to memory of 4720	4088	msedge.exe	92
PID 4088 wrote to memory of 4720	4088	msedge.exe	92
PID 4088 wrote to memory of 3676	4088	msedge.exe	94
PID 4088 wrote to memory of 3196	4088	msedge.exe	95
PID 4088 wrote to memory of 3676	4088	msedge.exe	94
PID 4088 wrote to memory of 3676	4088	msedge.exe	94
PID 4088 wrote to memory of 3196	4088	msedge.exe	95
PID 4088 wrote to memory of 3196	4088	msedge.exe	95
PID 4088 wrote to memory of 1016	4088	msedge.exe	98
PID 4088 wrote to memory of 1016	4088	msedge.exe	98
PID 4088 wrote to memory of 1016	4088	msedge.exe	98
PID 4088 wrote to memory of 4508	4088	msedge.exe	104
PID 4088 wrote to memory of 4180	4088	msedge.exe	105
PID 4088 wrote to memory of 4508	4088	msedge.exe	104
PID 4088 wrote to memory of 4180	4088	msedge.exe	105
PID 4088 wrote to memory of 4344	4088	msedge.exe	107
PID 4088 wrote to memory of 3860	4088	msedge.exe	118
PID 4088 wrote to memory of 2668	4088	msedge.exe	119
PID 4088 wrote to memory of 2476	4088	msedge.exe	120
PID 4088 wrote to memory of 4872	4088	msedge.exe	122
PID 4088 wrote to memory of 4872	4088	msedge.exe	122
PID 4088 wrote to memory of 5096	4088	msedge.exe	124
PID 4088 wrote to memory of 5096	4088	msedge.exe	124
PID 4088 wrote to memory of 4232	4088	msedge.exe	125
PID 4088 wrote to memory of 4232	4088	msedge.exe	125
PID 4088 wrote to memory of 4232	4088	msedge.exe	125
PID 4088 wrote to memory of 2284	4088	msedge.exe	126
PID 4088 wrote to memory of 532	4088	msedge.exe	127
PID 4088 wrote to memory of 2284	4088	msedge.exe	126
PID 4088 wrote to memory of 532	4088	msedge.exe	127
PID 4088 wrote to memory of 532	4088	msedge.exe	127
PID 4088 wrote to memory of 2832	4088	msedge.exe	128
PID 4088 wrote to memory of 2832	4088	msedge.exe	128
PID 4088 wrote to memory of 2832	4088	msedge.exe	128
PID 4088 wrote to memory of 1032	4088	msedge.exe	129
PID 4088 wrote to memory of 2760	4088	msedge.exe	130
PID 4088 wrote to memory of 2760	4088	msedge.exe	130
PID 4088 wrote to memory of 2760	4088	msedge.exe	130
PID 4088 wrote to memory of 4092	4088	msedge.exe	131
PID 4088 wrote to memory of 4092	4088	msedge.exe	131
PID 4088 wrote to memory of 4092	4088	msedge.exe	131
PID 4088 wrote to memory of 5836	4088	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://raw.githubusercontent.com/hanniii1/Loader/refs/heads/main/BFLoader.lua
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7fff5054c188,0x7fff5054c194,0x7fff5054c1a0
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2038348619210655308,4211827700995124052,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16541793927897057870,9613873073302815368,262144 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,2718517107498256198,8334285323041722761,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9217134195447692272,13408574296660284760,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,7374493797726837287,1679505436963867145,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1736,i,10736085119579860931,13015130635345729229,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,6368292129765071070,3904071291881881596,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4752,i,6102753571149137908,8600107540557867576,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,9663387948545879809,5659124666185457718,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1885465699556506339,12687793169953198317,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7195856745810521213,11746600468711972560,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7195856745810521213,11746600468711972560,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,2408255910706687430,9267508343161480271,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,14302459537879450567,17738770832087914102,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,16236158010083128894,2459884442875846999,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2996,i,17673239369081625169,5278660462484594319,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17100222576700809390,8822990119255391039,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5856,i,8788439612856091531,4894529019135902092,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,16155636718813724625,13811229337956491943,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6488,i,11268308917702376189,6473245925087967498,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6784,i,1553311128709014831,18237764763302194961,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,6707557598913006371,11907571181716822913,524288 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7220,i,17851960368314361379,16609931644309995378,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6604,i,7173126220165298732,8679826361392041272,2097152 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7240,i,409901994903476883,16059169212637785321,262144 --field-trial-handle=2308,i,4942873765463807381,10716038612632667987,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

