c92a99fd9784ba77fb4f2d389a4f4be350e7c52a5293f530c55e0423ac13ba19

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EAC.exe
Size 201.4MB
Sample260705-eaebfscy4p
SHA256 c92a99fd9784ba77fb4f2d389a4f4be350e7c52a5293f530c55e0423ac13ba19
MD5 1bd45a9d53350769527e1c4ecac9830b
SHA1 1b34ba46b05c7bcd96841ddd0f6a8df079b8c9d5
SHA512 795df3efd99c6d09d8124c65078f6814af37ddf8b3eecc20adaf93f1fafc08da4f50f32110b94a1ea556289457dd50a34321341c34144719119fff8d6a2dacfc
SSDEEP 1572864:jjO3d+HTPc9eDaxayId+tUcbGxq+TA5htqiQNvF1rtVxa5XLmgYtVHbI5op/cObb:POISeEyNRqVOb/ZUmLg
TLSH
T122A88C13E29641D9E05DD175874A9733FE72B8094B28A2DF2B5407522F77EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	EAC.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4220	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5356	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	powershell.exe
4220	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeShutdownPrivilege	2540	EAC.exe
Token: SeCreatePagefilePrivilege	2540	EAC.exe
Token: SeShutdownPrivilege	2540	EAC.exe
Token: SeCreatePagefilePrivilege	2540	EAC.exe
Token: SeShutdownPrivilege	2540	EAC.exe
Token: SeCreatePagefilePrivilege	2540	EAC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2540	EAC.exe
2540	EAC.exe
2540	EAC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1200	2540	EAC.exe	84
PID 1200 wrote to memory of 5404	1200	cmd.exe	86
PID 5404 wrote to memory of 2964	5404	net.exe	87
PID 2540 wrote to memory of 3744	2540	EAC.exe	88
PID 3744 wrote to memory of 4356	3744	cmd.exe	90
PID 4356 wrote to memory of 5104	4356	net.exe	91
PID 2540 wrote to memory of 5520	2540	EAC.exe	92
PID 2540 wrote to memory of 5520	2540	EAC.exe	92
PID 2540 wrote to memory of 3312	2540	EAC.exe	93
PID 3312 wrote to memory of 6028	3312	cmd.exe	95
PID 6028 wrote to memory of 4100	6028	net.exe	96
PID 2540 wrote to memory of 5440	2540	EAC.exe	97
PID 5440 wrote to memory of 4220	5440	cmd.exe	99
PID 2540 wrote to memory of 3488	2540	EAC.exe	100
PID 2540 wrote to memory of 5676	2540	EAC.exe	101
PID 2540 wrote to memory of 5676	2540	EAC.exe	101
PID 2540 wrote to memory of 464	2540	EAC.exe	106
PID 464 wrote to memory of 212	464	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\EAC.exe
"C:\Users\Admin\AppData\Local\Temp\EAC.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5104
- C:\Users\Admin\AppData\Local\Temp\EAC.exe
  "C:\Users\Admin\AppData\Local\Temp\EAC.exe" --type=gpu-process --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,2076611995600939939,8168832809102359047,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session >nul 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\Users\Admin\AppData\Local\Temp\EAC.exe
  "C:\Users\Admin\AppData\Local\Temp\EAC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --field-trial-handle=1772,i,2076611995600939939,8168832809102359047,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\EAC.exe
  "C:\Users\Admin\AppData\Local\Temp\EAC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\eac-bootstrapper" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783224570104153 --launch-time-ticks=573341149 --field-trial-handle=1772,i,2076611995600939939,8168832809102359047,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://myloader.cloud/download
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fff3898c188,0x7fff3898c194,0x7fff3898c1a0