092203f8-421a-47ae-ab82-631bf858fafc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\092203f8-421a-47ae-ab82-631bf858fafc.tmp
Size 18KB
SHA256 fd4b457bc6021e1ca89996f1d44499857a7984bc70c6b37e728673ff98b2862a
MD5 1d3c234a4e17d32e84dc6b57a4bfdf47
SHA1 c8dcc27f993fa3efb66f2d1d0717c437fad6f066
SHA512 bbbf9580d75ae1d1e6a023e3a6d854a10661ae4d3f3fc280c51b5f88401a6cbcc1e1538f796b41af44b7306fc4b448f026d95ac143da5bc6878cd75940196b46
SSDEEP 384:SdZcIhsNp8K2M5KrZOiBGYX5E78pxa++29ztgOIwZOyrogoM:ohhMfMGYu7Wjl9zXsBgD
TLSH
T16C828E729C785CBB1CFBA185F54B3A034FB88427A7C8AB54D5ED5B2C05DB698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31909670-d062-4c14-a009-09da4faf7793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31909670-d062-4c14-a009-09da4faf7793.tmp
Size 18KB
SHA256 d6fb5773278bbd00df090d2bae4c2b0316fb1e585119b8cd19861d8455e29ea8
MD5 7dd27ab878faf47ae6bd70d82afc65f2
SHA1 ac5856ed4af8a99c5bae89adc7c597d017ee3b35
SHA512 2f823605f7441e31827c43c1b32b7ca8d44b335310fdfb7f81189e660fa0163bbacb102a6f3009904ef5ac84de89602e3526ba464b15aafe8e7a6637903ea3c7
SSDEEP 384:EdZcIhsNpZK2M5KrZOiBGYX5E78pxa++29ztgOIwZOyrogoM:mhqMfMGYu7Wjl9zXsBgD
TLSH
T1A7828E329C785CBB1CFBA185F54B3A034FB89427A7C8AB54D5ED5B2C05DB698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b0bbbf1-b644-4d96-9b88-ac9449d94ace.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b0bbbf1-b644-4d96-9b88-ac9449d94ace.tmp
Size 392B
SHA256 deeb6d8bbc9e81ddc5799a70ec852af8e7fb27e848e08f12e39d9bba1455c776
MD5 a7e6ac69fb0177f9a6f86c63d98b8ce4
SHA1 9797fc428f344d631cc5379267e7b53c98ff1f2b
SHA512 0f2a0519438b01ddb22600c103bd920f6e1dfe082dc9e480ab5443913928827e73794bfa728cacf3e846f646ec7c9b478d3829c74b479d8d02ffc20c3cb9f8df
MD5 SHA1 SHA512

Submit Download

6a21f66e-26d5-43b1-b0aa-7757a5982f65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a21f66e-26d5-43b1-b0aa-7757a5982f65.tmp
Size 26KB
SHA256 817789fb217047d86efe807ce783adfebc1fbda6e3f7351d8eeca3310a4e1790
MD5 3110b951794bc6d33967fe724a1b4978
SHA1 a68ad00b37f364ba31b3225e53d18eda1365c03d
SHA512 d35abe34e2ef384f0b1d0b57f4092ff5a49482ad8dc5901373d831d7f3e8a8b5eab2c49be0c615262fc9e0a0941824fa39455d1d130054eace2c927660ddde85
SSDEEP 384:KmiFiZcIGzsNL8TUNTUlIl8K2M5KrZdD2BGYX5E78pxa++2ZztgOIwZOyrogoM:qFQ26wgUMgDwGYu7WjlZzXsBgD
TLSH
T103C22BF248E7987BD8EE5747A77E2D024EBCC017B684A650B7D8561CCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fde56e4-6a7b-4d5e-a5f6-a5994ff26a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7fde56e4-6a7b-4d5e-a5f6-a5994ff26a2b.tmp
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
MD5 b90ecf74a561822627982f1b8d4c4873
SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
TLSH
T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

113f2bba-632b-43fe-9b87-a67c82c7ca94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\113f2bba-632b-43fe-9b87-a67c82c7ca94.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2028a477-b24f-4e3a-a6c8-5a680c1aa138.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2028a477-b24f-4e3a-a6c8-5a680c1aa138.tmp
Size 10KB
SHA256 7b6c454f7d9e3dfd5e8d2d3edb24b022c36d190011662413d182318e9669ab72
MD5 5d2690babf1ba37631414168a2c598f1
SHA1 b96f99b999a42f5ffb01617ca0967e40fbcc916a
SHA512 85136233dc187d55169f3a241e90ebad06bb4d4c75b04041fac1b944930fa80bece1f3f8e302d217e7cc06cdcb738428d2a597a26c91d9bf068072914f35ab77
SSDEEP 192:sxZjR5Wg/fws81TIdpV4HW6+WN6ci/YgUyxIg5YJ:sxZjSg/fws81MOHbE/VW
TLSH
T16422C9526E34A9BB8CC7D60DBB15BF53D5F9543291901E48A6FCC62C09E67DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