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,6315841477717513656,5064031191707840969,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10874950035487147674,10393213398871155193,262144 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,10797015892897942357,2924777986564828449,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12917355886429768851,9787205409570018200,2097152 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3999759422373192575,17259359913046551846,2097152 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,6566918081662287616,10730819583723532202,2097152 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14426487001445168280,5019088786281977285,2097152 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,9001462041481595915,1493842513794708975,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6272111958872670135,6968960410107269354,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6528366689397791884,17645127845479103159,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,7721281247373278105,9046949793510608445,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,10480636985882021065,5966001937761608919,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10328990848620903336,16726326089974075204,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11726882581779456555,5154862218807592277,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,2791217248904892077,16113137835901798101,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,10480636985882021065,5966001937761608919,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,861729790276414372,4043190256060263478,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,17580324308999172575,9860266590179936843,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8240193981304197942,14682271718786031408,524288 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,14332751779463675784,1190496544771282692,262144 --field-trial-handle=2344,i,3384825175795471784,14089029630605152708,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
    3⤵
    PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d095085038f990bb4d8af56b6b2b1a74f9b1d87d6a4bbdcdfb23c8da7717a7e
MD5 12c36656ae683032315366f596274df4
SHA1 baae88f2cceba0942bd25ceba6b28004f4332dba
SHA512 4e567948c537a06b056715d72d7da2db431a7922fb9021ff36831e831d30daaa9f0f6eb9a3cbbeb9148f227b7781df8132b7b2ee86428733b07aa6c20853cbdf
TLSH
T17B71EB1426CE40AED7678AB8D1DBAA023FF192B17A47CE05F1C4F4FCA925F795858500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59888f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59888f.TMP
Size 3KB
SHA256 f85685d1b583cd9f5d3d603646f5236d1b860ce78004279edc8f1ffd83de8ec8
MD5 592494a09af99555d9e600cd85869f4f
SHA1 74811e50bcf348ef0a85254f0111a5f1affa1337
SHA512 1bff8434b0d1e07d11d1d4abf93284ca6d446c679c326ca477fae6ee96826d655e782921f96d91abff1b333110dd22b274b1d3eff925cb966d6343e17d6f260a
TLSH
T1D2613C1836CE007DE7538EB9E1EBC2013FF191B47A4B8E02E5C4F87D9925F314864804
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 365cee5c8f00abee9d0c3fecf8b076365832f7bc32f9c314268410dfe594b7b1
MD5 a11221fc9968585c65280b83991c98bd
SHA1 1254f6595a69d1152eaeca035128161f4efc379f
SHA512 51e8327527e57e54c59e52e3aea917130d12a159cc5e7f3e04910cb530d45d3097c3f9f375f676e496718093493d13e8989a9f8739d04b7863e3af7e476b4408
TLSH
T1E0518BF7C3E4C62E990196F0AA146E1FCE2D091953283D1B85E4EE5B97E34A2E105A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ccf904c983e0820a97f3da85ac3c1a4791a6eac5bd2723246bd9ddf9bce8df17
MD5 1bd61fc212d1f85d3c95b443d81b59a0
SHA1 9198a1f3081f529cea3bbd202bfcdce8ec33e6a0
SHA512 728bd7a5a801c66b4e1991f62e6c3a878351697734b35c43bbbc4c095513cad077dbfd26bab14095d3dc736a2ae21b24088ead9c62567cbea0e80f6da26c2e00
SSDEEP 192:sxZORqie/fasIH0wEdpRcHW6+WN2iG4/YwY7aIgyJ:sxZOZe/fasIU3WHba4/5O
TLSH
T1D022B7526E38A97B8CC7D219BB25BB43D2F94432A1D01E48E7FC961C16E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aa2465c90409ec2b1eda43e898fc9911ac1eb6fb6ee907b98b950faba688221f