209e797e-23d5-41c3-aeae-f950c453690a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\209e797e-23d5-41c3-aeae-f950c453690a.tmp
Size 13KB
SHA256 c8b053db6ecce083ba09f5a4d65492337cbae69d29529ed990a20e530296685a
MD5 b86c9323885a753c6e6f2d4bd9f12f57
SHA1 212e19c06fb0e2128a17bc5cf6d93ddaf2c3e274
SHA512 0a75b65d0a4ee661cadfe5b4661033c0fdd6934b46ea2a847edcbea45a85059a3069d4af3d2fc189201b317cd55710468e246a8b408ccd8fb48a7377abf2aa27
SSDEEP 192:sxZrR5ucBWg/fws8sDdpvEwLaP4HW6+WN6P8dYgcyxIg56tVRUk:sxZrimWg/fws8svTHb9dRMv
TLSH
T14D52BA52692495F78CC6D519BF35BF13E6F54432D9910E4CAAFCC52C09EB6EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5611f5cd-c79b-47db-8eb5-c63eacc170c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5611f5cd-c79b-47db-8eb5-c63eacc170c9.tmp
Size 27KB
SHA256 661cd19c12ceff414b0ce6b03ea74caa15dd1d40029244192d88ca0c9f55076b
MD5 ea618393101552d8ba190616b5c34156
SHA1 78eb6297724a55a6e106e092a6d4edd1679bab27
SHA512 113d5d74118bf9d5f3fa2cf4aa64f4ecc4a127bc2d8c48de167817f06b489a47f51b85ac71efab18aeb7c3c7c8fe2eb2fbd4120d2fce3c0c635e4e37db67bc36
SSDEEP 768:zkichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzkroSf5:zkichfPWvPZplu1jan+LKgzvw5
TLSH
T1E5C2E93B640CCB7E4FC01E9DDD5A6F9A7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d179ed7-1703-4b3f-bdc7-46e3e1657f6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d179ed7-1703-4b3f-bdc7-46e3e1657f6b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 44KB
SHA256 34a6a0b4c6521f99ec398ce7663437ea2cbb0d86b4d1322f65ae2b45a53007b2
MD5 f069cb36af3b6c360161ec41ba4e24ba
SHA1 98c3aba0d33b9daeeda530528c6d8a2debcc1067
SHA512 0ea2853fe3ff003193dd3aac8d7e895b91513dbe13e126a540462207ac18c215eb753ed77eded3a948ab5f0adac084270bccce77abf77ff99d5a375a5f607043
SSDEEP 768:DkwV7Apz1QrSXVvr4Qc/8Dc08rHPTynh06oYE7BsMlu1U/zWbw+FaBfTPr1feVrF:DHVsz1Q+Fvr439HPTgx5E7B41U7V+FKU
TLSH
T1F923021F23F52C97C23D1E603BF184E0BD64287CB49163E0A11B50196EB49C7EAB89BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f31e1b9c9d9168f54ea966f385e6f8cca48634596e29ebcedfe7432b0bd6d349
MD5 17c07db2c9938c2387d549a11c7ab8e4
SHA1 8f0513f755c9b9c55816663a3e4dee3deef04c31
SHA512 fb5ab0e00368294f0922a4cb4e3681d324060c39d740049f9841bc7abf19bb06ddf1abb19c14f4985845532c21b1e9bb0969e01da18c0ee2f10418a47042c096
TLSH
T11161A14DD2AC9575FB68013F73D610EBF33089E04CCFDE429DA4D83A9846B259A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 6b291af37dbcd5c69c4bfb63e41a4763ac2e12eaed1c234440a14befbbe52319
MD5 01035ef192ecfbdbf0a5ea30d8cf24b0
SHA1 d28900faea34cd74a61a49da925b20f8f8b6c007
SHA512 2bd31df19e36076adc6742455624e64b7f682db1532ab311a63d375590092b2f4631be41fa0826392a80d04a991c10cf9de67fd0bd4843778aa02eceb1306cff
SSDEEP 192:G4p+DpQUEgTb8HeCcC3yCg8DG3CnyhcE3gzq:E2UEsSeCnHyyySUOq
TLSH
T1E5E16E088D78D1E2FBA8003A22D490D6BEF498E10F8BDE0D9872F6717C3EB4056143AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a793b846e19f0374d25fa9bf5ad3943735fbf526147f35a0db2745da23c09ad
MD5 5a024a3495a7c102fcd77b864852bd90
SHA1 fb58cfad94b4881f9474db933df310e7be2b06d9
SHA512 8f1362e98687aa961c7cb7c369facd8e7d3a94d7c70a15ecbcfbf5243fa62be7031fdb5f1a526d775cf9de84ba7c6641826b1e42e85c625f6a7ff2bb523eb6a9
TLSH
T1DC61A04D96AC8574FB68003F77D600EBF33089E04CCFDE429DA8D83A9846B149A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

af6d973c-02ce-44d9-ba7f-295bb04612c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\af6d973c-02ce-44d9-ba7f-295bb04612c2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

27bc3247-2a14-4543-99e7-c1e42f25ce48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27bc3247-2a14-4543-99e7-c1e42f25ce48.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a5da549d-c510-4ae0-9ff1-e95f509d41af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5da549d-c510-4ae0-9ff1-e95f509d41af.tmp
Size 1KB
SHA256 91f581c686f5a0e6482bae94f5edc968bfb6ead50179de4723c1919475e87c5d
MD5 bd8ea2db3b1028321ec8bd6452cf90e5
SHA1 0a9137efba572923c94b6a68030997acbc53d788
SHA512 6ee638a6cd1f388e8f25c9a9979b74ba80bd56ff18f82e2bb89c31b97a4ce2cc43e2f5bc36f5a3924ddc48939ac8fe364b3cfa289e68a13a9f02ef53fdd419bb
TLSH
T1DC11ADF787E186AF8A015AF05A24AE2BCF2D0505832C7C5985E4EF2BD7E3476E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