MD5 d502c97309751f830df92521425c2c16
SHA1 2f742b68b65e30bee51fc97d4c9017e30456128c
SHA512 3e26923cdd01d28b8c63c636c8e4ade8ce7baa52ce24bbb6c24a7ed41b52c5c91d9af309579c82926950c1d3e5538191d994ff201b522558657bc4debf46fe32
SSDEEP 192:sxZORqie/fas5HwwEdpRcHW6+WN2iG4/Yww7aIg5aJ:sxZOZe/fas5Q3WHba4/lY
TLSH
T1B222B7526E38A97B8CC7D219BB25BB43E2F55432A1911E48E7FC871C16E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aa2138dbd7a796fd2f234cdccb38a5d84cbd64758aee7ba309bc8011df2ac228
MD5 838e706da0e68c643cc8a3c53a5f7dac
SHA1 7032f6f682a4a6fe1de00da7728f20ac948daf95
SHA512 f394f2899bdfeb5066bdaa998cd4d3c949bb4c1bd269dc2ab0ec459a619b3eb3f98275d7e0f755ab7f1eda2689ac586886d662d22a9865e79216ae8da5e4416f
SSDEEP 192:sxZORqie/fas5H0wEdpRcHW6+WN2iG4/YwY7aIg5aJ:sxZOZe/fas5U3WHba4/5Y
TLSH
T1FF22B7526E38A97B8CC7D219BB25BB43D2F94432A1D01E48E7FC961C16E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0ae7d3cceabb0d5797cca98226b5fd0f223aaf014a5897b983af1bd4893017f7
MD5 14817c8843c1cda51c051e21a4227257
SHA1 c95b172c4e3115a7dad1d287c5769b16c50709b2
SHA512 2f370d17fcb5c556db7bd144c37a42c73db17fa56e3e59321235adbcdb91460414dd54ddffa0e4057da225a1a15abcb8bc34ace4b82fa62e47229c9d5a883851
SSDEEP 192:sxZCR6yM/jK1Ml8Mie/fas5HwwEdpRcHW6+WN2iG4/Yww7aIg5aJ:sxZCIqe/fas5Q3WHba4/lY
TLSH
T10842EA16AB345A77CCDBD219FA51BB53D6F54473A2900E449AFCCB0C06E6ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 df0444bb4ed6e6a3e05ff9fb2277827d5703cf62d2d6b5739b1d72b3d9bc97a6
MD5 28e2c5866a364760014b560a608b7865
SHA1 7ff58fd895486f1fd487829082c9c2597003ca88
SHA512 111cd30e15ddc883d7d7933735e7f61f67ffddab7989a932154ac697eb7b114ca9c173b2f2bbee8a1576af360d47eb89500b4f0643e0104828438a4709f5745f
SSDEEP 768:9W4jeWmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8PLlrZ+dtrohmcsai:9W4jeWmWvmKLEu1jajPLZQdGTa
TLSH
T1C7E20A3B240CCF7E4F844E5CED2AAE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 52041ce264e22dc3a62657d3a1331d0663e364bf25bd41d858afdcca849fa8a1
MD5 22fb38c2bca7776c03a6cece723cd078
SHA1 d4eb0753fd99af6ed5faebeef925f9db727545bf
SHA512 0ea9854ccbd937a78131746b42f04aeecb9a2f2d192996660ed6d797e9a1450f73cdccf6c61e17c22f317825d653845b8767d8eaa4660eaa96972dd2dc895514
SSDEEP 768:9DmjYqmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEPLlrZ+Dtrof5laW:9DmjYqmWvmKyEu1jaHPLZQDGRT
TLSH
T1D4C2E93B244CCF7E4FC01A9DDD5A6F972EA802C76A588D4087FA954C02C77EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 3f56751bdbca59a46472fa1f27700371399114c48df7f9508f2e349600747350
MD5 1e460e20e70770f5dec7a2408281c7cd
SHA1 6373d72752ba4cefba26c8ca0986c2e9f846e515
SHA512 2d14dee595f6b08fb8dfdf3e291d413425684f073ab29aa44e44c037182b48427046a25bc2c31e6f3ab3e46dc6fbd212d15fa05317dbeb22cdcf247a044d93d6
TLSH
T13E216051793606403C7D350C817AC4568AC2F0623126E63B7FB809E51B67E63AFBEDC9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 61f70dab8125dcc53c0ed8995a0ecbc73b53c4c0ddc0e0d3d67b80247aefd069
MD5 25f6bf46a77c5e71eb4084d3395383e6
SHA1 676f5504ff756d968aa8410ac6ce0f582732e444
SHA512 1f6de62a4834cc913e510a21de5a804c7275ca19d782c79a06434637bc5d25f09331601144f72edfb81fc6a2e45d12430349c0c3dce907d51830f0e3b7027150
TLSH
T1AD516055753606403C7D290D817AC4168AC1B0623126E53B7BF805E61B67E63AFBEDC9
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 744c603e46ef9b34aa82c834318f08f5d02079a959db8afd51acd41a14ecbdfa
MD5 39830e60362b88c1a1fbde6f8f8f82d6
SHA1 7b0a6f243d6c75d1b71c2a7dbfb7175631a2a1b5
SHA512 38abef763a52af8b14793b316843ced66cfbe2631fd3ad8d59741dd73cc83b08fcfefe3085ee1ee511cf9c4b9a126ea33783c6e5dc6f06465cad0dbd405fa1f8
TLSH
T11E2156C0A3A964947F49AA41C12E9413D0E17E35171F9932233E81F45F84C27AF2FFA1
MD5 SHA1 SHA512 TLSH