b8d412f8-0bee-4cc7-8189-c58b20314c98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8d412f8-0bee-4cc7-8189-c58b20314c98.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b9e7c46d-d35c-4f42-930f-41b807fef11b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9e7c46d-d35c-4f42-930f-41b807fef11b.tmp
Size 211B
SHA256 ed61f72a57b22daefe3f9fa27edce095253e9a45ceca4f36eccffa99c64db61b
MD5 e8d88b3828126a36132737982ef3fc1e
SHA1 50d354c31ce0784a2e918a958bdc95ada42a4cec
SHA512 62523718658d59a1540a999bec0e4decf3d34e509157b4d916cef5775f6290d374f30cca5ea6557a595c9351fefbd6b1488de3d4cc16dba4e11b8927089386db
TLSH
T15CD0233321117075667C5E9973B6BCCFC32610A03417D9D510D0ACDC0D3147C175B140
MD5 SHA1 SHA512 TLSH

Submit Download

d27e7f68-1053-476e-9e07-7b5f7e79c0f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d27e7f68-1053-476e-9e07-7b5f7e79c0f1.tmp
Size 3KB
SHA256 181695c371549672cc9fccbd8973df30955493291c2cd3376ca29213c2c32b10
MD5 d9e0e3abdddab52c58866783ad840df7
SHA1 4770d6076cff61767289c6dbb2cd2b3440d64236
SHA512 8c41cc577258a6a419177889deed17acda3cc2d42af78a7ca4ab28328b0c84995ce9fe5fbeaa6b339ebd62cc0943d523c158054037920f8ecd070ec398ac6ce1
TLSH
T1CD61CFF387F5866DCA1155F0AA18AE1BCE2C0515831C3C6A84E4AE1BD7F3471E141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

f6c0643d-e182-478b-8983-67655ea9a502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6c0643d-e182-478b-8983-67655ea9a502.tmp
Size 1KB
SHA256 97c08a10757cfbd8e333d0ba70c9746c3040ae9fdb578338e14ed9a8405686df
MD5 41073623b3b7b0f32cd4f91d3898174a
SHA1 55650a4f8e83ff186cd76dfc06053a91c160c923
SHA512 ac89175aee3906432224847e8934ab729a20bb9616d949d266d23a78e29334a45b8cae021724af902ab972c78b905ccd39e8bebecd5e251a2168aa6da51ccb07
TLSH
T1C311ADF787E186AF8A015AF05A24AE1BCF2D0505832C7C5985E4EF2BD7E3476E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cf3672d0c105fbdf9f7437a6ae7d0d8fb4c2208f271698426700ca0c0ada8a56
MD5 33838728709b7b15b7ab20809e1ce690
SHA1 933647d9ad8fcc926050ed917a0eac14c705857f
SHA512 4a8a48956aec17d2aba0abbc4eae1dc3362f84c94b2fa87e96ce9b4e4ca7a05b066f5ad4c527c96ad29c62255b9d66bb4f0513bf290c50d93e70a606ea041ebd
SSDEEP 96:KgHyKoUW6KgKPKxUCUHUeUCUIUwUAUG6UQUtUtwUCUGKoUDwUkUGkU6UiUlU0Uio:EhP9r0Prl9NydGLr7D9J2TLuZLX4DMHX
TLSH
T1A591861272B70341387E6A4940AA862F919171B3350DED6B7F7D4192CEAEE144CFD8DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6fc82e2-6b51-46f5-a487-7e654e84601b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6fc82e2-6b51-46f5-a487-7e654e84601b.tmp
Size 12KB
SHA256 bb8a82a978acb6e8c91513b89aa785d369a30592e90f99e2f9ad6cb73804f279
MD5 22cdc98179cf8c4fa75da4f33960ac3b
SHA1 d3c5fb561f7d0d89f077bfcf2f78c45afaf1c2e9
SHA512 4a350dd14bb59789abb860dc26b659870a6c134c335f1b4ccfcdc29ccae5c7ab5b4b8371800fc9deabaece4e7af0066e7cfb7d0e9bcc206a73e3ec7a77a19cec
SSDEEP 192:sxZjR5ucBWg/fws8sYdp9wLaP4HW6+WN6P8dYgcyxIg56tVRUk:sxZjimWg/fws8sYkHb9dRMv
TLSH
T1E042C952692495F78CC6D50DBF34BF53E6F5443299911E8CAAFCC52C09EA6EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea654521-0485-4b07-9cea-0a914f78a239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea654521-0485-4b07-9cea-0a914f78a239.tmp
Size 10KB
SHA256 795791d0c4eb03b2090b9b0cbf08e2691d3b822c313e12111f241782fe970b7f
MD5 627108bb50c9f9886d038add504dfc61
SHA1 119334084b3ab94a6af20ae761572754dd31fcac
SHA512 a12d40a3a57261238280f33a3d1767e722f85f5a1cff983385a207a349e4fc6e975d44a796f99dbfc97be776af1236e5d020d164b8f865db97cce9eb4fd6721c
SSDEEP 192:sxZjR5Wg/fws8vTIdpV4HW6+WN6qoXYgSyxIg56J:sxZjSg/fws8vMOHbYXbU
TLSH
T15F22DA526E2469BB8CC7D60DBB15BF53E6F9543291901E48A6FCC62C09E7BDE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f04785ee-a2f7-482a-9b24-e005c6dc0b17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f04785ee-a2f7-482a-9b24-e005c6dc0b17.tmp
Size 9KB
SHA256 3fd7b79755544f7076aaead6adbeab96402656a52b953f2c78b3130b2551ece5
MD5 cce061bbbd71472a0b8fac7ddf5dc810
SHA1 afeac139e9b942a7bf406bc4a4b515db3bac00f1
SHA512 aa6385c1a067c020841351cdc13c43ec42046b4f3284a0cc804ce11bcdefbba4e01d8cb33213cf4ffca1412be6a1d0eda737b0db8c924975bd3615aec8daaa04
SSDEEP 192:sxZjR5Wg/fwsCTIdpV4HW6+WN6ci/YgUyxIgrJ:sxZjSg/fwsCMOHbE/V9
TLSH
T17122C9526E24A9BB8CC7D60DBB15BF53D5F95432A5901E48A6FCC61C08E6BDE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f67f2d6f-5d61-430a-bb4a-bdee33f93b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f67f2d6f-5d61-430a-bb4a-bdee33f93b90.tmp
Size 10KB
SHA256 2205608ff2a9636afc8e48e461996f2445d329b05f497e548a05c90392f71b07
MD5 c5e3200607c3e24814800ca869439924
SHA1 de563a5ac63efa535e8c40b6a76ff80c58a2afed
SHA512 44adb3ee0bc3aed937516a692b5ab6f1d1fb2a8451e661db653ca09d5021ae3687eeeda41fac007b19629c9ed6d7e211d79395c3812ee2d76bb4c934c067a2c6
SSDEEP 192:sxZjR5Wg/fws8sTIdpz4HW6+WN6P8dYgcyxIg56J:sxZjSg/fws8sMUHb9dRU
TLSH
T18522D9526D2469BB8CC7D60DBB15BF53E6F9543291D01E48AAFCC62C09E6BDE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

923d2396-c1a6-49de-9ea2-24fd4831fcbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\923d2396-c1a6-49de-9ea2-24fd4831fcbd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2c1d41b7446a988eb8d0f696accf8555837afcfff971d20cbe66f070e17db6e3
MD5 3d0e7d1e1d2ef2ba150120de3f813780
SHA1 62415ada44eee513ef8fab9aeb4370615487ba5e
SHA512 00f8eeeee16e6d517aca916a5b62502855c9860616cd96c4443aa3a722c355d128e2e4d710abca9bbfe1a41012ad26d04a1cdb50603f0b68542ddc8b5ed008df
MD5 SHA1 SHA512