Submit Download

28ae5ca9-1005-4fb0-86f1-f94dc15d076e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\28ae5ca9-1005-4fb0-86f1-f94dc15d076e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b3b599cfae9728a8631f701829fb4e64cc9ef6ff88a4d46e55ab6ff6c4589f10
MD5 2d99e7df1abc158381f54d21db0c65e5
SHA1 28aa1f3ce633701d6779e2c2af78cbfdaea9bf8f
SHA512 d68d79847e70454135e325a11ca3dc252900c5032cb237abd84c43675588bc05ab007dc3d151058e4ba02e54504da7fd95ed339809fe84ed923982021ae617d5
SSDEEP 192:zLLsNGTQKTdeZEhWdQmiU1A37ZH/+jVWjzor2t+XH+2i5cOT1q8PunJZ5l:z3sNGThdfkbClf+k82EXH+2NcJKZf
TLSH
T1B2423B35A879DC2788E6E545F44B36A39EF810BB9DC56F44E9E85F1C008B69C270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 4189b06918972b2ab70ffbdf77d6840b4464f89bea7e1946f679b61e8c4b25d0
MD5 f1cf06c406c79d40b947ac2bf812fbaa
SHA1 a04064f42efec363c8f537cb9237b0864b9b0829
SHA512 1c869bdaeb09f4ecdbdf54999694a2d8c289e869ce58b37714ada4dc8c641c37194c422dceff70270dbfa7a00ff3f85e6b0fb303343108cde26752a914cc3a60
SSDEEP 384:nLiF9sNG8TUNTUlIlAhdfkbCkrDfQx+k82EXH+2vFJKZf:mF9PwgIdLfxIHltJKZf
TLSH
T1F282F836D8A5CE2BACE697C5F6077693DEF011A789C99EC4DAD85E0C00872ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b61f651e8df38fa6802889882b74de440a8618e0db6a5ff6991ae71ef763019c
MD5 79d13a7df0ea42c742bb9018c2d1efa4
SHA1 dcd48e3463f42d8748ec4b6c7dfafaece1351407
SHA512 68e5e9d02de21a8252826d730a94dddb52d7823ef609bb0556146f96dfb33b58c28092df85d791247530a5c940a3e288dd71189ecd3c7d5897ee69aa10126287
SSDEEP 192:uu5LsNGAQKTdeZEhWdQmiU1A374H/+jVWjzor2t+XH+2M5cFT1q8PunJZ5l:nlsNGAhdfkbCkf+k82EXH+2vFJKZf
TLSH
T188424C356879DC6388E6E545F54B32A39EF810BB9DC56F44EAEC5F1C008B69C270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a59ce4b02802979cc8e342f8220f7afb7bcf01802c2ae0277c92d9700c7b32f2
MD5 c8a2e503ddfeddcd8404b06ed2eb386a
SHA1 a01469b4f9495c2bd2a542ee3811dc99bb3f22d3
SHA512 5302c8d5bb5cf99beaeb2cc1a01a74af01f2e39fdcb23d0feb046bc9580ab63f63d6e8b0a8d252821d7f5092c0419b46e68cd29b7accf21e463923bbdbe3a43e
SSDEEP 192:z5LsNGAQKTdeZEhWdQmiU1A374H/+jVWjzor2t+XH+2M5cFT1q8PunJZ5l:zlsNGAhdfkbCkf+k82EXH+2vFJKZf
TLSH
T18F424C356879DC6388E6E545F44B32639EF810BB9DC56F44E9EC5F1C008B69C270B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 712ea0ec650f5975588d5035a0226f8d0f590b5bcab388fb95e2ff9deaa9a415
MD5 829726c3d7fb612b4013cc22e76e2a99
SHA1 1a040836615d37169365b820a9f3c8eb1bd461a8
SHA512 b698f518d01df2cc28ac51346d53e901123b44c1d81e6b56a90050302f06104f522411eed6877222757015f8447114b18159983562b52fde5da30d8a634616b1
SSDEEP 192:EONq6hZ0QmiUy5apc/+jVWjzor2tn5wOZARU6:EONq6oXpu+k82A2IU6
TLSH
T16A02E93568786CB78EE2AE45F48727235FE4116BEA956F84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b031cef9b27ba505fb5e6ba51962889338fd67c4755c5352e58cad6e0ef5332d
MD5 3fb74c02233c2bc688b9163d237429f3
SHA1 f197643cfda85efe71b6b2f401af47f2771ba712
SHA512 73ab98602777348ff5b0f03c0f72a575bc17cbec8e0ac2ca84f2142d6b29eb3458675eeba6ecb79de6c0b507e34b096013ca6382b3c1ffa4a5d92b950977af3f
SSDEEP 384:nLiF1tNn/s3n9SAzsNG8TUNTUlIl4hdfkbCkrDfQx+k82EXH+2vFJOObjI9G6w7L:mF1j+9nPwgcdLfxIHltJ29ML
TLSH
T116B23A36D8A5CE67ACE28BC5F64B36979EF011A789C99EC4E9D85F4C00C76EC070AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e283c2160d66958aacee114d63402d5c7356960853277438029f2b23a9c1af5
MD5 e8333918ab711bd343420f424841cb89
SHA1 c7b8fcf6d318749374983e05926f396b6e248cbd
SHA512 6f12972598cacf97b439877a7faeeae94abfb1cc41c6461092681365cfa0d5fa043b2e8b2e1543ce67a9aa6910db0d44c45188bc34c5546f57277ded7a46fd2b
SSDEEP 192:OON36hZrQmiUynakc/+jVWjzor2t+XH+2y5cOq1q8PU6:OON36BPku+k82EXH+299JU6
TLSH
T1AB12FB35646CEC674DD2E555F08732A39EE82177AD86AF84E6E85F1C00C779C2B0F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 142555e6be7e84415b7261c6b23af9020be89f17e4714612287909985b4f903b
MD5 2c5a65b8e86b6554ab03d1823cbbd3a3
SHA1 9274644566720a99a7b8da1eade59439397d20cb
SHA512 12aae1038cc66dac62c5e1b30b7ff1480ed40149c132a58b8c67d8fb28b35c144f031e78cb2f2ccf634043a6e7271b66ee98db4645b0cd10e0465340eb427b72
SSDEEP 384:nLiFazsNG8TUNTUlIl4hdfkbCkrDfQx+k82EXH+2vFJKZf:mFyPwgcdLfxIHltJKZf
TLSH
T13782F836D8A4CE2BACE697C5F6077693DEF011A789C99EC4DAD85E4C00872DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c77a28e2-a034-4605-aade-b790a15812e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c77a28e2-a034-4605-aade-b790a15812e7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2612af6b20b9868d70997dcddafa9d8102189c303c8fd57552a487ab01179b63
MD5 6407c03025a6c7eb39d5f845ff7e2c7b
SHA1 947c91e69c45f2c8ea72b0e1d9afe62e6fe16be3
SHA512 76931922fe325678005c222cf19a8b4ac2030f732947cc388a4c2eaf4cdf36b71aac3a94ad740dfc2cf2bf5c564f7028bbcee83e6d7ff0bbedb7fddd7615ec11
TLSH
T19C412959BAFE1148B3B76F56AFF6A86D447A78771E46905E10010D0F0A23B40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

8e071083-4bf9-423f-b07a-9980d8a70fb0.tmp

Path C:\Users\Admin\AppData\Local\Temp\8e071083-4bf9-423f-b07a-9980d8a70fb0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lj0wrjmr.4qs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lj0wrjmr.4qs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d2d56a43-a07c-4ee8-9921-76f9e6723bd6.tmp

Path C:\Users\Admin\AppData\Local\Temp\d2d56a43-a07c-4ee8-9921-76f9e6723bd6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eefd3e75-cf0e-402a-b9ce-2bb21360bc90.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir464_231766653\eefd3e75-cf0e-402a-b9ce-2bb21360bc90.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\eac-bootstrapper\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/4220-17-0x000001A827E30000-0x000001A827E52000-memory.dmp

Download

memory/5676-30-0x00007FFF55D10000-0x00007FFF55D11000-memory.dmp

Download

memory/5676-29-0x00007FFF55230000-0x00007FFF55231000-memory.dmp

Download

memory/5676-241-0x0000024A8C060000-0x0000024A8C79F000-memory.dmp

Download