Submit Download

b602a189-e969-403a-bb4a-105da290022d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b602a189-e969-403a-bb4a-105da290022d.tmp
Size 8KB
SHA256 0e9ee432c43f86cd0f0b969953b475ba4a180f7799c81cc70b3cace8e1f5cfe2
MD5 032d161f66bd2cd4752f7a25bb144ed1
SHA1 53fc7e5896b7eb2cc59abf24b0e0c8acef1a3d7c
SHA512 e3069291812f9451978161e4e7c70f12c1efb3ecf049a0e3686cef9a6f8fe8197c9510aaead201cdc2c9ae33fa7cae4fe8d0ae065bbb31cb1283a4192a7c46d8
SSDEEP 192:LJONc6DphhqQmiUydzt+wGYX59eziC8px2F++2tkII6q5RU6:lONc616yR+wGYX5E78pxa++22zU6
TLSH
T12B122B36E878AC7B0DD3A591F44B39139FA45127EB847F94D5EC1A1C01DF25C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac62a99e-b458-4319-8245-254ad5314515.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac62a99e-b458-4319-8245-254ad5314515.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa95b15e-e8ff-4633-9fdc-dfa41ac78841.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa95b15e-e8ff-4633-9fdc-dfa41ac78841.tmp
Size 8KB
SHA256 6a1cd42e36e20eb7ff4b365080c5c74965972bf31a10963d58d4cb8a62ad6fbe
MD5 f2ae626bc3e9c5f46d2661319de0f693
SHA1 17c5574a0f4d06ac8e9ae78688419208cf393ae9
SHA512 8557cac1665739a4bd2942bdd7ee704c12f5b8fa788035f126184d66fb57909e0fef43dd38546dce651a895924c97b1c62fd6b7947c20cf9d685267fa94c92e1
SSDEEP 192:LJONAh6DphmqQmiUyBtq8wGYX59eziC8jkk7MwxU6:lONAh6190RwGYX5E78bZU6
TLSH
T15602FA35E8787CBB4DE7AE45B54B27139FE8212BAA906B84D6E81F1C00D764C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 044b58a401cf77237f6341c23538c77b977bf5a23c48ac74ea33c7f787438425
MD5 411785c9abfced76641e73f223a85906
SHA1 b2124f81f78b4a2625d8c0032e841b028865893e
SHA512 94eb0b41e66100a6177a97f8c93ff803322b623a56823ef7f25eb57350fa94aad0e80d79c49a730026aa15f9901b9bbd313c18ef5fd9978e252941e769f46d5e
TLSH
T1B7411C5CBAEA1148B3B37F56ABF6686D487ABD772E06D19D00110E4E0A66B00D871B33
MD5 SHA1 SHA512 TLSH

Submit Download

2c51c7ff-2563-4841-9a97-8058245ffd5c.tmp

Path C:\Users\Admin\Downloads\2c51c7ff-2563-4841-9a97-8058245ffd5c.tmp
Size 1KB
SHA256 1f0cb54a9621de59f49fe3777cfa87a7fb317c1f08aba54a8f582f8cfbff1f00
MD5 4f8d47fe1e66b560c1730a84ef0bcb44
SHA1 b93991f82f49c97ba59ab77ded8d28e71151ed6b
SHA512 8cee1473a6ac2aff1face37e506f7b9b9019ddcaec81ef382797b2195d7eb33ea84c491807ccdef18ac6025d45793f8c8dbb5af7d87d65475a158a93098f1f3d
TLSH
T12A4174E95440087101B3A23ACB5A6249FA73426B1402C604796C26622FB8E2B47F7FFC
MD5 SHA1 SHA512 TLSH

Submit Download